VirtuSky

For years, parties to litigation have been demanding the production of data from various electronic sources. These sources have included desktop computers, laptops, servers, emails, and, most recently, mobile devices and the cloud. All of these locations are relatively easy to collect, preserve, analyze and produce from in both computer forensics and ediscovery related matters. One location that has often been a point of contention, though, is the dreaded backup tape.

For years, backup tapes were the dreaded discussion point both in determining one’s own obligation to preserve and produce as well as in requesting discovery from the other side. Tape backups are generally only found in enterprise environments, and the content and rotation of the tape library can make any meaningful discussion about the tape’s content difficult at best. Yet, the tape backup is a potential gold mine of discoverable data, especially in matters where spoliation is an issue. Tape libraries, though, historically have been very difficult to restore from, both from a cost perspective as well as a technical perspective. In the original Zubulake v. UBS Warburg, 217 F.R.D. 309 (S.D.N.Y. 2003), the court found that tape backups fell within the realm of inaccessible or unduly burdensome to produce (although later an exception was made for certain tapes and kinds of tapes).

Obviously, when it comes to the tape backup dinosaurs, FRCP Rule 26 goes so far as to provide an exception for electronically stored information (“ESI”) that is “…not reasonably accessible because of undue burden or cost.” “Undue burden or cost” is a very good way to describe tape backups as they have a reputation for being cumbersome, expensive and fragile.

Many Apple computer users in individual, SOHO and enterprise environments, use Apple’s Time Machine for backups. Apple Time Machine provides immediate access to versioning history for a user’s files and folders, retaining hourly backups for the past 24 hours, daily backups for the past month, and weekly backups for all previous months. The oldest backup versions are deleted when Time Machine begins to run out of room for storage. To restore a file, all a user must do is point and click on the file within Time Machine and restore it. So, to summarize, it’s nearly as easy to use as finding a normal file or folder, and is both free to use and requires very little specialized skill or excessive manpower.

I think we just found the antithesis of “Undue burden or cost.”

So what does this mean for your clients who use Time Machine as a backup solution? First, the Time Machine backups should be considered as a viable ESI location for the purposes of a litigation hold policy. Just because a user does not have the “smoking gun” document in their “secrets” folder does not mean that the file is not still on the computer in the Time Machine backup. When you or your client are forced to search and produce ESI, Time Machine backups may be a viable source of collection since they are not unduly burdensome or costly to access. Second, Time Machine backups should be incorporated into any internal litigation hold processes that are enacted. Since Time Machine works on a “rolling basis” whereby the oldest data is purged when space is needed, consideration must be made to preserve the backups along with the actual data to prevent spoliation claims. Finally, users should be aware of how Time Machine works in terms of recording versions of documents on an hourly basis for the first 24 hours, then daily versions for the next month, and finally weekly versions for the remainder of time. Sometimes having drafts and previous versions may lead to unintended consequences. Time Machine has the ability to purge all backups of specific files as determined by a user, but of course this would not be prudent if a duty to preserve exists.

If you are in the position to be requesting preservation and production of ESI, be sure to include the Time Machine backups if applicable. Additionally, when you send your litigation hold notice to opposing counsel, indicate that the Time Machine backups are included in what you consider as possibly relevant.

If you have any questions about Time Machine backups, or ediscovery in general, email Peak at blog@peakforensics.com or call 602-354-8950.

ABOUT Peak Forensics: Peak Forensics is a full service Computer Forensics, Electronic Discovery and Consulting firm in Phoenix, Arizona.  Peak Forensics fills a need for experienced, professional computer forensics services, client centric electronic discovery and seasoned testimonial and trial consulting services.  Peak’s CEO and founder, Jefford Englander, has been actively participating in computer forensics and ESI investigations for 15 years and has a background in local and federal law enforcement and the civil litigation realm.  From ESI collection to forensic analysis, hosted review, reporting and expert testimony, Peak can lead you to focused information.