When Should You Search for Deleted Files?

Trash Can Icon used by Apple The District Court in Tampa recently issued a discovery Order involving deleted email. Wells v. Xpedx, 2007 WL 1200955 (M.D.Fla. April 23, 2007). The case raises the interesting issue of when you should search for deleted files, and when you should not because they are “not reasonably accessible” under Rule 20(b)(6). In my view, this often hinges on whether or not the files were “double-deleted.” The order in question granted plaintiff’s motion to compel a 30(b)(6) deposition of defendant’s IT representative, but deferred ruling on the companion motion to compel production of deleted emails because there was an inadequate factual record to decide the issues, and for that reason the deposition was allowed.

The dispute began after defendant Xpedx produced its written records retention policy manual. The manual showed that Xpedx had introduced a new email retention policy in 2003 wherein emails were automatically deleted after 90 days, unless they were specifically designated for retention. The manual explained that if an email was not designated for retention, then after 90 days the automatically deleted email could not be restored, without consent of the company’s legal or tax department.

Not surprisingly, plaintiff sought a deposition to learn what this policy meant, and specifically to explain the procedures for retrieval. Further, plaintiff hoped to discover in that deposition if any emails were destroyed relating to his claims. Plaintiff also sought to compel production of all Xpedx emails related to his claims. During the hearing on the motion to compel, the plaintiff narrowed the scope of production request to any emails containing his name, Joseph Wells, in certain time periods in 2002 and 2003 by seven Xpedx employees.

The defendant opposed the deposition, arguing that it was unnecessary because it had already produced its records retention manual. This argument was not persuasive in view of the vagaries of the wording of the policy, especially as to the approval of restoration of deleted emails by the law or tax department. Further, a plaintiff in this position is normally permitted to inquire whether the actual practices of the company comply with the policy directives. Defendant opposed the motion to compel because it argued that all relevant emails had already been produced. This is a very dangerous argument, as many defendants in the past have discovered, including UBS Warburg and Morgan Stanley.  After you make that kind of representation to a court, it tends to look bad if relevant emails are later discovered, no matter how innocent and understandable the mistake. Finally, defendant argued that if there had been any other emails that were not specifically preserved, then they would have already been deleted under its 90 day policy. Magistrate Judge Elizabeth Jenkins, who is well known in Central Florida for her good analysis and pragmatic results, begins her discussion of the email discovery dispute by noting that:

Deleted emails are, in most cases, not irretrievably lost. Discoverability of Electronic Data Under the Proposed Amendments to the Federal Rules of Civil Procedure: How Effective Are Proposed Protections for “Not Reasonably Accessible” Data? 83 N.C.L.Rev. 984, 988 (2005).  Deleted emails may remain on a computer hard drive, servers or retained on back-up tapes. Id. at 988-90.

So far, so good; but then Magistrate Jenkins goes on to hold that: “The producing party has the obligation to search available electronic systems for deleted emails and files. Peskoff v. Faber, No. 04-526 (HHK/JMF), 2007 U.S. Dist. LEXIS 11623, at *13 (D.D.C. Feb. 21, 2007).”  There I think the opinion goes too far, or should have been better qualified and clarified to apply only to “once-deleted” emails and files, and to exclude “double-deleted” files. 

First let me explain what I mean by these terms.  As everyone knows, if an email in Outlook is deleted, it is not erased; it is just moved into another Outlook folder for deleted files. It is still readily accessible. Any user can change their mind and restore the email. But if an email in the Deleted Folder is deleted again, in other words “double-deleted,” then it is no longer indexed in Outlook, and no longer readily accessible (unless, in some circumstances, as one observant reader pointed out, it is still within a double-deleted email retention period set by the Outlook Administrator; usually only seven days).  Of course, double-deleted files are not truly deleted yet on the hard drive, but the file markers pointing to it and identifying it have been omitted (or, in some cases, will soon be omitted). These double-deleted files still exist, they have not been erased, but, in most cases at least, they are no longer easy to find and retrieve.  It requires some level of forensic examination to locate and try to retrieve them.  In fact, in some circumstances, double-deleted emails may be impossible to retrieve from the hard drive (be it server or PC) because they have been written over by other files. The same process applies to “once-deleted” files in the Windows operating system environment.  They are not removed from an index of files when first deleted; they are simply moved to a new location, the Trash directory.  But if the Trash is emptied, the pointers for that file are removed, and the space is considered to be available for writing new data.    

So, back to the opinion, which states a party has an “obligation to search available electronic systems for deleted emails and files.”  If the phrase “deleted emails and files” is construed to mean “once-deleted,” than I agree completely.  These files are readily accessible.  But, in most circumstances, it would be wrong to try to stretch the meaning of this holding to also include files that have been “double-deleted,” and thus require forensics to locate and restore, or resort to a search of back-up tapes.  

In my opinion, and that of most commentators and courts that have squarely faced the issue, the obligation to search for “double deleted” files should not arise in all circumstances.  This duty should only arise in certain special circumstances, where, for instance, there is evidence that highly relevant emails have been double-deleted, and therefore that there is good cause to go to the extra time and expense inherent in a forensic examination for such files.   Most courts do not require an extraordinary search for deleted files, unless and until special circumstances are shown to warrant such extraordinary efforts. See for example, Hedenburg v. Aramark American Food Services, 2007 U.S. Dist. LEXIS 3443 (W.D. Wash. Jan. 17, 2007) discussed in my blog entry of February 25, 2007.   

The facts alleged by Xpedx to oppose the deposition of its 30(b)(6) IT representative suggest that the emails sought were all “double deleted.”   But it is not clear, and in fact, that was the plaintiff’s whole point.  His motion to compel the deposition sought discovery of the facts surrounding these emails and deletion.  The deposition should reveal whether or not the emails in question were once deleted, and thus reasonably accessible under Rule 26(b)(2)(B).  If they are twice-deleted, and further, if under Xpedx’s computer system that means that they are not readily accessible, as I suspect, then an entirely different legal analysis applies to determine whether the plaintiff is entitled to compel production of these emails.  If they are not reasonably accessible under Rule 26(b)(2)(B),  then the plaintiff would be required to make a showing of good cause sufficient to justify the extra expense of location and recovery of the double-deleted emails. 

For these reasons, Judge Jenkins’ order compelling the deposition makes good sense, especially when you consider she limited the deposition to four hours and permitted it to occur by phone.  It also makes sense to defer ruling on the motion to compel.  This motion cannot be properly determined without evidence as to whether the deleted emails are reasonably accessible, and if not, whether the facts and circumstances show good cause for them to be produced anyway, perhaps with cost sharing as suggested by Rule 26(b)(2)(B). 

5 Responses to When Should You Search for Deleted Files?

  1. Must You Retrieve Deleted Files?

    How far do you need to go to recover deleted emails? As the Federal Rules of Civil Procedure are further defined by the courts, we are beginning to see some definition. Magistrate Judge Elizabeth Jenkins of the U.S. District Court

    Like

  2. […] E-record expert Ralph Losey notes that there’s a difference between deleted and double-deleted. […]

    Like

  3. “But if an email in the Deleted Folder is deleted again, in other words “double-deleted,” then it is no longer indexed in Outlook, and no longer readily accessible.” — Just because the message is “double deleted” in Outlook does not mean that it is not accessible. I’m assuming that you are using Outlook against the Exchange server. The majority of Exchange admins will set a “Deleted Items Recovery” retention period. This means that even if the email message is “doubled delted,” it can be recovered from the Exchange server. If the user is using Outlook 2003, the email message may be recovered from its cache. (see http://www.computerperformance.co.uk/exchange2003/exchange2003_recovery_deleted_item.htm).

    Other email systems have similiar functionality. The GroupWise client, for example, has had a desktop cache feature for years.

    I’ve never heard the term “double deleted,” and I suggest that it is a poor term because it infers that the message is truly gone (outside of the message fragments hanging out on the hard drive).

    Like

  4. ralphlosey says:

    You make a point that even a double deleted email may still be easily restored in some circumstances where it is still within an administrator set time recovery period. I assumed for purposes of simplification in this blog that it was not. But I admit the example you provide could be an exception, depending on time frames, to the proposed general rule of when an email is not “reasonable accessible.” Note I say, in accord with the rules, not “reasonably” accessible. I do not say not accessible. Yes it can be accessed, most every thing can be restored and accessed, but at what costs and time or effort. that is where the reasonability component comes in.

    The term “deleted” itself infers a message or file is truly gone. That is or should be your true gripe, and blame Microsoft, not me. The modifier “double” is easy to understand, and does not imply true erasure; just that retreival may, I would say usually is (depending only on the time quirk you mentioned), more difficult to restore.

    Like

  5. […] where computer disks are imaged, and forensic exams are performed to restore and search deleted files, fragments, Internet cache, slack space, memory, and the like.  A diagram providing a simple […]

    Like

%d bloggers like this: