A company was conducting an internal corporate investigation of potential antitrust violations by a newly purchased subsidiary and had issued a litigation hold barring any data destruction of records relating to the product lines at issue in the antitrust investigation. Stroz Friedberg was assisting in the data preservation and identification effort in the internal investigation. A senior manager appeared to have deleted relevant records within several days after the litigation hold had been issued, and Stroz Friedberg was tasked to examine the manager’s workplace computer to evaluate his deletion activity. After preparing a deleted files spreadsheet, which is a useful tool to aid in the investigation of deletion activity on a particular hard drive, Stroz Friedberg determined that files with relevant file names did appear as deleted files but that those files were temporary files, created and then deleted by the operating system rather than the user.
This indicated that after the litigation hold had been issued, the manager had accessed and reviewed relevant files on his computer, and that during that process the computer had automatically saved temporary copies of those files, which the computer subsequently and automatically deleted. No original relevant files had been deleted and the manager was exonerated.