E-Discovery Basics: Spoliation and Metadata

This week, I'd like to define the term 'spoliation'. If you are not familiar with the word, you may have to be a little careful - you could mispronounce it. It's not 'spoil-ation' (which isn't a word, according to the Merriam-Webster dictionary), but 'spo-li-ation'.

'Spoliation' is related to the word 'spoil', however, and its first definition comes from the Latin word for 'plundering'.

We are more interested in its second definition, which is to alter a document so that evidence is lost, destroyed, or even just changed.
Spoliation is a bad thing - it can be done intentionally or negligently, and it can be a criminial act.

Spoliation can occur quite often in the electronic discovery context. It usually happens to metadata.
What is metadata? 'Metadata' is data about data. For example, most electronic documents have a creation date, the name of the document's author, the date the document was last saved, etc. All of this is considered 'metadata'.

If the contents of an electronic document are changed (such as text in the body of an email), this is clearly spoliation. However, if even the creation date of a document is changed, this is also considered spoliation.

Why is spoliation important in e-discovery? Spoliation can lead to a judge imposing sanctions or even giving adverse inference instructions to a jury, which, as we have seen, can be devastating.

In my experience, the problem with spoliation usually arises in the context of restoring electronic documents from back-up media such as back-up tapes. It is very possible that some of the metadata is changed in the restoration process. I've found that if spoliation has occured, it is usually the document's creation date that is changed, and it is changed to the restoration date.

For example, an email may be written and sent on 1/1/2005. Its creation date is therefore 1/1/2005. At some point, the email is backed up into an archive. If the email is restored from the archive on 6/25/2009, and the email's creation date is changed from 1/1/2005 to 6/25/2009, then this is spoliation.

Spoliation can happen this way quite often - many regulators and judges are familiar with the problem, and may allow minor spoliation of documents turned over to the court or to the other side, so long as the original archive copy of the data is clean and unaltered.
However, being aware of the situation and notifying the court or the other side is extremely important in this case. Handing over data that has undergone spoliation, and not telling the recipient, is a recipe for disaster.