When “Corrupted Data” Doesn’t Quite Add Up
Let’s dive into another interesting case from our files. This matter had already been dragging through the courts for years, locked in heated litigation. We hadn’t done much forensic work early on, just imaging and basic analysis of computers tied to the case.
Then things took a turn.
We were asked to look closely at a contentious file. Our forensic analysis revealed two critical insights:
- The file was not as old as it was claimed to be.
- It almost certainly originated as an email attachment.
When we requested the original email, opposing counsel told us it was lost due to “corrupted data in an email system.” According to them, their internal IT had already tried to recover it, no luck.
Oddly enough, this seemed to satisfy most people involved. But it didn’t sit right with us, or with our counsel.
The Judge Steps In
As our side continued to press for the original emails, the judge grew increasingly dissatisfied with the opposing side’s vague explanations. Finally, the judge ordered them to turn over specific user accounts, exported from their email server, so we could investigate directly.
You’d think if their data was truly lost, they’d welcome expert help. Yet they still resisted, dragging out the timeline at every step. When we finally received the exported data (after a suspiciously long wait), we found what they’d handed over was indeed corrupt.
From Dead Data to a Live Case
At this point, a standard e-discovery approach likely would’ve stopped cold. Those corrupted email databases, some between 10GB and 90GB, wouldn’t have yielded anything. The emails would have remained “lost.”
But that’s not how we work.
Our job isn’t to merely hand over easily retrievable files from My Documents or the Recycle Bin. We rebuild. We index. We carve through unallocated data looking for remnants of deleted emails. That means not only recovering whole emails but also fragments, headers, attachments, and metadata.
Why? Because we’re after the smoking gun, not a shotgun blast of irrelevant data. Our goal is always to help our clients win, which means targeted, meaningful discovery.
What We Found, And Why It Mattered
As it turned out, there was plenty buried in those files. Gigabytes of emails. Tens of thousands of messages. All from accounts the other side had represented as irretrievably lost.
Among them were multiple versions of the original attachment we’d questioned. These emails showed a clear evolution, versions being revised over time, which directly supported our client’s allegations. The bigger problem for the other side? These emails also revealed who had originally sent them and exactly when. All of it undercut the narrative they had tried to present.
Once our findings were laid out for our client’s attorney, their client, and ultimately the court, the other side quickly changed their tune. Just as we were preparing to testify as expert witnesses, they decided it was time to “come to the table.” A settlement was soon reached.
More Than Just Finding Files
This case highlights an important distinction between typical e-discovery and true digital forensics. We weren’t simply reporting on what files existed. We interpreted the evidence, tracked down inconsistencies, and directly dismantled the excuses offered by the opposition. That’s what ultimately moved the needle toward a favorable resolution.
A Final Thought
Does it always end with a dramatic smoking gun? No. In digital forensics, sometimes absolute proof of wrongdoing isn’t there. But your odds improve dramatically when you have seasoned experts, people who are passionate about digging deeper, questioning assumptions, and following the data wherever it leads.
In this case, we found both the smoke and the gun. Once again proving the old saying true: where there’s smoke, there’s fire.
As you’d expect, the names of individuals, companies, and a few unnecessary details have been omitted to respect our client’s confidentiality.
About Swailes Computer Forensics
Swailes Computer Forensics provides expert digital forensic services to law firms, corporations, and organizations nationwide. Our work includes investigations into intellectual property theft, employee misconduct, data breaches, and more. With decades of experience and a commitment to integrity and clarity, we help clients uncover critical evidence and take informed action.
If you’re facing a potential case of employee data theft or have concerns about unauthorized activity, contact us for a confidential consultation.