This following complimentary form or article is a result of our mission statement: “Making Good Lawyers Better.” Thank you for being a lawyer!

TIP4550 Be Aware of the Evidence that may be in MFP’s

Our message involves mostly a security problem, but there is a court ESI evidence possibility that litigation attorneys should understand. You might want to be proactive and protective of your clients, tell your client about the significant security threat to their confidential information we describe below.

Almost all MFP’s (copy machines, fax machines, Copy/Scan/Print/Fax devices, aka Multi-Function Peripheral, aka Multifunction Printer) manufactured since 2002 contain a hard drive, storing an electronic image of every document copied or scanned on that machine, together with the metadata on when the operation was done and other data about it. Ergo, if your litigation adversary has not removed the hard drive data from the copier, fax machine, or other MFP, you might find evidence in the electronically stored information (ESI) that resides there.

Depending on the size of the hard drive, and how much the copier/fax/scanner is used, it could be years before data is overwritten to the point that it cannot be retrieved by you or by criminals. That’s a security problem when you or your client either sell a used MFP or use a public copy machine.

Want to learn more about the security problem that also is a civil case evidence chance? See the CBS news report available on YouTube.

The chances are small that something has been copied or faxed that is not otherwise discoverable in a computer hard drive or paper file. Remember, what we are talking about is only a digital copy of an otherwise existing original document that was additionally copied, scanned, or faxed. Chances are huge that the original document is going to show up in other discovery responses. (Remember, you are not the CIA, doing a clandestine sweep for evidence.)

The small chance of finding something new suggests that litigation attorneys probably do not want to routinely insist that all printers, copiers, and fax machines be taken out of use until a forensic copy has been made of their hard drives. In the usual case in litigation, such a request is too unlikely to produce something new. In addition, pulling printers and copiers and fax machines out of service pending forensic examination is expensive and disruptive. Plus what you demand your adversary quarantine for forensic examination will probably result in your adversary demanding your client do the same.

Still, in those ‘cost-be-damned’ cases, or unusual cases where the mere fact that a document was copied, scanned or faxed is important, such as a fired employee suspected of making faxing copies of confidential papers to his home, you need to be aware of the evidence that may be in MFP’s.

There are three basic methods of removing data from an office copier or fax machine: the high tech method, the long wait method, and the blunt approach method.

• The high tech method involves using a software program designed to completely erase a drive. Some manufacturers offer a utility to clean the hard drive, but others want to sell you their service to do it.
• The long wait method involves hoping that as your machine randomly overwrites hard drive space over the years, anything confidential will be overwritten and thereby erased.
• The blunt approach is to take the hard drive out, and use a hammer to smash the hard drive, with its electronic bits and bytes, into physical bits and pieces!

Do you, and your client, use any of those methods before selling the office copier or fax machine?