Gates Rubber Company v. Bando Chemical Industries, Ltd., et al.^[1] is a decision by the U.S. district court for the District of Colorado from May 1, 1996. It is considered a landmark decision^[2] in terms of expert witness court testimony in questions of electronic evidence^[3] and digital forensics.

In a nutshell, the decision states that the authenticity^[4] of electronic evidence is accepted by courts only if the party adducing the evidence complied with the newest technical standards of electronic evidence acquisition.^[5] Moreover, U.S. magistrate judge Schlatter commented on the factors he considered relevant in the process of weighing the qualifications of digital forensics experts when those present contrary opinions or conclusions to the court. Hence, Gates v Bando has set legal standards for examining electronic evidence that have remained relevant to this day.^[6]

Gates Rubber Company and Bando Chemical Industries were both involved in the manufacture of industrial belts as direct competitors. Several defendants aside from Bando were former employees of Gates, who had signed written non-competition agreements before they left the company. In 1989, Gates learned that the latter used a computer program highly similar to one of its own, so that Gates suspected its former employees had stolen, copied and used it for Bando. Accordingly, Gates filed several actions on the grounds of unfair competition, misappropriation of trade secrets, infringement of copyright, and breach of contract.^[7]

During the court proceedings, in 1992 Gates learned that N., one of its former employees, deleted a computer program from his computer at Bando, which Gates claimed to be an unauthorized copy of a copyright-protected software of his own. Furthermore, (and actually decisive as regards the influence of digital forensics in trial), N. also "deleted" several word-processing files on the same computer, testifying that he did not erase any materials relevant to the pending litigation. Consequently, Gates applied for disclosure, in order to examine whether or not the defendant had maliciously deleted files in an attempt to destroy evidence. The court granted Gates a court order that allowed Gates to copy the hard drive of Newman's computer in order to obtain as much information as possible from the "deleted", but reconstructible files. Gates then assigned the technician V. to execute the copying of the hard drive, whereas he subsequently also appeared as Gate's expert witness in the court procedure.

In retrospect, the technical method V. applied to create a copy of the hard drive of N.'s computer as well as his formal professional qualification as a digital forensics expert (particularly in comparison to the expert witness summoned by the defendant) turned out to be the crucial aspects that were decisive for the outcome of Gates claims arising from Bando's alleged violation of disclosure obligations through spoliation.

In the course of his examination, V. copied a software onto the hard drive of N.'s computer (which contained the evidentiary electronic files), in order to create a file-by-file copy of the hard drive. This conduct induced the court to extensively comment on the forensic methods that must be applied to electronic evidence to allow it to be used as a piece of evidence in court procedure:

First, the court stated that - as a general rule - any digital forensic examiner shall be obliged to "utilize the method which would yield the most complete and accurate results"^[8] in order to comply with the legal prerequisites in regard to the admissibility of evidence in court procedure. As a result, several organizations started to continuously publish best practice literature for electronic evidence acquisition.^[9] However, it should be kept in mind that such a best practise prerequisite must be considered a dynamic procedural hurdle, as the technical requirements and possibilities in analyzing and copying digital data change with the underlying hard- and software, and consequently the technical procedures to be applied in order to create a legally permissible piece of electronic evidence may change in the future.

Second, the judge held that the file-by-file copying procedure applied by Gates' forensic examiner fails to fulfil the court's "best practice" requirement. Instead, it had been necessary for a forensic investigation de lege artis to copy the hard drive by means of creating an image (or: mirror) copy:

"Gates retained V. as its technician to do the copying, and he attempted to do this through the use of a program called Norton's Unerase. Proper use of the program could yield information, or partial pictures, about files which were once present on the computer's hard drive, but were deleted.

Gates argued that V. did an adequate job of copying the Denver computer. W. (the defendant's expert witness, remark of author) persuaded me, however, that V. lost, or failed to capture, important information because of an inadequate effort. In using Norton's Unerase, V. unnecessarily copied this program onto the Denver computer first, and thereby overwrote 7 to 8 percent of the hard drive before commencing his efforts to copy the contents... Additionally, V. did not obtain the creation dates of certain of the files which overwrote deleted files. This information would have assisted in determining the deletion date of some files.

W. pointed out that V. should have done an "image backup" of the hard drive, which would have collected every piece of information on the hard drive, whether the information was allocated as a file or not. Instead, V. did a "file by file" backup, which copies only existing, nondeleted files on the hard drive. The technology for an image backup was available at the time of these events, though rarely used by anyone...

I find that the duty was on Gates, and not Bando, to utilize the best technology available."^[10]

The standards outlined above have become the general standards in computer forensic examination.^[11] According to these statements, electronic data, which is recovered from computer hard disk (or any other form of electronic storage unit for digital information) is permitted to be used in court procedures only, if the data is duplicated and verified in a forensically sound manner. The forensic examiner in Gates v Bando (V.) failed to create such a forensically sound duplication since the installation of the examiner's software could have overwritten existing files on the hard drive, this is the constitution of the evidence was altered even before the copy was made. Correct duplication, however, requires that any alteration of the data during the process of copying is reliably excluded. This requires that:^[12]

1. The image is an exact, bit-by-bit duplicate of the original computer drive,
2. The image is taken in such a way as to guarantee that the original was not changed,
3. The image is examined in such a way as to guarantee that the image is not changed.

In practise, proper duplication is usually warranted by write-blocking of the original storage device.^[13] Correct verification means that the electronic evidence presented to the court must be provably identical to the one originally investigated, which usually is warranted by means of a hash value, an algorithm that calculated a number based on the content of the respective piece of electronic evidence.^[14] In the present, compliance with this "best practise" requirement can usually be achieved by using a proprietary software for imaging, as this will admittedly preserve the evidential value of the electronic information recovered.^[15]

Expert qualifications are considered by both lawyers and experts to be very important, and in the case of Gates v Bando, the court reaffirms that widely accepted belief.^[16] Judge Schlatter stated in this context:

"Bando's expert on matters associated with computer science was W., who holds a Ph.D. in computer science from Stanford. W.'s credentials, experience and knowledge were impressive, and I relied upon his opinions. Gates failed to obtain a similar expert in timely fashion. Gates did offer the testimony of V., the technician who was hired by Gates to copy the hard drive of the computer at Bando's Denver facility. His credentials, experience and knowledge were nowhere near those of W., and I placed much less weight on his testimony than on W.'s."^[17]

The court strongly relied on the experts' formal professional qualification, as it was obviously the most distinguishable criterion in this case. However, most cases in litigation are not that unambiguous. Then, the factor of an expert's actual professional appearance - including but not limited to the ability to impart non-legal knowledge to the court, the thoroughness of the report and the traceability of the expert's inferences - will play a larger role. Additionally, a major practical issue for judges dealing with issues of electronic evidence remains in the lack of measurability of IT expertise, partly due to the absence of uniform formal professional qualification^[18] in this field.^[19]

The case of Gates v Bando surely highlights the necessity of selecting a given digital forensics expert carefully when it comes to civil litigation involving digital evidence issues, as such expert's opinion often turns out to be decisive for the outcome of a case. But the parties' due diligence in such cases even goes further: it is not only the selection of an expert witness in the litigation stage, but already in the pre-litigation phase attorneys and experts are obliged to ensure the correct acquisition of electronic evidence which is potentially relevant to their case. Moreover, they have to develop and apply an evidential reasoning that could both professionally withstand an opponent forensic expert's testimony and factually persuade the judge and/or the jury in the courtroom.

Apart from that, the course of the court procedure has (relatively early^[20]) illustrated the potential economic impact of E-discovery issues on litigation: originally initiated as a secondary theatre of war in an IP litigation, these issues soon snowballed to a case of its own that finally achieved economically and temporally dimensions exceeding the original matter in dispute. Today, more than 90% of all corporate information is stored electronically.^[21] Typically enough, digital forensics has become a big business with an estimated market value of 780 Mio. $ in 2011.^[22] Generally speaking, the outcome of an increasing number of cases in all fields of law will depend on issues of digital evidence.^[23]

To the same extent which Gates v Bando illustrates the necessity for litigation parties to carefully plan and execute a sophisticated strategy in terms of electronic evidence, however, it must be realized that it ultimately describes a recurrent practical problem: as IT and its relating tools and techniques will progress and the courts will (presumably) carry on to demand the application of the very best method available to warrant an electronic evidence's authentity, the absence of commonly court-accepted standards will emerge again and again. One potential solution for litigators to avoid the repeated occurrence of this issue might lie in entering into pre-trial agreements with their opponent, in which they agree upon certain conditions for the mutual recognition of their electronic documents' authenticity.^[24]

• Computer forensics
• Electronic evidence
• Expert witness

Reliability of digital evidence in general:

• United States v. Scholle, 553 F.2d 1109 (8th Cir. 1976)
• United States v. Vela, 673 F.2d 86, 90 (5th Cir. 1982)
• United States v. Bonallo, 858 F. 2D 1427 (1988)
• John Paul Mitchell Sys. v. Quality King Distribs., Inc., 106 F. Supp. 2d 462, 472 (S.D.N.Y. 2000)
• Schaghticoke Tribal Nation v. Kempthorne, 587 F. Supp. 2D 389, 397 (D.Conn. 2008)

Authentification of E-mails:

• Kearley v. Mississippi, 843 So. 2D 66 (Miss. Ct. App. October 22, 2002)
• Fenje v. Feld, 2003 LEXIS 24387 (N.D. Ill., December 8, 2003)
• People v. Downin, 828 N.E. 2d 341 (Ill. App. Ct., April 29, 2005)
• United States v. Safavian, 2006 U.S. Dist. LEXIS 32284 (D.D.C. May 23, 2006)
• Scheuplein v. City of W. Covina, 2009 Cal. App. Unpub. LEXIS 7805 (Cal. Ct. App. Sept. 29, 2009)

Authentification of electronic document printouts:

• United States v. Melenberg, 263 F.3d 1177 (10th Cir. 2001)
• People v. Markowitz, 721 N.Y.S.2d 758 (Sup. Ct. February 9, 2001)
• Bank v. Eurich, 831 N.E. 2d 909 (S.J.C Mass., August 3, 2005)
• United States v. Lebowitz, 647 F. Supp.2d 1336 (N.D. Ga. 2009)

Authentification of website-content:

• Perfect 10, Inc. v. Cybernet Ventures, 213 F. Supp. 2d 1146 (C.D. Cal. 2002)
• Telewizja Polska USA, Inc, v. Echostar Satellite, 2004 WL 2367740 (N.D. Ill. Oct. 15, 2004)
• Hutchens v. Hutchens-Collins, 2006 LEXIS 87187 (D. Ore. Nov. 30, 2006)
• Lorraine v. Markel American Insurance Co., 241 F.R.D. 554 (D. Md. 2007)
• Williams v. Long, 2008 WL 4848362 (D. Md., November 7, 2008).

• http://www.infolaw.co.uk/newsletter/category/electronic-evidence/
• http://ials.sas.ac.uk/publish/deeslr/deeslr.htm
• http://www.techrepublic.com/blog/it-security/so-you-want-to-be-a-computer-forensics-expert/