Judge critical of evidence spoliation

Among the interesting facets of this case is the magistrate's critical comments regarding the plaintiff's treatment of electronic evidence "having irreparably altered the evidence on its hard drives by running scans on its computers and continuing to use them prior to making proper forensic copies.”

While every situation is different, collecting electronic evidence in a forensically sound manner should be the first stage of a forensic process. It's often also the quickest and cheapest. Failure to do so can not only bring the integrity of the evidence into question, but significantly reduce it's forensic value in proving (or disproving) the facts in a case.

Read Brian Krebs' analysis of the case here.