Meanwhile, in the infamous “Wagatha Christie” defamation trial in 2022, Rebekah Vardy, in a suit against Coleen Rooney, claimed crucial WhatsApp messages between Vardy and her agent were lost during a transfer to her lawyer. Adding to the mystery, her agent claimed her phone was accidentally dropped into the North Sea from a boat while on a family holiday.

In these cases, the judges drew adverse inferences from the missing evidence, highlighting how the destruction or tampering of evidence – whether deliberate or accidental – can pose serious legal consequences.

Breach of contract and evidence tampering

In the case of AEI Insurance Group Pty Ltd v Martin (No 4) [2024], the respondent, a former account manager at the company, allegedly solicited 45 clients to a rival firm after his resignation, despite being bound by a 12-month non-solicitation agreement. This restraint prohibited him from soliciting, canvassing, or approaching AEI clients for business. He resigned in August 2022, and by early November, AEI learnt that 21 clients had already switched to the rival broker. AEI sought an injunction against him, but even after it was granted, 24 more clients moved.

Because the respondent’s phones, which were believed to contain evidence pertinent to the case, were damaged between his resignation and joining the rival firm, extracting evidence was impossible. The defendant alleged that his first phone, used while at AEI, was water-damaged. Just five days after the court issued a discovery order, he claimed his second phone was accidentally run over by a lawnmower.

VIEW ALL

During examination of a third phone, it was found that the call logs had been reset on 24 February 2023, and all MMS and SMS messages prior to 19 April had been deleted. This raised further suspicions about the destruction of crucial evidence.

FTI Technology was engaged as AEI’s appointed independent digital forensics provider and was tasked with providing expert testimony in the proceedings. The judge cited several of these expert opinions in the final judgment, particularly concerning the reset call logs and deleted messages on the phone that was not damaged. Excerpts include:

• Mr Khoury expressed the opinion that it was “highly unusual” for a phone to have no active (that is, non-deleted) SMS messages. Mr Khoury stated that there were a number of explanations for this, including user habits (that is, preferring other methods of communication), manual deletion, factory reset, or data transfer.

• Mr Khoury concluded that the “absence of any active SMS messages on the [Galaxy A53] suggests that the messages were deleted from the device at some time before the delivery” of the Galaxy A53 to him. That is the inference which I also draw. I infer that this was done in order to attempt to ensure that no useful information could be extracted from the Galaxy A53. Mr Khoury also expressed the opinion that the lack of historical call logs before 24 February 2023 “may suggest that the call log was cleared sometime prior to 5:45pm on 24 February 2023”. Due to the lack of SMS messages and other records, Mr Khoury suggested the possibility that Mr Martin may have been utilising an additional mobile device for communication. The court draws the inference that the call log was cleared by Mr Martin sometime before 5:45pm on 24 February 2023 and that this was done in order to attempt to ensure that no useful information could be extracted from the Galaxy A53.

The court ruled in AEI’s favour, awarding $500,000 in damages for breach of contract and misuse of confidential client information.

In the final judgement, Justice Thomas Thawley said: “The court concludes, on the balance of probabilities, that these steps were undertaken with a view to frustrating AEI in its attempts to obtain information from the mobile telephones.”

The critical role of digital forensics in tackling missing evidence

Missing data is not an unknown phenomenon in litigation, but as the case of AEI Insurance Group (and the Wagatha Christie trial) demonstrates, it remains a pivotal issue. These cases highlight the growing interplay between legal proceedings and digital forensics and serve as a reminder of both the risks and opportunities associated with technological advancements in retrieving and analysing electronic evidence.

While advances in digital forensic technology have significantly improved the ability to recover deleted emails, voicemails, and other forms of digital communication, there are limits. Forensic tools can reconstruct data from damaged devices, extract remnants of deleted files, and identify traces of tampering. However, the retrieval of locally stored data from missing or deliberately destroyed devices remains a major challenge. In cases where the physical device is lost or irreparably damaged (such as a phone allegedly dropped in the North Sea or run over by a lawnmower), recovering evidence becomes highly complicated, or in some instances, impossible.

The intentional or accidental destruction of evidence is thus a critical vulnerability in litigation. While forensic analysis can often detect traces of deliberate deletions or device resets, as seen with the Samsung Galaxy A53 in the AEI case, it cannot recover data that no longer exists or was never backed up.

Digital forensics in the AEI case

In AEI’s case, the defendant’s actions highlighted the importance of early intervention and the risks associated with delayed or incomplete compliance with court orders for discovery. Expert-led forensic analysis identified the absence of SMS messages and historical call logs on the defendant’s Samsung Galaxy A53, suggesting deliberate deletions to obstruct the investigation. Despite the substantial lack of available evidence, the court was still able to rely heavily on these findings to draw adverse inferences, ultimately ruling that the defendant had acted to obstruct AEI’s attempts to access relevant evidence.

The conclusions in that case reflect a key strength of digital forensics: the ability to detect anomalies in data patterns, such as missing logs or recently reset devices, and to interpret those anomalies in a legal context. While the devices in question were ultimately unavailable for full analysis, the forensic insights provided a basis for the court’s findings, leading to a significant damages award against the defendant.

Key lessons for managing digital evidence in litigation

The cases discussed herein highlight several critical lessons for legal professionals and organisations navigating disputes involving digital evidence, including:

1. Preserve now, litigate later: Secure all relevant data and devices at the earliest indication of potential litigation to prevent accidental loss or allegations of intentional destruction. For instance, if concerns arise about potential breaches of confidentiality involving a departing employee, immediately implement litigation hold procedures and forensically secure potentially relevant devices and data. This ensures the creation of a forensically sound “point-in-time” snapshot to safeguard the integrity of the evidence.

2. Leverage digital forensics early: Engage digital forensic experts at the outset to identify, collect, and analyse data. Their insights can uncover signs of tampering, deletions, or unusual activity, which can be pivotal in pursuing a legal action.

3. Invest in backup solutions: Ensure that critical data is regularly backed up to secure, centralised systems or cloud storage. This mitigates risks of accidental loss and provides a reliable source of evidence if needed during litigation or investigations.

By incorporating these practices, lawyers can minimise the risk of data loss, protect the integrity of evidence and strengthen their clients’ positions in litigation. In an age where digital evidence is increasingly decisive, preparedness and transparency are essential to achieving favourable outcomes.

Michael Khoury is the senior managing director at FTI Consulting’s technology segment.