Will Wiping Warrant a Whipping?

Suppose a company sues a former high level employee claiming the employee absconded with proprietary company data in order to use the data in a competitive venture.  If the former employee installs a file wiping program called SureDelete on her laptop and wipes files, has the defendant committed spoliation?  Should sanctions necessarily follow?

What if the defendant only deleted highly sensitive personal data, e.g., personal income tax data and pornographic material, but swears not to have deleted any information relevant to the issues in suit?  Even with a litigation hold in place, can't a litigant continue to delete irrelevant and non-discoverable ESI?  I'm not asking if it's a good idea.  It's risky as hell.  I'm only asking if it's per se sanctionable?

Now let's add a wrinkle:

Before the deletions, the plaintiff made written demand upon the defendant seeking access to the defendant's laptop for the express purpose of conducting a computer forensic examination.  And let's assume the plaintiff offered reasonable grounds for seeking such access.  Now, has the character of the conduct changed?  Did the express effort to seek analysis of ESI at a forensic level of scrutiny render any intentional wiping improper?  Is it enough to just rattle the forensics saber in a preservation demand letter, or must there be a pending motion seeking access?

One final tweak: The Court has ordered the laptop turned over for examination and the wiping occurs on the eve of the machine being handed over.  Does the Court's turnover order pretty well make any subsequent wiping a lay down for spoliation sanctions?

The question is, of course, how tangible must the anticipation of computer forensic examination be before antiforensic activity (like wiping) is hands-down verboten, even for destruction of allegedly irrelevant ESI?  Is a party to a lawsuit free to dispose of non-discoverable, irrelevant ESI at anytime (aside from the practical problem of proving the irrelevant character of information that's been wiped)?

On different facts, these are issues danced around in Oz Optics, Ltd. v. Hakimoglu, 2009 WL 1017042 (Cal. App. Apr. 15, 2009) (unpublished opinion), but the lines aren't clearly drawn.  It's an important issue, because when litigants reasonably anticipate forensic examination of their ESI, aren't they obliged to refrain from intentional antiforensic behavior and act promptly and in good faith to interrupt processes expected to frustrate the legitimate ends of such examination?  If so, what's the trigger for such a duty? 

• Is a shotgun preservation letter sufficient or is a narrow, specific request or a motion required? 
• Should we conclude that intentional antiforensic behavior (e.g., installing and running something like SureDelete) must halt on nothing more than the anticipation of litigation, or certainly in response to an opponent's written demand?  Can a litigant use antiforensic self-help to shield irrelevant, non-discoverable data from examination? 
• Does it matter if running the antiforensic application was a routine business process before contemplation of litigation?
• Does it matter if the cost and burden of forensic preservation is substantial?
• At what point must a litigant's confidence that examination isn't warranted give way to preservation of the data in case examination is ordered?

In my work as a forensic examiner, I see the use of antiforensic tools and techniques with disturbing regularity but, thankfully, devoid of finesse.  The cases of file wiping after the demand for examination tend to leave irrefutable traces proving the stuff wiped away was damning evidence.  Else, the destruction is so targeted or vast and the timing so malevolent that the court has no trouble discerning what transpired. 

But the day is fast approaching when the lines won't be so clear.  Antiforensic features will be routinely implemented, allegedly to guard against identity theft or shield personal and private activity (e.g., "porn mode" on the latest browsers, though none of the software publishers call it that in their marketing).  So gentle reader, be thinking about what events will draw these lines and where they'll fall.