United States District Court, N.D. Illinois, Eastern Division
MEMORANDUM OPINION AND ORDER
Williams brought this suit against his former employer,
American College of Education, Inc. (“ACE”),
under 42 U.S.C. § 1981, Titles VI and VII of the Civil
Rights Act of 1964, 42 U.S.C. §§ 2000d et
seq., 2000e et seq., and state law, alleging
that he was discriminated against and ultimately terminated
due to his race and in retaliation for complaining about
discrimination. Doc. 8. ACE counterclaimed, alleging theft
under Indiana law. Doc. 29. Williams then filed an amended
complaint, adding allegations that ACE defamed him by
publishing false allegations that he locked ACE out of its
Google email account after his termination. Doc. 59.
moves under Civil Rule 37(e) and the court's inherent
authority for sanctions against Williams for spoliation of
evidence, charging that he intentionally destroyed
electronically stored information by installing a new
operating system on his ACE-issued laptop, rendering
unrecoverable potentially relevant files. Docs. 90, 189.
Williams denies ACE's charge, contending that he kept a
second ACE-issued laptop at ACE's Indianapolis office,
and theorizing that ACE used that laptop-or a combination of
his two laptops-to fabricate evidence of the alleged
spoliation. Doc. 215 at 12-15. The court held an evidentiary
hearing and entertained oral argument. Docs. 208, 210-215.
Having heard, reviewed, and carefully considered the
evidence, the court finds that Williams destroyed files on
his laptop by installing a new operating system and committed
perjury in denying that he had done so, and therefore grants
ACE's sanctions motion, dismisses Williams's claims,
and relinquishes its jurisdiction over ACE's
worked in ACE's Information Technology (“IT”)
department from 2007 through February 2016. Doc. 124-2 at
¶ 6. He was a systems administrator from 2013 through
2016. Id. at ¶ 8. From 2011 until his
termination, Williams worked remotely from his home in
Riverdale, Illinois. Id. at ¶¶ 10-11; Doc.
214 at 4.
February 12, 2016, ACE told Williams that it was relocating
all IT employees to its Indianapolis headquarters and that he
would no longer be permitted to work remotely from home. Doc.
124-2 at ¶ 12; Doc. 212 at 68-69, 169; Doc. 124-4.
Williams alleges that he was subjected to discriminatory
treatment due to his race over the course of his employment
and that ACE forced him to choose between relocating and
leaving his job due to his race and in retaliation for his
prior complaints about discrimination. Doc. 59 at
¶¶ 43-52. The most salient of those complaints were
set forth in a letter (the parties call it the “ACE
Culture Letter”) that Williams sent to supervisors
expressing his concerns that “[t]he culture of [ACE]
has become very toxic … and seems to affect only the
African American demographic of our college.” Doc.
124-3; Doc. 59 at ¶ 14. The letter is dated February 11,
2016-the day before ACE announced on February 12 that all IT
employees had to relocate to Indianapolis-but the parties
dispute whether Williams in fact prepared and sent it before
Williams's Knowledge of His Preservation
February 29, 2016, ACE told Williams that it was placing him
on a leave of absence and that he should no longer report to
work. Doc. 124-2 at ¶ 21. Williams's attorney sent
ACE a letter that day, informing it of Williams's intent
to bring this suit. Doc. 89 at 10-11. ACE's counsel
responded on March 10, 2016, stating:
The College asks that you remind Mr. Williams that he has
affirmative obligations to preserve any and all electronic
and paper documents that are relevant to his claims, his
separation and his employment with the College. This not only
includes preserving his company property without destruction,
but also any personal email, text messages or other forms of
communication that he has had with other current or former
College employees. We trust Mr. Williams has and will
continue to comply with [h]is preservation obligations.
Id. at 13-14.
Williams's Home Laptop
February 29, 2016, the day Williams was placed on a leave of
absence, ACE cut off his access to its network by changing
his password and disabling his account. Doc. 212 at 54, 69,
175; Doc. 214 at 4; Doc. 124-2 at ¶¶ 21, 42.
Although Williams's network access was disabled, he still
could have logged into the ACE-issued laptop he kept at home
by using either his previous password-because the computer
was no longer on ACE's network, it would not have
received the update invalidating that password-or the local
administrator credentials. Doc. 212 at 70-71; Doc. 214 at
4-5. According to James Aldridge, ACE's vice president of
technology, ACE could not have remotely accessed
Williams's laptop after it was removed from the network.
Doc. 212 at 57, 70.
April 21, 2016, KK Byland, ACE's vice president of human
resources, sent Williams a FedEx box so that he could return
his ACE-issued laptop to ACE. Doc. 89 at p. 2, ¶ 5.
Aldridge testified that on May 10, 2016, a receptionist
delivered to his office a sealed FedEx box from Williams
containing the laptop. Doc. 212 at 80-81. IT managers Steven
Carey and Rick Gehring were in Aldridge's office at the
time. Ibid. Aldridge testified that he laid out the
contents of the box-the laptop and a few pieces of bubble
wrap-and photographed them. Id. at 81; Doc. 178-3 at
16. (Williams testified that he also sent back his power cord
and keycard, neither of which appears in the photograph. Doc.
214 at 23-24; Doc. 178-3 at 16.) Aldridge did not photograph
the bottom of the laptop, where the service tag (Dell's
version of a serial number) was located. Doc. 212 at 118-119;
Doc. 214 at 60. Aldridge then opened the laptop and turned it
on, at which point he realized that it “was no longer
on [ACE's] domain and that the screen was cracked.”
Doc. 212 at 81.
Aldridge told Byland that he had received the laptop, she
gave him a chain of custody form. Id. at 82.
Aldridge filled out the form and then locked both the form
and the laptop in his desk, using a key on his keychain.
Id. at 82-84. The chain of custody form identifies
the laptop as a “DELL Latitude E7450 wrapped in bubble
wrap in a large Fedex box” with a “[v]isibly
damaged screen, ” but does not note its service tag.
Doc. 178-3 at 11. Williams testified that ACE's IT
department, including Aldridge, typically identified devices
by their service and asset tags. Doc. 214 at 181.
to Aldridge, ACE's “standard procedure” when
receiving a former employee's laptop was to gather the
files from the laptop and provide them to the employee's
supervisor, who then reviewed the files to determine whether
any should be kept. Doc. 212 at 84. IT then “wipe[d]
[the] computer and put a fresh image on it … for the
next user.” Ibid. IT was unable to perform
this procedure on Williams's laptop because a new
operating system had been installed. Id. at 84-85.
gave the laptop to Jacob Carey on May 12, 2016-a transfer he
recorded on the chain of custody form, Def. Ex. 9 at 1; Doc.
178-3 at 11; Doc. 124-14 at 6-who used a bootable operating
system to access the computer in search of “any
additional files on the laptop that [ACE] could
preserve.” Doc. 212 at 84-85. Jacob Carey accessed the
laptop, changed the local administrator password, and logged
in. Id. at 85. Upon doing so, he discovered that the
laptop had been loaded with a new copy of the Windows 7
operating system and that “no files from …
Williams were present on the laptop.” Ibid.
Jacob Carey then returned the laptop to Aldridge, who kept it
locked in his desk drawer until, upon leaving ACE in January
2017, he gave it to Steven Carey. Id. at 87; Doc.
178-3 at 11.
responses to ACE's requests for production, Williams
repeatedly stated that the requested documents could be found
on the laptop that he returned to ACE. Doc. 89 at 22, 36-37.
For example, Williams responded to ACE's request to
produce “[a]ll documents that refer or relate in any
way to your employment with [ACE], including but not limited
to, time records, policies, procedures, and personnel
documents” by stating: “These documents were
maintained electronically and were accessed via my laptop
which was returned.” Id. at p. 22, ¶ 1.
Williams gave a similar response-“Documents that may
have been contained on my laptop are now
unavailable.”-to ACE's requests for
“[d]ocuments relating to any communications, including
but not limited to e-mails and text messages, ” between
Williams and Rommel Haynes, Dr. Linetta Durand, Amber Ying,
or “any person not employed by [ACE] regarding the
allegations in the Complaint.” Id. at pp.
36-37, ¶¶ 60-63. And Williams gave that same
response to ACE's request for documents “reflecting
[his] job duties and responsibilities while he was employed
by [ACE]” and documents related to his attempts to
obtain employment after he left ACE. Id. at p. 37,
D4/Evans's Forensic Analysis
sent Williams's laptop to John Evans, a computer
forensics expert with the firm D4, LLC, to perform a forensic
analysis. Doc. 214 at 29-31; Doc. 89 at 94. D4 received the
laptop and ACE's chain of custody form in July 2017. Doc.
214 at 31. Evans testified that the laptop received by D4
matched the description on the chain of custody form.
Ibid. The shipping label identified the sender as
Steven Carey, as did the form. Doc. 178-2 at 7, 13. Evans
testified that D4 never received any other computers from
ACE, and that D4 examined only one laptop: a Dell Latitude
E7450 with service tag CXF4M32 received from ACE. Doc. 214 at
31-32, 41. Byland testified that the laptop Williams returned
to ACE was the one that ACE sent to Evans and that she had no
reason to believe that anyone had altered or tampered with
it. Doc. 212 at 177.
performed a forensic examination on the laptop and found that
the operating system had been reinstalled on March 28, 2016.
Doc. 214 at 32. Evans added that the previous operating
system had been installed on June 1, 2015. Id. at
42. Evans testified that reinstallation requires human
intervention in the form of “affirmative actions to
click through screens to set up the new operating
system.” Id. at 37. In Evans's experience,
reinstalling an operating system is a common method of
deleting information from a computer. Ibid. He
explained that when an operating system is reinstalled, files
that were deleted before the reinstallation can be
overwritten, making them unrecoverable. Id. at 32.
found evidence that the reinstallation of the operating
system on Williams's laptop had that effect. Id.
at 33. Specifically, he found “evidence of at least 20
files that were opened prior to the reinstallation”-and
thus “were present on the hard drive at that
time”-but that “no longer exist[ed] on the
device” when he examined it. Ibid. Evans
testified that he was unable to recover any autosaved Google
login information or any email communications other than
those saved in Outlook (and therefore available independently
through Outlook). Id. at 32-33, 46. When Evans
received the laptop, it did not appear to be associated with
any domain or physical network. Id. at 35.
to Evans, reinstalling the operating system moves the
previous operating system and user profiles-which Evans
described as “a collection of documents related to
logins on that computer”-to a “windows.old”
folder. Id. at 34. Evans found six user profiles
that pre-dated the reinstallation: “Administrator,
” which accessed the device from June 2015 through
March 2016; “Jose.Rubio, ” which accessed the
device in July 2015; “Triano.Williams, ” which
accessed the device from August 2015 through January 2016;
“Triano.Williams.ACE, ” which accessed the device
from January through February 2016; and two profiles with no
activity (“Default” and “Public”).
Id. at 34-36, 48; Doc. 89 at 95. From August 2015
through February 2016, the only profiles with any activity
were “Triano.Williams” and
“Triano.Williams.ACE.” Doc. 214 at 36. The only
profiles present after the operating system reinstallation
were “ACE, ” “Default, ”
“Public, ” and an “Administrator”
profile deleted shortly after the reinstallation.
Id. at 37; Doc. 89 at 95.
found evidence of activity on the previous operating system
on March 4, March 9, and March 28, 2016. Doc. 214 at 34. That
activity included opening about twenty files on March 28,
2016, the date of the reinstallation. Id. Because
none of those files were present on the laptop after the
reinstallation, Evans concluded that they had been deleted
before the reinstallation. Id. at 34-35. Evans was
able to determine the names of the deleted files but not
their contents, id. at 66-67, and observed that the
names of files do not necessarily match their contents,
id. at 82-83. Evans also found that USB devices were
connected to the laptop on February 29 and March 3, 2016.
Id. at 36. Evans did not find any documents or
activity from after the reinstallation. Id. at 37.
Evans found the TeamViewer application (a mechanism for
obtaining remote access to a computer) and the logs it
generated when used, but he did not find any evidence of
TeamViewer activity after February 1, 2016, nor did he find
any other evidence of remote access in connection with the
March 28, 2016 reinstallation. Id. at 36, 44; Doc.
178-2 at 4. Evans testified that as far as he knows, it is
not possible to reinstall an operating system remotely. Doc.
214 at 76. If it were possible to do so, Evans would expect
the process to leave behind evidence, but he did not find
any. Id. at 79.
recovered more than 10, 000 deleted items, which he opined
were recoverable only through forensic means. Id. at
41. Evans opined that all the items were deleted from the
laptop he examined. Ibid. He added that “it is
impossible to tell what information was overwritten, and
therefore no longer recoverable, as a result of the”
reinstallation. Doc. 178-2 at 3.
looked for evidence of tampering beginning on May 10,
2016-when ACE received the laptop from Williams-but found
none. Doc. 214 at 38. Evans found nothing on the laptop that
was altered after May 12, 2016, when Jacob Carey used a boot
disk to start the computer and reset the password.
Id. at 37, 47; Doc. 178-3 at 18-19. Evans found two
files consistent with the activity that Jacob Carey
described, both dated May 12, 2016. Doc. 178-2 at 5, 19-21.
Evans testified that he would expect to find evidence of
doctoring if someone had tried to make a laptop look like
someone else was using it. Doc. 214 at 38.
Protek/Glud's Forensic Analysis
hired Protek International, Inc. to analyze a copy of the
forensic image that D4 had made of his laptop. Doc. 169-2 at
1. Like Evans, Protek found that the “active operating
system” was installed March 28, 2016, likely by way of
reinstalling Windows, as evidenced by the presence of the
“Windows.old” folder. Id. at 2. Protek
found a few dozen emails to or from Williams's personal
accounts. Ibid.; Doc. 169-1 at ¶ 9. (Evans
testified that Protek's finding those emails is not
inconsistent with his conclusion that there were no
recoverable emails because Evans searched for locally saved
emails, not for emails available in Outlook. Doc. 214 at 46;
Doc. 178-2 at 5.) Protek did not find the two files that
Jacob Carey said he renamed- “Utilman.exe” to
“Utilman.exe.old, ” and “cmd.exe” to
“Utilman.exe”-while attempting to access the
laptop with a boot disk, but Protek did find evidence that a
program file named “Utilman.exe” was last run on
May 10, 2016. Doc. 169-2 at 3.
found “[s]everal versions of spreadsheets tracking ACE
computer assets.” Ibid. Protek also examined
“ShellBag” and “UserAssist”
artifacts, which can provide information about user activity.
Ibid. Protek determined that the ShellBag data,
which “help track the views, sizes and positions of a
folder when displayed on a monitor screen” and thus
offer “insight into the folder/browsing history of a
user, ” provided “evidence of network access to
resources attributable to Higher Education
Holdings”-ACE's holding company-from June 3, 2015
through January 6, 2016. Ibid. Protek also
determined that the UserAssist artifacts, which record
“programs executed by a user account, ” showed
activity on the same profiles and in the same time periods as
Evans had found. Compare ibid., with Doc.
214 at 34-36, 48, and Doc. 89 at 95.
evidentiary hearing, Williams asked Evans whether a
spreadsheet Protek prepared of the UserAssist data, Pl. Exs.
12, 22; Doc. 169-2, contained evidence of remote access to
Williams's laptop on March 28, 2016. Doc. 214 at 84-87.
Evans opined that even assuming that the UserAssist
spreadsheet was accurate, it showed only that a program named
“Remote Desktop Connection” was run on the laptop
after the reinstallation, not that the laptop was in fact
accessed remotely from another device. Doc. 214 at 87-89.
(Although Plaintiff's Exhibit 22 was not separately
admitted at the evidentiary hearing, it is a reproduction of
Exhibit D to Protek's report, Doc. 169-2; Pl. Ex. 12,
which Williams filed in its native (Excel) format on a USB
Glud, Protek's director and senior consultant for
electronic discovery and computer forensics, opined that
ACE's chain of custody form was deficient because it did
not “record any unique identifying information, ”
such as a service tag, that would distinguish Williams's
laptop “from other laptops of the same make and
model.” Doc. 169-1 at ¶¶ 1, 6. (ACE's
motion to strike Glud's opinions about the chain of
custody form, Doc. 163, is denied as moot because those
opinions do not affect the outcome of ACE's spoliation
motion.) Glud also opined that one of the inventory
spreadsheets on the forensic image of Williams's laptop
indicated that “two Dell Latitude E6430 laptop
computers” were at some point assigned to Williams,
both with service tags different from the tag on the E7450
laptop that D4 analyzed. Doc. 169-1 at ¶ 8. Williams
averred in a declaration that the laptop he returned to ACE
from his home and the laptop he used at the Indianapolis
office (of which more in a moment) were E7450s. Doc. 180-15
at ¶¶ 8, 31-32.
prepared a supplemental report in response to Protek's
findings and Williams's declaration. Doc. 178-2 at 2.
Evans opined that Protek's findings were largely
consistent with his own. Id. at 4-5. Evans agreed
with Glud that the inventory documents referred to two E6430
laptops, but found that none of the documents referred to the
service tag of the laptop that D4 imaged. Id. at 5.
Ultimately, Evans opined that Protek's findings were
“consistent with D4's conclusion that the
reinstallation of the operating system may have caused the
permanent deletion of … potentially relevant
information.” Id. at 6. Given the lack of
evidence of remote access and the affirmative steps required
to accomplish reinstallation, Evans ...