What Are eDiscovery Sanctions?

eDiscovery sanctions represent the federal courts’ strongest response to modern evidence spoliation. eDiscovery sanctions arise when parties fail to preserve, produce, or manage electronically stored information (ESI) after litigation duties attach. The 2025 Google Core Update rewards deeply authoritative and original legal analysis—especially for California practitioners navigating FRCP 37(e), court procedures, and the complex landscape of data loss in digital litigation. From multi-pass wiping to cloud metadata deletion, the risks and consequences of eDiscovery sanctions are real.

eDiscovery Sanctions Framework: FRCP 37(e) and California Federal Practice

1. FRCP 37(e) governs loss of Electronically Stored Information (ESI) “that should have been preserved in the anticipation or conduct of litigation.” Courts in the Northern, Central, Eastern, and Southern Districts of California apply 37(e) as the exclusive vehicle for ESI loss sanctions.
2. Curative measures apply if the loss causes prejudice; severe eDiscovery sanctions require intent to deprive (adverse inference, striking pleadings, default judgment).
3. Inherent authority remains for non-ESI abuses or extraordinary litigation misconduct.

Key Case: “The Court finds that Defendants acted with the intent to deprive Plaintiff…” 360 Security Partners LLC v. Hammond

Preservation Triggers, Scope, and Proportionality

• The duty to preserve arises with demand letters, internal incident reports, or receipt of legal hold notices. Document all trigger dates and issue written holds for key custodians—especially in email and mobile-first environments.
• Proportional scope and targeted collection minimize eDiscovery sanctions risks (FRCP 26(b)(1)). Use M365/Google Workspace, Slack/Teams, device backups, NAS/SAN shares, and cloud app exports, but memorialize why each source needs preservation.

Counter-Forensics: Wiping, Reformatting, and eDiscovery Sanctions Forensic Traces

Counter-forensics software like DBAN, East-Tec Eraser, and CyberScrub are designed for permanent data destruction. Examiners search for forensic “residuals” in event logs, NTFS metadata ($MFT, USN Journal), registry keys, and volume serials—even after major wipes.
EaseUS, by contrast, is primarily for recovery or partition management. Its presence alone does not show spoliation, but intent is inferred when used after a preservation trigger, especially with other deletion tools in sequence.

• DBAN: Bootable, multi-pass drive wipes. Use post-hold is strong evidence of intent.
• East-Tec Eraser: Windows-based applied erasure with registry artifacts.
• CyberScrub: Commercial file shredder, leaves system and log traces.
• EaseUS: Data recovery/partition tools—not considered destructive by default.

Key Case: “Spoliation sanctions are appropriate when a party destroys evidence that it has a duty to preserve.” Keating v. Jastremski

Mobile, Messaging, and Cloud Forensics

Deleting WhatsApp, iMessage, or cloud log data after notification is risky and often sanctionable. Mobile Device Management (MDM) solutions should enforce litigation-mode: suspend auto-delete, backup keys, restrict uninstalls.

• iOS Forensics: iCloud/backup, KnowledgeC, sysdiagnose, chat.db artifacts help reconstruct timelines.
• Android Forensics: ADB logs, app sandboxes, cloud backup versions.
• SaaS Collaboration: Slack/Teams retention policy, Google Vault, M365 Purview audits essential.

Forensic Note: Server/cloud logs and prior backups are crucial restoration sources when users attempt device-level erasure.

Remedies: Curative and Terminating eDiscovery Sanctions Under FRCP 37(e)

• Curative: Additional discovery, evidence preclusion, cost-shifting, presentation of spoliation evidence to jury.
• Severe: Adverse inference instructions, striking claims/defenses, default or dismissal if intent to deprive is proven (see: CourtListener – Spoliation Case Database)

Courts prefer tailored remedies. When counter-forensics eradicate central evidence, more severe eDiscovery sanctions are common.

California GEO/SEO Keywords

• eDiscovery sanctions San Diego
• e-discovery sanctions Los Angeles
• eDiscovery expert witness Orange County
• Rule 37(e) sanctions California federal courts
• mobile forensics spoliation Northern District of California
• digital spoliation Central District of California
• litigation hold violations Riverside County
• metadata destruction Santa Clara County
• forensic imaging sanctions San Bernardino County
• WhatsApp deletion sanctions Southern District of California

Practical Litigation Playbook for eDiscovery Sanctions

For the Moving Party

• Chronology: Notice, hold, service dates.
• Image devices, collect cloud/server logs.
• Map installation/execution of wiping tools to time of notice.
• Attempt restoration, document why it’s impossible.
• Quantify prejudice; seek terminating eDiscovery sanctions if strongly evidenced.

For the Responding Party

• Show steps: timely holds, suspended retention, IT coordination.
• Produce alternate/restored sources if possible.
• Provide documented non-litigation explanation for any maintenance actions.
• Deliver examiner declaration evidencing absence of activity in critical periods.
• Propose proportionate curatives, cost sharing, extra depositions.

Infographic: eDiscovery Sanctions and Spoliation Flowchart

Further Reading & Key Judicial References

• CourtListener: Case Law Database
• 360 Security Partners LLC v. Hammond
• Keating v. Jastremski
• California Appellate Project
• Oyez: Supreme Court Cases
• E-Discovery Guidance (Justice.gov)
• Computer Forensics Reference (Justice.gov)