HMS HOLDINGS CORP., HEALTH MANAGEMENT SYSTEMS, INC., and HMS BUSINESS SERVICES, INC., Plaintiffs, v. MATTHEW ARENDT, SEAN CURTIN, and DANIELLE LANGE, Defendants A754/2014 Supreme Court, Albany County Decided May 19, 2015 Counsel Weil, Gotshal and Manges LLP, (Salvatore A. Romanello, David R. Fertig, Jessie B. Mishkin and Aryeh Zuber, of counsel), 767 Fifth Avenue, New York, New York 10154, (Christopher J. Cox, of counsel), 201 Redwood Shores Parkway, Redwood Shores, California 94065, Attorneys for Plaintiffs. Bond, Schoeneck & King, PLLC, (Arthur J. Siegel and Stuart F. Klein, of counsel), 111 Washington Avenue, 5th Floor, Albany, New York 12210, Attorneys for Plaintiffs. Whiteman Osterman & Hanna LLP, (Christopher E. Buckey and Nicholas J. Faso, of counsel), One Commerce Plaza, Suite 900, Albany, New York 12260, Attorneys for Defendants. Platkin, Richard M., Justice OPINION OF THE COURT Plaintiffs HMS Holdings Corp., Health Management Systems, Inc. and HMS Business Services, Inc. (collectively “HMS”) commenced this action against defendants Matthew Arendt, Sean Curtin and Danielle Lange “to enforce [the former employees'] contractual promises to safeguard HMS's confidential, proprietary and trade secret information, to prevent unfair competition and irreparable injury to HMS's business interests, and to protect the goodwill of its business” (Complaint ¶ 1). HMS now moves pursuant to CPLR 3126 for the imposition of spoliation sanctions against defendants Curtin and Lange, alleging that they intentionally deleted and destroyed electronically stored information while under a duty of preservation. The relief sought by HMS includes an order of preclusion and an adverse inference. BACKGROUND The defendants in this action are former employees of HMS who are now employed by Public Consulting Group, Inc. (“PCG”). HMS alleges that defendants misappropriated its confidential information and trade secrets, including valuable technological, financial, customer and strategic information. Defendants allegedly distributed HMS's confidential information widely among themselves and others to assist PCG in its efforts to compete against HMS for contracts to provide third party liability (“TPL”) services. HMS further alleges that certain defendants are in violation of the obligations imposed by post-employment covenants. Defendants do not deny, as a general matter, that they possessed HMS's confidential information, but they do claim that such information was not used or accessed by them to assist PCG's competitive efforts and that they are not in breach of any contractual obligations. This action was commenced on August 19, 2014. In response to this lawsuit and a companion action commenced in Texas against PCG and certain other former HMS employees (“Texas Action”), PCG circulated a Litigation Hold Notice (“Litigation Hold”) on August 25, 2014 to certain employees, including Curtin and Lange. The Litigation Hold advised recipients of their obligation to “preserve all records related to the subject of the complaints”, including electronically stored information (“ESI”) on computers, removable or portable storage media, office computers, cell phones and personal computers. Recipients also were directed to discontinue any type of data destruction. The Litigation Hold further advised that the failure to preserve and retain evidence may result in sanctions against PCG and responsible individuals. Accordingly, recipients were told to “err on the side of caution” and to contact PCG's Director of Legal & Compliance Services directly with any questions. On September 25, 2014, the parties to this case and the Texas Action entered into a Stipulation Regarding Expedited Discovery, which was so-ordered by the Court on October 8, 2014. The Stipulation provides that defendants “shall forensically image for review a copy of all *2 personal and work computer(s), flash or zip drive(s), cell phone(s), smartphone(s), tablet(s), blackberry(ies), personal digital assistants, or other electronic devices in their possession, custody or control, and the Parties will agree upon a protocol for searching such devices.” In accordance with the Stipulation and a protocol later established by the parties, defendants produced to HMS and its retained computer expert, J. Christopher Racich, forensic images of certain personal computers and electronic devices, including: (1) Curtin's personal MacBook Pro laptop computer; (2) Curtin's PCG laptop computer; (3) Lange's PCG laptop computer; and (4) data extracted from an iPhone owned by Lange. Racich opines, based upon his forensic review of the images, that Curtin and Lange (hereinafter “defendants”)[1] intentionally deleted and destroyed ESI that is relevant to this lawsuit. HMS further argues that in light of the willful and deliberate nature of defendants' misconduct, the relevance of the spoliated ESI may be presumed and sanctions of preclusion and an adverse inference are warranted. In opposition, defendants submit affidavits in which they acknowledge the deletion, destruction and loss of certain ESI while under a duty of preservation, but offer various explanations and excuses for the spoliation. Defendants also submit the affidavit of a computer forensics expert, Noel Kersh, who challenges certain of the conclusions drawn by Racich. In a Decision & Order dated March 2, 2015 (“Prior Decision”), the Court held as follows: Through the affidavit of its computer forensics expert and the documentary evidence submitted in support of the motion, HMS has made a prima facie showing that Curtin and Lange engaged in the spoliation of potentially relevant ESI with a culpable mental state during the pendency of this action. Defendants acknowledge the deletion, destruction and loss of certain ESI while under a duty of preservation. However defendants offer various explanations that, if credited, would lend support to their arguments regarding mental state, the relevance of the missing ESI and the sanctions, if any, to be imposed. . . . As determination of the motion rests, at least in part, on the credibility of defendants' averments, an evidentiary hearing is warranted. In addition, the Prior Decision recognized that live testimony from the computer experts may assist in clarifying the technical issues before the Court. Accordingly, an evidentiary hearing was held on March 24, 2015 to augment the written motion record. The Court heard the testimony of defendants and the parties' computer experts. In addition, Christopher Haley testified in an effort to corroborate certain aspects of Curtin's testimony. Post-hearing briefs were received, and this Decision & Order After Hearing follows. LEGAL STANDARD *3 A.Spoliation “A party seeking sanctions based on the spoliation of evidence must demonstrate: (1) that the party with control over the evidence had an obligation to preserve it at the time it was destroyed; (2) that the records were destroyed with a culpable state of mind'; and finally, (3) that the destroyed evidence was relevant to the party's claim or defense such that the trier of fact could find that the evidence would support that claim or defense” (VOOM HD Holdings LLC v EchoStar Satellite L.L.C., 93 AD3d 33, 45 [1st Dept 2012]). The burden is on the party requesting sanctions to make the requisite showing (Duluc v AC & L Food Corp., 119 AD3d 450, 452 [1st Dept 2014]). A duty to preserve evidence is triggered once a party reasonably anticipates litigation, that is, when the “party is on notice of a credible probability that it will become involved in litigation” (VOOM, 93 AD3d at 43). Such a duty plainly exists during the pendency of known litigation (Pegasus Aviation I, Inc. v Varig Logistica S.A., 118 AD3d 428, 430-431 [1st Dept 2014]; Hameroff & Sons, LLC v Plank, LLC, 108 AD3d 908, 909 [3d Dept 2013]). “Spoliation sanctions are not limited to cases where the evidence was destroyed willfully or in bad faith, since a party's negligent loss of evidence can be just as fatal to the other party's ability to present a defense” (Standard Fire Ins. Co. v Fed. Pac. Elec. Co., 14 AD3d 213, 218 [1st Dept 2004] [internal quotation marks omitted]). Accordingly, “[a] culpable state of mind' for purposes of a spoliation sanction includes ordinary negligence” (VOOM, 93 AD3d at 45). “The intentional or willful destruction of evidence is sufficient to presume relevance, as is destruction that is the result of gross negligence; when the destruction of evidence is merely negligent, however, relevance must be proven by the party seeking spoliation sanctions” (id.; see Hameroff, 108 AD3d at 909-910). The spoliating party may rebut the presumption of relevance by establishing that there could not have been any prejudice to the innocent party (Voom, 93 AD3d at 45). B.Witness Credibility The credibility of the witnesses who testified at the spoliation hearing plays an important role in determination of the motion. “The credibility of the witnesses, the reconciliation of conflicting statements, a determination of which should be accepted and which rejected, the truthfulness and accuracy of the testimony, whether contradictory or not, are issues for the trier of the fact . . . . The memory, motive, mental capacity, accuracy of observation and statement, truthfulness and other tests of the reliability of witnesses can be passed upon with greater safety by a trial judge who sees and hears the witnesses . . . .” (Healy v Williams, 30 AD3d 466, 468 [2d Dept 2006] [quoted source omitted]; see also Magie v Preferred Mut. Ins. Co., 91 AD3d 1232, 1235 [3d Dept 2012]). The doctrine of falsus in uno allows a factfinder to completely disregard the testimony of a witness who has wilfully testified falsely as to any material fact, upon the principle that one who testifies falsely about one material fact may well have testified falsely about everything (see e.g. DiPalma v State of New York, 90 AD3d 1659, 1660 [4th Dept 2011]).The factfinder may also consider the extent to which defendants' testimony has been influenced by their strong interest in the outcome of this motion. ANALYSIS A.Curtin's Personal Computer *4 1.The Parties' Contentions According to HMS's expert, forensic review of the image of Curtin's Macbook Pro shows that a data wiping tool was used six separate times after the commencement of this action. Data destruction was initiated using the tool “Disk Utility”, which is part of the computer's Macintosh operating system. The “Secure Erase Free Space” function completely overwrites all unallocated space on a computer hard drive, rendering unrecoverable any files previously deleted by the user. The Secure Erase Free Space function (“Secure Erase”) can only be initiated by an affirmative act of the user; it is never run automatically. Racich finds that the Secure Erase function was activated six times on Curtin's personal computer between September 5, 2014 and September 26, 2014. The computer logs show that the deletion process was interrupted for unknown reasons on three such occasions, and the utility was re-activated and run to completion three other times. According to Racich, each of three successful Secure Erase passes took between thirteen and twenty seven hours to complete. Racich found no evidence that the Secure Erase function had been initiated on Curtin's computer prior to September 5, 2014. In his affidavit in opposition, Curtin claims that he ran Disk Utility because he believed “it would improve the performance of [his] laptop, including its speed, which had been significantly underperforming”. Curtin asserts that his laptop started exhibiting significant performance problems beginning in March 2014. By late August or early September 2014, Curtin claims to have been advised by several PCG colleagues that the use of Apple's pre-loaded Disk Utility software would improve speed by optimizing disk performance. Curtin maintains that he did not know or have reason to know that Disk Utility may cause the permanent deletion of data. In fact, Curtin avers that one of his colleagues assured him that it was “impossible” to delete files. Finally, Curtin explains that he interrupted the Secure Erase process several times in order to use the computer for other purposes, and that he reinitiated the process twice after it successfully completed because he did not see any increase in his computer's performance. At the hearing, Curtin generally adhered to his affidavit testimony. He did not deny running Secure Erase in the manner described by HMS's expert, but professes to lack recollection of many of the specific details of the process he used. Defendants also rely upon the affidavit of their computer expert, Noel Kersh, who attacks as misleading Racich's claim that Curtin utilized a “data wiping tool”. According to Kersh, the primary purpose of Disk Utility is to troubleshoot and repair hard disk issues, perform disk maintenance and optimize computer performance. In this connection, Kersh cites a Google search for the term “speed up my mac” that returns a link to an article referencing the “Mac's built-in Disk Utility Program”. Thus, in Kersh's opinion, it was reasonable for Curtin to believe that Disk Utility may improve the performance of his computer. 2.Discussion a.Duty to Preserve Curtin's use of Secure Erase came after the commencement of this action. Accordingly, Curtin does not dispute that he was under an obligation to preserve ESI on his personal computer on each occasion when he initiated the Secure Erase function. b.Culpable Mental State The Court does not find Curtin's explanation for his use of Secure Erase to be worthy of belief. Rather, for the reasons that follow, the credible evidence convincingly establishes that Curtin intentionally used Secure Erase to prevent the recovery of deleted files. First, as emphasized by HMS's expert and illustrated in Exhibit 2 annexed to his reply affidavit, the Secure Erase function is not one that can be triggered automatically or inadvertently. To initiate a Secure Erase, Curtin first was required to locate the Disk Utility program in the Utility sub-directory of his computer's Applications directory, run the program and then select a hard drive. Curtin then was presented with four selectable tabs: “First Aid”, “Erase”, “RAID” and “Restore”. The default option presented, the “First Aid” tab, displays options for verifying the integrity of the selected disk and repairing any problems. However, Curtin affirmatively had to move away from the default option and select the tab labeled “Erase” to proceed to the next step. At that point, Curtin was presented with various options for erasing data on the selected disk, including the option to “Erase Free Space”. Curtin selected that option, which led him to another screen that required him to choose the level of security for the data overwriting. The default level, labeled “Fastest”, displays a message stating that it “writes zeroes over the unused space in the disk once”, which “provides good security and is quick”. The forensic proof shows that Curtin did not use the default selection of “Fastest”, but instead requested the highest level of secure deletion, labeled “Most Secure”. This option informs the user that it “provides the best security” by overwriting “the unused space in the disk 7 times”. Only after all of that could Curtin click on the Erase Free Space button, thereby initiating the process of permanent data destruction. As stated above, Curtin went through the foregoing process six separate times between September 5, 2014 and September 26, 2014, which resulted in all of the unallocated space on his computer having been overwritten with zeroes at least 21 different times. While insisting that he initiated the Secure Erase function to resolve long-standing performance problems with his computer, Curtin offers no explanation as to why he did not proceed with Disk Utility's default selection of “First Aid”, which allows the user to verify the integrity of the disk and repair any problems. Curtin admits that he did not investigate or even consider the use of the First Aid function to improve his computer's alleged performance issues,[2] and the forensic proof confirms that Curtin never invoked the First Aid function. Nor could Curtin explain his preference for the Erase option, testifying only that it somehow “resonated” with him. While Curtin claims to have relied upon a colleague's assurance that “that it was impossible to delete files”, Curtin nonetheless found his way into Disk Utility and selected a function called “Erase”, which presented him with various options for erasing data from his hard drive. And Curtin offers no explanation for selecting the “Most Secure” level of deletion, rather than “Fastest” -- a peculiar choice for an unsophisticated user ostensibly concerned that his computer was not running fast enough. Further, Curtin, a trained attorney, explored and invoked these “Erase” options while under a known duty of preservation and with the admonition of PCG's counsel to err on the side of caution. Second, Curtin could not have initiated the Secure Erase function without knowing that he was permanently preventing the recovery of deleted files. Before the Secure Erase function could be initiated, Curtin was presented with multiple warnings that it would “prevent the recovery of previously deleted files”, “write over the unused space . . . to prevent disk recovery applications from recovering deleted files” and “overwrite[] data accessible to Mac OS X”.[3] Curtin received these warnings each and every one of the six times that he initiated the Secure Erase process. Under the circumstances, Curtin's testimony that he failed to read, notice and/or comprehend these warnings is wholly unconvincing. Third, the timing of Curtin's use of Secure Erase also supports a finding that he acted intentionally and willfully to destroy ESI. Curtin claims in his affidavit that he began to experience “significant performance issues” with his computer beginning in or about March 2014. At the hearing, Curtin testified that these issues actually began in late 2013. While claiming that these allegedly longstanding problems affected his ability to use applications of importance to his work (e.g. PowerPoint), Curtin did not bring the computer in for repair or seek technical support from an information technology (“IT”) professional. It was only in September 2014 -- after this lawsuit was filed and the Court had signed an Order to Show Cause bringing on expedited discovery -- that Curtin began to securely erase his hard disk. In fact, Curtin's last use of Secure Erase completed on September 26, 2014, just days before his computer was to be collected for forensic imaging. In this connection, Curtin's claim that he was advised to use Disk Utility in late August or early September 2014 by two colleagues is contradicted to some degree by the testimony of Chris Haley, the one such colleague who was called by Curtin to testify. According to Haley -- Curtin's college roommate, best friend for the last 27 years and an individual whom Curtin assisted in obtaining employment with PCG -- his conversations with Curtin regarding computer problems took place earlier in 2014. Further, Haley spoke to Curtin at a “very macro level”, and he had little, if any, recollection of specifically referring Curtin to the Disk Utility program.[4] And Curtin's testimony regarding his other colleague, Peter Adams, lacks any corroboration.[5] c.Relevance Having concluded that Curtin intentionally and willfully destroyed ESI, it must be presumed that such evidence was relevant to this action and would support HMS's claims. Accordingly, the burden shifts to Curtin to rebut this presumption by demonstrating the absence *5 of relevance or prejudice (VOOM, 93 AD3d at 45-46). This he has failed to do. In his affidavit and oral testimony, Curtin acknowledges that he stored and used confidential documents and emails on his personal computer throughout the course of his HMS employment. Curtin also used the computer after his departure from HMS and prior to formally joining HMS -- a critical period with respect to plaintiff's effort to enforce the covenant against competition through injunctive relief. And Curtin admits retaining HMS confidential information on the computer after the termination of his employment and acknowledges deleting documents and emails from the computer. Thus, as a result of Curtin's destruction of deleted files via Secure Erase, HMS has been denied the opportunity to determine the full extent to which Curtin may have misappropriated and/or used its confidential business information and adhered to his obligations under the Noncompetition Agreement. B.Curtin's External Toshiba Hard Drive 1.The Parties' Contentions HMS's forensic analysis shows that an external Toshiba hard drive containing a folder named “HMS” had been attached to both Curtin's personal computer and his PCG work computer. The analysis also finds that Curtin copied a considerable volume of confidential HMS business materials to the Toshiba drive over a thirty minute period on February 27, 2013, the day before he terminated his employment with HMS. Log files on his personal computer establish that Curtin accessed certain of these files as recently as June 24, 2014 and July 22, 2014. However, Curtin failed to produce the Toshiba drive for forensic examination in September 2014. In his affidavit, Curtin acknowledges that he used the Toshiba drive for PowerPoint presentations and other business purposes while employed at HMS. However, Curtin claims to have been unable to locate the drive, despite repeated searches. At the hearing, Curtin admitted copying a broad range of confidential HMS business information to the Toshiba drive, including files regarding the company's “strategy, plans and objectives”, just one day prior to leaving HMS's employment. But he claims to have taken these files so that he would be in a position to provide post-termination assistance to his former HMS subordinates and his successor at HMS. Curtin did not deny accessing HMS documents on the Toshiba drive in June and July of 2014, while competing on behalf of PCG against HMS for the Louisiana TPL award. Finally, Curtin testified that he last observed the drive in his Boston office in or about July 2014. He believes that the hard drive was lost in his move to Portsmouth, New Hampshire sometime thereafter. 2.Analysis Having had the opportunity to assess Curtin's testimony at the hearing, the Court does not find his explanation for failing to produce the Toshiba external drive to be credible. As an initial matter, Curtin signed a declaration on his final day of HMS employment acknowledging that he no longer possessed the company's property, including its confidential information. As a result of this false declaration -- which Curtin attempts to dismiss as a mere “formality”, despite having signed under penalty of perjury -- no one within HMS knew that Curtin remained in possession of a broad range of its confidential business information. Curtin also failed to disclose the existence of the Toshiba drive in response to HMS's interrogatories. Thus, Curtin acknowledged the existence of the drive only after being confronted with HMS's *6 forensic proof of the same. Curtin's explanation for his bulk copying of confidential HMS files to the Toshiba hard drive the day before leaving HMS's employment also lacks credibility. Curtin acknowledges that the downloaded data was not used in his April 18, 2014 meeting with his successor, Semone Wagner, which is described simply as a “Meet & Greet” on the calendar entry he submitted into evidence. Further, Curtin makes no claim that he used these documents to assist his former HMS subordinates, and there is no persuasive basis for finding that he expected to provide ongoing assistance to HMS. In fact, the opposite seems true. The only proof before the Court regarding use of these files shows that Curtin accessed them in June and July 2014, a period in which Curtin was competing against HMS for the Louisiana contract. Together with the patently incredible testimony he gave with respect to his use of the Secure Erase function, the Court disbelieves Curtin's testimony that the Toshiba hard drive conveniently was lost after PCG's Louisiana proposal was finalized and this action commenced. The Court instead finds that Curtin has intentionally and willfully failed to produce the Toshiba external hard drive while under a legal obligation to do so. The Court further finds that Curtin has failed to rebut the resulting presumption of relevance and prejudice. Even if HMS could determine precisely the full scope of its confidential business information bulk-downloaded by Curtin on February 27, 2013, plaintiff has been deprived of valuable metadata that could show when and how the downloaded files were used and any changes that were made. Further, Curtin concedes that these documents contained information concerning HMS's “strategy, plans and objectives” -- confidential and proprietary information of value to a competitor, even if not of a technical nature. And Curtin also admits that other HMS data had been downloaded to the Toshiba hard drive during his employment, including PowerPoint presentations. Under the circumstances, Curtin has not established the absence of prejudice to HMS from the spoliation. C.Lange's PCG Laptop a.The Parties' Contentions HMS contends that forensic examination of Lange's PCG computer shows that she engaged in intentional data destruction during the pendency of this litigation. HMS's expert first explains that Lange's computer, which runs the Microsoft Windows operating system, contains a number of “Shadow Copies”, which he describes as a partial backup made by Windows for system restoration that is used to create manual or automatic backup copies of a computer volume at a snapshot in time. A typical use for this information is for restoring a computer to a prior “restore point” if a problem arises with the operating system. The Shadow copy is not the type of backup used for disaster recovery; it does not typically backup all data on a computer (up to 10% of a volume's capacity). Therefore, a Shadow copy is an incomplete snapshot for some, but not all, data that resided on a computer at an earlier point in time. According to Racich, review of a Shadow Copy created on August 28, 2014 shows that there were documents in the Desktop directory of Lange's hard drive containing the term “HMS” *7 that no longer were present on September 15, 2014, when the computer was produced for forensic imaging. In Racich's opinion, this indicates the intentional and targeted deletion of files from Lange's user directory on or after August 28, 2014. Racich also relies upon his review of the registry files on Lange's computers. In particular, Racich examined the User Assist Registry Key, which identifies the applications that had been run on the computer over time. His review of the forensic image of Lange's computer shows only a limited number of applications having been run. However, the version of the User Assist Registry Key from August 28, 2014, which appears in the Shadow Copy, shows approximately one hundred applications having been run on Lange's computer since installation of the operating system on June 4, 2014. In Racich's experience, the removal of information in the User Assist Registry Key indicates that a data destruction tool has been used to remove information about what applications have been run on the computer. In response, defendants' expert takes the position that Racich has failed to adequately support the foregoing opinions. With respect to the claim of intentional and targeted deletion of user files, Kersh states that via the use of an industry standard forensics tool, he determined that about 5,300 files were deleted from Lange's computer, and he was able to view these files using the forensics tool without resorting to the Shadow Copy. Further, Kersh avers that only two such files contained the term “HMS”, one of which was mostly likely a temporary file automatically created (and deleted) by Microsoft Word. The other file, a .zip archive, was created on September 4, 2014 and appears to be a set of the pleadings filed by HMS in this action. However, because the files on the PCG computer are encrypted (pursuant to a company policy), Kersh could not open and read any of the deleted files. As to the claimed deletion of registry information, Kersh avers that he is familiar with numerous utility programs that clean up and remove such information in connection with improving the performance of the computer. He therefore disagrees with Racich's conclusion that the missing User Assist Registry Key information means that a data destruction tool has been run on the computer. In Kersh's view, Lange's use of an optimization utility “likely resulted” in the missing registry information. Lange submits an affidavit in which she admits deleting the “DRL” directory from the Desktop directory of her computer, but she denies spoliating any data relevant to this action. Lange, an attorney admitted to practice before this Court, avers that the DRL directory only contained files pertaining to her private law practice and personal matters. According to Lange, her only intent in deleting the DRL directory was to protect the confidences of her clients, explaining that “PCG's attorneys did not intend to review [her] computer for privileged materials”. Lange further asserts that before she left HMS, she copied the DRL directory to her personal computer and ultimately to her PCG laptop using a thumb drive that she discarded during the Summer of 2014 after it became “irreparably damaged in her purse”. According to Lange, she was not concerned about spoliating data because the DRL directory on her PCG computer was substantially duplicated on her personal computer, an image of which was produced to HMS for forensic examination. She claims that the only changes made to the files in the DRL directory on the PCG laptop pertained to her private law clients. With respect to the two “HMS” named files identified by Racich, Lange agrees with her expert that *8 one was a copy of the pleadings in this action that was emailed to her by HMS's counsel on September 4, 2014. The other file, which Kersh dismisses as an automatically-generated temporary file, is claimed by Lange to be a file she used to store passwords and other sensitive personal data. Lange also denies using a “data destruction tool”. Upon information and belief, she attributes any deletion of registry information to her use of “ defragmentation' software built in the computer's Windows operating system”. Lange states that after losing her password on September 2, 2014, she contacted PGP's IT department. After mentioning in passing that her computer was running slowly, she was instructed by the IT staff to “defrag” her hard drive.[6] In reply, HMS's expert emphasizes the proof showing that five relevant documents pertaining to HMS had been deleted from Lange's computer. Racich acknowledges that similar documents were located in the DRL directory of Lange's personal computer, but notes that the files on Lange's personal computer contained “HMS” in the filenames, whereas the similar files recovered from the PCG computer did not refer to“HMS”. Racich further observes that these files did not appear among the 5,300 files recovered by Kersh, suggesting that those files were purposely targeted and deleted. Racich asserts that the foregoing deletions and removal of data from the User Assist Registry Key are consistent with the use of a data destruction tool. The fact that other types of tools might also clean up or optimize the Registry data is irrelevant in Racich's view, because there is no evidence that any such tools were used on Lange's PCG computer. In particular, Racich opines that a defragmentation tool would not have deleted information from the User Assist Registry Key. At the hearing, Lange acknowledged that she deleted DRL directory, including the five HMS-related documents identified by Racich, but she maintains that the HMS files had been transferred into the directory by accident. Lange further testified that she did not recall changing the filenames and stated that she “can't exactly speak to” the forensic proof showing that the five HMS files were modified on August 19, 2014, the date upon which this action and the Texas Action were commenced. With respect to the thumb drive used to transfer the DRL directory to her PCG computer, Lange abandoned her affidavit testimony and instead asserts that the thumb drive actually belonged to a friend and cannot be located. For their part, Kersh and Racich adhered to their affidavit testimony, but articulated in greater detail the bases for their differing conclusions. 2.Discussion a.Duty to Preserve Lange acknowledges that she deleted the DRL directory from her PCG computer during the pendency of this action, a time when she was under a clear and known obligation to preserve evidence. Further, any use of a data destruction tool occurred subsequent to the creation of the Shadow Copy on August 28, 2014, which also is subsequent to the commencement of this action. Accordingly, the Court finds that Lange was under a duty of preservation at all pertinent times *9 with respect to the alleged spoliation of ESI from her PCG laptop. b.Destruction of Data with Culpable Mental State Lange admits that she deleted the DRL directory from her PCG work computer for the purpose of preventing it from being produced to HMS during discovery. While she attempts to justify this data deletion by invoking her duty as an attorney to protect client confidences, the Court does not find credible Lange's uncorroborated testimony that she believed that PCG would produce privileged, confidential and/or sensitive personal information to HMS over her objection. Lange is an admitted attorney who was aware of her duty to preserve evidence. Nonetheless, she took it upon herself to delete a directory of files from her work computer -- some of which had HMS in the name -- without consulting with PCG's counsel. Nor does it appear that Lange sought independent legal advice. And Lange did not attempt to confirm that the files in the DRL directory of her personal computer were the same as those on her PCG computer. Nor did she examine the DRL directory for relevant evidence before she deleted it. Under the circumstances, the Court finds Lange's spoliation of ESI to be intentional and willful. Lange's denial that she changed the names of the HMS files also does not withstand scrutiny. The forensic proof submitted by Rasich, which establishes that each of the files was modified on August 19, 2014, stands unrebutted. While Kersh testified that other types of changes to the files could have resulted in the same modification date, the forensic evidence is entirely consistent with Racich's opinion, and there is no proof before the Court of any other type of modification to the files. The suspicious timing of the changes lends further support to Racich's conclusion. And Lange's evasive oral testimony, in which she did not recall changing the file names but “speculated as to why [she] might have if [she] did” (T133), did not carry with it the appearance of veracity. With regard to HMS's claim that Lange used a data destruction tool on her computer, there is no dispute that User Assist Registry Key information was destroyed sometime after the creation of the August 28, 2014 Shadow Copy. The Court credits Racich's opinion that this is consistent with the use of a data destruction tool. While Kersh opines that there are other types of utilities that also delete Registry data, there is no evidence any such utility was used. In particular, Lange's belief that the use of the Windows defragmentation utility could have caused the deletion of Registry data was rejected by both experts. And Kersh can offer no other explanation for the loss of the User Assist Registry Key information. However, apart from the loss of the Registry information under circumstances consistent with the use of a data destruction tool, Racich is unable to identify any other artifacts or forensic proof affirmatively establishing the use of a data destruction tool. Although the Court recognizes the inconclusive nature of this finding -- after all, some data destruction tools are, by their very nature, intended to hide evidence of their use -- it is HMS's burden to affirmatively demonstrate the alleged spoliation. Accordingly, while HMS has produced substantial evidence to support its claim that Lange used a sophisticated data destruction tool on her computer, the Court is unable say that the evidence preponderates in favor on this point.[7] c.Relevance Based upon the finding that Lange intentionally spoliated the DRL directory from her PCG laptop, the Court presumes that the deleted ESI was relevant to this action and would support HMS's claims. The Court further finds that Lange has failed to rebut this presumption by demonstrating the absence of relevance or prejudice (VOOM, 93 AD3d at 45-46). Lange's spoliation has made it impossible to determine what other HMS files existed only within the DRL directory of her PCG computer and when such files were accessed or modified. And having determined that Lange testified falsely about a number of other material facts at the hearing, including her testimony about renaming files and the disposition of her iPhone 4 (see infra), the Court declines to accept her self-serving assurance that the DRL directory did not contain any other HMS documents or evidence relevant to this action. D.Lange's iPhone 1.The Parties' Contentions In its moving papers, HMS takes issue with Lange's failure to produce the text messages from her iPhone prior to September 2014. Racich's affidavit states that review of the text messages produced by other parties to this action and the Texas Action shows numerous texts sent and received by Lange during this period. In opposition, Lange avers that she replaced her iPhone 4 in August 2014, after accidentally dropping it. According to Lange, the staff at her local AT & T store were unable to transfer any of the data from the old iPhone 4 to her newly purchased iPhone 5. Lange avers that she did not retain the iPhone 4 because of the damage and, at the time of replacement, she did not reasonably anticipate this litigation. Finally, Lange avers that HMS was not and cannot be prejudiced, since text messages she sent or received through August 8, 2014 were produced after PCG found a backup of the iPhone on her work computer. In reply, HMS submits proof that Lange's text messages were produced only in response to the instant motion practice, it has not received her text messages from August and early September 2014, and Lange has offered no explanation for failing to produce her damaged iPhone 4 to determine what ESI, if any, may still be recoverable. At the hearing, Lange submitted into evidence a receipt establishing that she purchased a replacement iPhone 5 at a local AT & T store on August 8, 2014. With respect to her old iPhone 4, she testified that after the AT & T staff “tried very hard to transfer the data over [to her new iPhone] and [they] couldn't”, she discarded the phone at the store. Lange also admitted that she had not been aware that automatic backups were performed each time she plugged an iPhone into her PCG computer. Finally, Lange testified that she deleted texts from iPhone 5 until she received the Litigation Hold notice in order to keep the new device “clean and free of building up with messages and texts”, which she describes as “normal behavior”. In his testimony, Kersh acknowledged that the backup discovered on Lange's PCG computer actually was for two different iPhones. However, in response to HMS's questioning, Kersh testified that he was unaware that the metadata associated with these backups showed a creation date of August 15, 2014, one week after Lange claims to have discarded the broken and unusable iPhone 4 at the AT & T store after unsuccessful efforts to transfer the data. Racich then testified that the metadata produced from the backup of Lange's PCG computer shows two iPhone backup directories created on August 15, 2014: one very large directory and one smaller directory The large directory is said to be consistent with a backup of *10 Lange's iPhone 4, which had been in use for some time and stored a large volume of data, and the smaller file is consistent with Lange's iPhone 5, to which data had not been transferred. 2.Analysis Prior to the March 24, 2015 hearing, the Court did not view this branch of HMS's motion as particularly substantial. After all, even if Lange had improperly disposed of the iPhone 4 following its accidental destruction, the backup found on her PCG computer contained text messages through early August 2014, thereby ameliorating most of the actual prejudice to HMS. However, in light of the evidence adduced at the hearing, the Court is constrained to conclude that Lange knowingly gave false testimony regarding the destruction and disposition of her iPhone 4, an issue that is highly material to determination of plaintiff's spoliation motion. Lange did not and could not have disposed of her iPhone 4 at the AT & T store on August 8, 2014 as she claims. Unbeknownst to Lange, her iPhones automatically were backed up each time they were plugged into her PCG laptop. HMS's expert testified clearly and unequivocally that the backup of Lange's iPhone 4 from which her text messages were recovered was created on August 15, 2014 -- one week after Lange allegedly discarded her inoperable iPhone 4 at the AT & T store. And given Lange's receipt from the AT & T store, there can be no mistake about the date of this visit. Thus, Lange's testimony that she disposed of her iPhone 4 at the AT & T store when she purchased her new iPhone 5 is false. Similarly, the presence of an August 15, 2014 backup of the iPhone 4 demonstrates the falsity of her testimony that data could not be recovered from the allegedly damaged device. At the hearing, Kersh was unable to confirm Racich's finding regarding the date of the backup, and Lange's counsel objected to this line of testimony, stating: “If this was an issue about the backup, when it was backed up, it should have been set forth in the Reply Affidavit. This is entirely new. It's an ambush.” The Court overruled the objection, reasoning that the specific date upon which Lange purchased her new iPhone 5 and disposed of her iPhone 4 was not disclosed until Lange's oral testimony at the hearing, and HMS was entitled to offer proof in rebuttal challenging the veracity of Lange's amplified testimony. Further, Lange's counsel did not seek to recall Kersh to the stand to respond to Racich's testimony or request a continuance of the hearing for that purpose. But given the very serious nature of the issue, the Court, on its own initiative, convened a teleconference on April 1, 2015 to invite Lange's counsel to submit a supplemental affidavit if Kersh disputed Racich's finding regarding the date of the iPhone backups. No additional proof was supplied. In addition, the Court found another aspect of Lange's testimony to be troubling. While she unequivocally denied plugging the new iPhone 5 into her PCG computer, both Racich and Kersh agree that Lange's PCG computer actually contains the backups of two iPhones, both of which were created on August 15, 2014. The Court credits Racich's uncontroverted testimony that the large file is consistent with the backup of Lange's data-laden iPhone 4, and the small file is consistent with the backup of Lange's newly purchased, “clean and free” iPhone 5. Thus, Lange's testimony that she never plugged her iPhone 5 into her PCG computer also is false. Additional support for the foregoing conclusions is found in the timing of these events. The last text messages recovered from Lange's iPhone 4 pertain to HMS's discovery that Lange *11 and other former HMS employees were working for PCG and competing for TPL business. Only then did Lange's iPhone suffer its alleged demise. And Lange purchased her new iPhone 5 on August 8, 2014, the very same date upon which she learned of HMS's protest of Louisiana's bid award to PCG. Also lacking in credibility is Lange's testimony that she deleted texts from new iPhone 5 in order to keep it “clean and free of building up with messages and texts”. Lange's explanation for adopting this highly unusual practice of routinely deleting incoming and outgoing text messages is unconvincing. This practice began only after Lange learned that HMS was aware of her competitive efforts on behalf of PCG. In this connection, the Court finds that Lange was on notice of the likelihood that she would become involved in this litigation no later than August 8, 2014, when she was advised that HMS was protesting the Louisiana bid award (see VOOM, 93 AD3d at 43). And even if the relevant date were August 19, 2014, as claimed by defense counsel, Lange's own testimony establishes that she spoliated text messages from that date through September 10, 2014.[8] Finally, Lange has offered no proof to rebut the presumption that the text messages she intentionally deleted were relevant to this action. E.Sanctions HMS has established that Curtin and Lange intentionally destroyed, deleted and failed to produce ESI while under a known duty of preservation and that the destroyed, deleted and missing ESI would support HMS's claims against these defendants. “In deciding whether to impose sanctions, courts look to the extent that the spoliation of evidence may prejudice a party, and whether a particular sanction is necessary as a matter of elementary fairness” (Duluc, 119 AD3d at 452). “New York courts therefore possess broad discretion to provide proportionate relief to the party deprived of the lost evidence, such as precluding proof favorable to the spoliator to restore balance to the litigation, requiring the spoliator to pay costs to the injured party associated with the development of replacement evidence, or employing an adverse inference instruction at the trial of the action” (Ortega v City of New York, 9 NY3d 69, 76 [2007]). HMS requests an order precluding any evidence favorable to Curtin and Lange, including evidence that they did not breach obligations to HMS or wrongfully acquire, access, distribute or use HMS confidential information. HMS further seeks an adverse inference that the ESI spoliated by defendants is relevant to this litigation, would be unfavorable to defendants and would have supported HMS's claims against defendants. Finally, HMS seeks an award of attorney's fees, costs and expenses associated with the instant motion practice. At the outset, the Court finds that both Curtin and Lange engaged in egregious misconduct for which they bear a high degree of culpability. Curtin repeatedly initiated the Secure Erase function of his personal computer to prevent HMS from recovering his deleted files through forensic means. He also intentionally withheld from discovery the external Toshiba hard drive to which he had downloaded a host of confidential information immediately to leaving *12 HMS's employment and which he last accessed while competing against HMS for the Louisiana contract. For her part, Lange deliberately deleted the DRL directory from her PCG laptop to avoid producing it. She also spoliated her iPhone 4 in a deliberate effort to deny HMS access to her text messages. And Lange admits to deleting relevant text messages from her iPhone 5 while under a legal duty to preserve evidence. Adding to defendants' culpability is their failure to testify truthfully about material events, which has had the effect of interfering with the sound administration of justice.[9] The Court also is mindful of the substantial prejudice accruing to HMS as a result of defendants' misconduct. Both Curtin and Lange stored confidential HMS information on their computers and hard drives, and their spoliation has rendered it impossible to determine what they deleted, destroyed or failed to produce. Further, defendants' misconduct has denied HMS access to metadata showing when defendants accessed, used and/or modified the files that they deleted, destroyed or failed to produce. Metadata is of particular importance here, since defendants acknowledge possessing their former employer's confidences, but maintain that HMS is unable to show evidence of “use”. And Lange's text messages in the aftermath of the Louisiana bid protest and HMS's commencement of litigation have left HMS with an incomplete record of communications. The prejudice to HMS is particularly acute with respect to Curtin, who admits to having stored a broad array of confidential HMS business information on his personal computer and Toshiba external drive. Further, Curtin's spoliation encompasses two highly significant periods: (1) the time between the termination of his HMS employment and the commencement of his formal employment with PCG, which is critical to HMS's effort to enforce the Noncompetition Agreement through injunctive relief; and (2) the months of June and July 2014, when Curtin accessed the external Toshiba drive while leading PCG's effort to win the Louisiana contract. In contrast, the full extent of actual prejudice from Lange's deletion of the DRL directory is less clear. Moreover, despite the bad faith demonstrated by Lange in spoliating the iPhone 4, her efforts to keep text messages from being disclosed to HMS were largely a failure. And while Lange's newly minted policy of her keeping her iPhone 5 “clean and free” does represent intentional spoliation, the damage there is limited to a period of about one month. In addition to the nature of defendants' misconduct and the resulting prejudice to plaintiff, the Court also must consider the proportionality of the remedies sought by HMS. In particular, the Court is concerned that the order of preclusion requested by HMS would be tantamount to granting the broad, permanent injunctive relief requested in its complaint. Without prejudging the ultimate merits of the case, the Court believes that such relief, which implicates important public policies of the State, should be ordered only upon consideration of all available evidence, including any evidence that Curtin and Lange did not breach obligations owed to HMS or wrongfully acquire, access, distribute or use confidential HMS information. Indeed, a de facto terminating sanction generally is unwarranted where, as here, the spoliated evidence is not the sole means by which plaintiff can establish its claims. Under the circumstances, the Court finds that an adverse inference is necessary to alleviate the harm suffered by HMS. The issue then becomes the type and scope of adverse inference to be employed: Like many other sanctions, an adverse inference instruction can take many forms, again ranging in degrees of harshness. The harshness of the instruction should be determined based on the nature of the spoliating party's conduct -- the more egregious the conduct, the more harsh the instruction. In its most harsh form, when a spoliating party has acted willfully or in bad faith, a jury can be instructed that certain facts are deemed admitted and must be accepted as true. At the next level, when a spoliating party has acted willfully or recklessly, a court may impose a mandatory presumption. Even a mandatory presumption, however, is considered to be rebuttable. The least harsh instruction permits (but does not require) a jury to presume that the lost evidence is both relevant and favorable to the innocent party. If it makes this presumption, the spoliating party's rebuttal evidence must then be considered by the jury, which must then decide whether to draw an adverse inference against the spoliating party. This sanction still benefits the innocent party in that it allows the jury to consider both the misconduct of the spoliating party as well as proof of prejudice to the innocent party. Such a charge should be termed a “spoliation charge” to distinguish it from a charge where the a jury is directed to presume, albeit still subject to rebuttal, that the missing evidence would have been favorable to the innocent party, and from a charge where the jury is directed to deem certain facts admitted. (Pension Comm. of the Univ. of Montreal Pension Plan v Bank of Am. Sec., LLC, 685 F Supp 2d 456, 470-471 [SDNY 2010] [internal citations and footnotes omitted]). Given the willful and deliberate nature of defendants' misconduct, imposition of a mandatory presumption is warranted. The trier of fact should be permitted to draw the strongest possible adverse inference from defendants' bad faith and intentional destruction, deletion and failure to produce relevant evidence Thus, the trier of fact should be instructed as a matter of law that defendants engaged in the intentional and willful destruction of evidence, advised of the extent of each defendant's proven spoliation, and permitted to presume that the evidence spoliated by each defendant was relevant to this action, would have supported HMS's claims against the defendant and been unfavorable to the defendant. While the precise wording of the adverse inference instruction can await trial, the Court rejects defendants' assertion that imposition of a sanction at this juncture is premature. This motion is brought pursuant to CPLR article 31 to sanction defendants for their willful failure to *13 produce relevant evidence during discovery (see also Lawrence v North Country Animal Control Ctr., Inc., 126 AD3d 1078, 1080 [3d Dept 2015] [spoliation claim properly treated as one for penalties under CPLR 3126]). Such motions are routinely decided prior to trial. Moreover, the spoliation has occurred, and defendants offer no reason to believe that their actions, and the consequences thereof, are anything other than final. And defendants offer no principled basis for their argument that the Court should decline to employ an adverse inference in adjudicating HMS's pending motion for a preliminary injunction. The Order to Show Cause bringing on the motion authorized liberal, pre-hearing discovery, and defendants' bad-faith spoliation has deprived HMS of evidence that can and should have been part of the motion record. While defendants point to the dearth of precedent applying an adverse inference in such a context, the reason seems clear: motions for preliminary injunctive relief ordinarily are decided without the benefit of extensive fact discovery. Here, the salutary objective of promoting fundamental fairness by restoring balance to the party deprived of relevant evidence is best served by employing an adverse inference at all relevant stages of the litigation. Further, a preliminary injunction motion requires the Court to determine the movant's ultimate likelihood of success, and a mandatory adverse inference at trial certainly is a factor to be considered in making that assessment. In addition to an adverse inference, defendants should be required to pay HMS the reasonable attorney's fees, costs and expenses incurred as a result of their intentional misconduct, and they shall not seek reimbursement or indemnification of such costs, fees and expenses from PCG. Finally, given the egregious nature of Lange's misconduct and its bearing on her honesty, trustworthiness and fitness to practice law, the Court is obliged to forward a copy of this Decision & Order After Hearing to the New York State Committee on Professional Standards for the Appellate Division, Third Department (see 22 NYCRR 100.3 [D] [2]; Rules of Professional Conduct [22 NYCRR 1200.0] rule 8.4 [b], [c] and [d]). CONCLUSION Accordingly, it is ORDERED that HMS's motion is granted; and it is further ORDERED that defendants shall be subject to an adverse inference in accordance with the foregoing; and it is further ORDERED that defendants shall pay HMS the reasonable costs, attorney's fees and expenses of this motion;[10] and it is further ORDERED that the Clerk of the Court shall forward a copy of this Decision & Order After Hearing to the New York State Committee on Professional Standards for the Appellate Division, Third Department. This constitutes the Decision & Order After Hearing of the Court. An electronic copy is being uploaded to NYSCEF; the signed original is being transmitted to HMS's local counsel for *14 filing and service; and the exhibits introduced at the hearing are being transmitted to the Albany County Clerk. The signing of this Decision and Order After Hearing shall not constitute entry or filing under CPLR Rule 2220. Counsel is not relieved from the applicable provisions of that Rule respecting filing, entry and Notice of Entry. Dated: Albany, New York May 19, 2015 RICHARD M. PLATKIN A.J.S.C. Footnotes [1] Defendant Matthew Arendt is not a subject of the spoliation motion, and references hereinafter to “defendants” shall not include him. [2] Both experts agree that Secure Erase does not and cannot improve the performance of a computer, and no proof was offered to establish that Curtin relied upon incorrect information obtained from the Internet advising him otherwise. [3] Defense counsel speculates that the version of the Disk Utility screens presented to Curtin may not have been identical to the screens submitted by Racich, but no proof was adduced to substantiate this theory. [4] Haley further acknowledged that he has no special expertise in computers, he is not a user of Macintosh computers, he has no personal experience actually running the Disk Utility program and he did not speak to Curtin about any of the specific functionality available within Disk Utility. [5] Adams did not submit a supporting affidavit and was not called to testify at the hearing. [6] In a remarkable coincidence, both defendants claim to have experienced computer performance problems in September 2014 that led them to initiate unfamiliar disk-utility software for the first time. [7] Based upon similar considerations, the Court declines to find spoliation on the basis of the missing thumb drive (or drives). [8] Lange did produce two iMessages from September 3, 2014. [9] In addition to being contradicted by credible forensic proof and documentary evidence, the Court emphasizes that the manner in which defendants testified to their highly implausible version of events did not carry with it the appearance of truthfulness. [10] The parties are directed to confer in an effort to reach agreement on the reasonable amount of fees, costs and expenses incurred. If such an agreement cannot be reached, the parties shall notify the Court and propose a procedure for efficient judicial determination of the same.