Sam Bankman-Fried was convicted on all counts in November 2023 and sentenced to 25 years in March 2024. One thread that ran through the case: FTX’s culture of auto-deleting communications. SBF encouraged staff toward ephemeral messaging, and prosecutors framed that policy itself as relevant — a choice, not an accident.
That is the part worth dwelling on as a technical matter. A retention policy is a configuration, and configurations leave traces even when their content does not. When a company sets messages to auto-delete, the messages may be gone — but a surprising amount survives:
- The policy decision itself: who enabled ephemeral messaging, on which platform, and when.
- Server-side and admin metadata that often outlives the message bodies.
- Copies on the other side of every conversation — counterparties, exchanges, banks, and auditors who were never on the same retention setting.
- Backups, exports, and discovery productions made before the deletion window elapsed.
For a litigator, the instinct is to ask “do we still have the messages?” The more productive question is usually: “what does the deletion itself tell us, and where did the content survive despite it?” Answering that is software-specialist work — reconstructing the retention configuration, identifying which systems were and weren’t covered, and finding the copies that the deleting party did not control.
The general principle holds well beyond crypto fraud: in accounting disputes, employment matters, and ordinary commercial litigation, ephemeral messaging is rarely the clean erasure a party hoped for. The story is usually recoverable from the edges.
Why this needs a software expert witness, not just discovery
A discovery request produces what the other side still holds. It does not tell you what was configured to disappear, when, by whom, or which systems were never covered by that setting at all. That gap is the difference between “we don’t have the messages” and a picture a judge can act on.
So a software expert witness in a matter like this does not stop at reading what survived: the work is reconstructing the retention configuration itself, and showing where content survived it.