By Aruna Viswanatha

WASHINGTON, Jan 16 (Reuters) - The U.S. Securities and Exchange Commission has become more aggressive in seeking full hard drives from the companies and individuals it investigates, startling defense lawyers who question whether the agency is allowed to obtain such information.

The big push is an outgrowth of the SEC's new state-of-the-art forensics lab, which gives the agency the ability to recover altered or deleted electronic data as it builds insider trading cases and other enforcement actions.

It is part of a larger effort by enforcement authorities, both criminal and civil, to use bolder and more sophisticated tools to nab fraudsters who themselves are becoming savvier.

In recent months, the term "ESD" is showing up more often in subpoenas from the SEC, according to lawyers who have received such requests. "ESD" refers to electronic storage devices, which includes everything from laptops and hard drives to printers and smartphones.

Some defense lawyers say they are contesting such subpoenas, comparing it to the SEC asking for a whole filing cabinet, rather than specific types of documents, which is what it usually does.

The SEC can request books, papers, correspondence, memoranda, or other records deemed relevant to an inquiry. The SEC contends that electronic storage devices qualify as records.

While investigators would traditionally have balked at getting dozens of boxes of files with little guidance on what was in them, new technological capabilities allow the SEC to quickly run terabytes of data through complicated search tools.

Eugene Goldman, a former SEC lawyer who is in private practice at McDermott Will & Emery, said he received his first request for a client's hard drive in the past six months.

"I objected to it," he said.

Goldman said he was alarmed because the hard drive would potentially give the SEC a lot of information outside the scope laid out by the formal order of investigation. The SEC is considering his request to narrow the scope.

SEC spokesman John Nester said he is not aware of legal disputes involving the agency's ability to seek hard drives.

If a defendant refuses to turn over a device, it could force the SEC to go to court to enforce its subpoena and prove it has the authority to request it, lawyers said.

But some lawyers said defendants might not want to pick a public fight with the SEC and risk giving up any credit they might get for fully cooperating with investigators. Also, some lawyers said they believe the agency does have the right to obtain hard drives given the agency's broad subpoena powers, which doesn't require a judicial sign-off.

'CRITICAL SMOKING GUN'

The SEC continues to invest in its electronic discovery efforts and its forensics lab, which opened its doors in June 2011.

Housed on the second floor of the newest wing of the SEC headquarters in Washington, the built-to-spec forensics lab features poured concrete walls two-feet (0.6 meter) thick with built-in metal barriers to prevent eavesdropping, and is stocked with powerful air conditioners and servers.

The lab is staffed with forensic analysts conducting "digital investigations" that can recover deleted, encrypted or damaged data or files.

"The key to just about every important SEC investigation nowadays lies in the data that the staff find," said John Stark, who spent two decades at the SEC, including as chief of its office of Internet enforcement, and now helps companies respond to requests for electronic information at Stroz Friedberg, a technology consulting firm.

"Occasionally you have wiretaps or a whistleblower, but generally, the critical smoking gun resides on some device as a byte of data," he said.

Scott Friestad, associate director of the SEC's enforcement division, said the forensic lab's work on hard drives and other devices is especially helpful in instances where investigators believe an individual has taken steps to conceal wrongdoing.

"I think it's a small percentage of our overall cases that use those services, but for the ones that do, it can be critically important," Friestad said.

As an example, he said the forensics lab could be particularly useful in an insider trading investigation, to determine whether someone had deleted emails or other evidence connecting them to a corporate insider or another tippee.

'PUSHING THE ENVELOPE'

The SEC is also finding that its enhanced power to comb through electronic devices can help it rebut arguments from defense counsel who say such outsourced forensic searches could be costly.

"It could be a game changer," said Thomas Sporkin, a former SEC lawyer who led the agency's Office of Market Intelligence and is now a partner at BuckleySandler. "If you think of the SEC as saying, 'we can do it for free,' that could have big implications on an entity that otherwise would have used expense" as a way to avoid the search, he said.

That scenario played out for Howard Schiffman, a defense attorney at Schulte, Roth & Zabel. The SEC asked for information from the personal computer of every employee at a firm being investigated in an insider trading case, he said.

When Schiffman said such a search could be cost prohibitive, the SEC asked the company to turn over the computers and said it could conduct the searches itself.

"What the SEC is doing, is asking people electronically to look for the needle in the haystack, but lots of times there isn't one," Schiffman said.

And while lawyers and consultants are taken aback by the boldness of the SEC's approach, some acknowledge they are a little impressed, too.

"It is a pretty innovative way to catch bad guys," Stark said. "They are pushing the envelope, but it's also my job to push back."

Follow us on Twitter @ReutersLegal | Like us on Facebook