Court Sets Out Imaging, Recovery and Disclosure Protocols for Imaging of Defendants’ Computer Equipment by Plaintiff’s Computer Forensics Expert
Cenveo Corp. v. Slater, 2007 WL 442387 (E.D. Pa. Jan. 31, 2007)
In this case, plaintiff alleged that its former employees improperly used plaintiff’s computers, confidential information and trade secrets to divert business from plaintiff to defendants. In discovery, the parties disputed how and under what circumstances materials on hard drives in defendants’ possession would be produced to plaintiff. Plaintiff sought to use a mirror or digital imaging method, in which a digital image of the hard drives would be created and turned over to a third party forensic computer expert of plaintiff’s choosing, who would then search the image for relevant information. Plaintiff further proposed that, to avoid any disclosure of privileged information, defendants should provide a privilege log to plaintiff’s third party forensic expert, and that the forensics expert would be bound not to disclose any privileged information provided to him. Defendants, on the other hand, proposed that they create digital image of the hard drives in question and search that image using terms that plaintiff provided and defendants agreed upon. Defendants would then produce the results of the search to plaintiff, save any confidential or privileged information.
Defendants opposed the plaintiff’s proposed method primarily on the grounds that it might result in the disclosure of privileged information. In the event that defendants’ method was adopted by the court, plaintiff requested to have its forensics expert present during defendants’ imaging of the hard drives. Defendants wished to conduct the imaging without such oversight.
The court concluded that, because of the close relationship between plaintiff’s claims and defendants’ computer equipment, the court would allow plaintiff to select an expert to oversee the imaging of all of defendants’ computer equipment. The court set out a detailed three step process:
1. Imaging
Plaintiff shall select a computer forensics expert trained in the area of data recovery to produce a digital or mirror image of all computers and portable hard drives that have been in defendants’ custody, possession, or control since January 2006. Once the expert is chosen, plaintiff shall notify the defendants, and the expert shall execute a confidentiality agreement agreed to by the parties and sign a copy of the protective order in place in this matter (Document No. 20). The expert shall further agree to submit to the jurisdiction of this Court and be bound by the terms of this memorandum and order.
Defendants shall then make all of the computer equipment described above available to plaintiff’s expert at their place of business or residences at mutually agreeable times. Plaintiff’s expert shall use his or her best efforts to avoid unnecessarily disrupting the normal activities and business operations of defendants while inspecting and imaging defendants’ computer equipment. Plaintiff’s expert may not remove defendants’ computer equipment from defendants’ premises, and only plaintiff’s expert and his or her employees assigned to this project are authorized to inspect the equipment produced. Defendants may also have an electronic data recovery expert present during the inspection and imaging of their computer equipment. After the inspection and imaging, plaintiff’s expert may perform the reminder of his or her responsibilities outside defendants’ premises. Plaintiff’s expert shall maintain all information in the strictest confidence. Plaintiff’s expert will maintain a copy of the mirror images and all recovered materials until sixty days after the unappealable conclusion of this litigation.
Within ten days of inspection and imaging, plaintiff’s expert shall provide the parties with a report describing the computer equipment defendants produced and the actions plaintiff’s expert took with respect to each piece of equipment. This report shall include a detailed description of each piece of equipment inspected, including the name of the manufacturer and model and serial number of the equipment, wherever possible.
2. Recovery
Plaintiff’s expert shall recover all documents from the mirror images, including but not limited to all word-processing documents, email messages, PowerPoint or similar presentations, spreadsheets and other files, including “deleted” files. Plaintiff’s expert shall provide the recovered files to defendants in a reasonably convenient and searchable form, along with, to the extent possible, information showing when any files were created, accessed, copied, or deleted. Plaintiff’s expert shall also provide plaintiff notice of when the recovered materials were provided to defendants.
3. Disclosure
Within forty-five days of receipt, defendants shall review the recovered materials for privilege and responsiveness, supplement defendants’ responses to plaintiff’s discovery requests, and send to plaintiff’s counsel all non-privileged responsive documents, as well as a privilege log complying with Federal Rule of Civil Procedure 26(b)(5)(A). Plaintiff shall have the opportunity thereafter to propound any additional discovery requests, and defendants shall produce any non-privileged responsive materials to plaintiff as described above. Nothing in this order shall prevent plaintiff from filing a motion to compel if it is unable to resolve a claim of privilege or relevance with defendants, but the parties are strongly encouraged to resolve these issues without Court intervention.
This procedure shall govern the recovery of discoverable materials located on defendants’ computer equipment. The Court directs the parties to meet and confer to determine how they will carry out the terms of this order, keeping in mind the Court’s directive to minimize the burden and inconvenience to defendants.