Magistrate Judge Orders Expedited Forensic Imaging of Defendants’ Computers

Xpel Techs. Corp. v. Am. Filter Film Distribs., 2008 WL 744837 (W.D. Tex. Mar. 17, 2008)

In this brief order, the magistrate judge granted plaintiff’s motion for expedited computer forensic imaging, finding that good cause had been established.  The magistrate judge ruled that the costs of the forensic imaging would be borne by the plaintiff, and articulated a number of protocols for the parties to follow:

• Computer forensic analysis will be performed by Digitalworks, located at 13333 N. Central Expy., Ste. 201, Dallas, Texas 75243 (the "Forensic Examiner").
• All Forensic Examiners utilized must agree in writing to be bound by the terms of this Order prior to the commencement of their services.
• Within two days of this Order or at such other time agreed to by the parties, defendants shall make its Computer(s), Server(s), and any other electronic storage devices located at Defendants’ place of business at 1385 Westpark Way, Euless, Texas, including but not limited to Brett Wassell’s laptop, which may be located at a different location, available to the Forensic Examiner to make mirror images of those devices as set out below:
   

a. Imaging of the Computer(s), Server(s), any other electronic storage devices in Defendants’ possession, custody, or control, and Brett Wassell’s laptop shall be created using Encase or a similar hardware or software tool that creates a forensically sound, bit-for-bit, mirror image of the original hard drives.  A bit-stream mirror image copy of the media item(s) will be captured and will include all file slack and unallocated space.

b. Defendants’ Computers may include, but are not limited to, computers named CLASSROOM, BRETTSTOSHIBA, XPEL, XPEL98, OEMCOMPUTER, and SYSTEMAX.  This Order does not limit imaging to one server if Defendants possess or have custody or control of additional servers, each of which shall be imaged pursuant to this Order.

c. All images and copies of images shall be authenticated by generating an MD5 hash value verification for comparison to the original hard drive.

d. The forensic images shall be copied and retained by the Forensic Examiner until such time the court or both parties request the destruction of the forensic image files.

• The Forensic Examiner will maintain all mirrored images and do so in the strictest confidence, and not disclose any information obtained to unauthorized persons.
• The Forensic Examiner will use its best efforts to avoid unnecessarily disrupting the normal activities or business operations of the defendants while inspecting, copying, and imaging the computers and storage devices.

A copy of plaintiff’s brief in support of the motion is available here.