New York Court Provides Detailed Instruction on Protocol for Discovery of Cloned Hard Drive

Schreiber v. Schreiber, 2010 WL 2735672 (N.Y. Sup. Ct. June 25, 2010)

In this matrimonial action, plaintiff sought access to her husband’s (the defendant) office computer to determine his true financial condition.  After denying plaintiff’s initial motion, the court directed (by stipulated order) that a clone of defendant’s office hard drive be made at plaintiff’s expense.  Thereafter, the court denied plaintiff’s motion for access to the cloned drive upon finding her request for unrestricted access overbroad.  “Equally important” to the court was plaintiff’s failure to propose any protocol for investigation of defendant’s hard drive.  The court instructed that should the plaintiff wish to renew her motion, her renewal “must contain a detailed, step-by-step discovery protocol that would allow for the protection of privileged and private material.”  Moreover, the court provided detailed instruction for what such a protocol should contain:

(a) Discovery Referee:  The parties will have until the renewal deadline to agree on an attorney referee, preferably someone with some technical expertise in computer science, to be appointed pursuant to CPLR 3104(b) to supervise discovery (the referee).  [FN10]  If the parties fail to agree on a referee before the renewal deadline, they will submit two names each to the court (along with a summary of the proposed referee’s qualifications, not to exceed one page, and hourly rate), and the court will select a referee from among the candidates submitted.

(b) Forensic Computer Expert:  The parties will have until the renewal deadline to agree on a forensic computer expert who will inspect and analyze the clone (the expert).  If the parties fail to agree on an expert before the renewal deadline, they will submit two names each to the court (along with a summary of the proposed expert’s qualifications, not to exceed one page, and the expert’s fee structure), and the court will select an expert from among the candidates submitted.  The expert will execute a confidentiality agreement (to be agreed upon by the parties) governing non-disclosure of the contents of the clone and its re-delivery to defendant’s counsel after completion of electronic discovery.

(c) File Analysis:  The expert will analyze the clone for evidence of any download, installation, and/or utilization of any software program, application, or utility which has the capability of deleting or altering files so that they are not recoverable (a drive-wiping utility).  The expert will then (i) extract from the clone all live files and file fragments, and (ii) if the files on the clone have been deleted or altered using a drive-wiping utility, will also recover all deleted files and file fragments.

(d) Scope of Discovery:  Plaintiff will list the keyword and other searches she proposes to have the expert run on the files and file fragments, subject to a reasonably short time frame (to be agreed upon by the parties) in which such files or file fragments were created or modified.  Plaintiff is cautioned that she should narrowly tailor her search queries so as to expedite discovery and reduce the costs of litigation to the parties.  To illustrate, a search query for all documents with an .xls (Microsoft Excel) extension, created or modified within a three-year period preceding the commencement of this matrimonial action, will not be permitted.

(e) First-Level Review:  The expert will run keyword or other searches on all of the extracted files and file fragments.  After performing searches, the expert will export to CDs or DVDs a copy of the native files and file fragments which were hit by such searches, and will deliver such media to defendant’s counsel to conduct a privilege review.  An exact copy of the media delivered to defendant’s counsel will be contemporaneously delivered by the expert to the referee.  The expert will also concurrently deliver to the referee and to counsel for both parties a report (i) detailing the results of its searches, (ii) listing the file types for all files hit by the searches, with the file extensions and number of files for each, and (iii) stating whether or not it found evidence of the use of a drive-wiping utility.

(f) Second-Level Review:  Within twenty days after delivery of the media containing the extracted files and file fragments, defendant’s counsel will deliver to plaintiff’s counsel in electronic format (to be agreed upon by the parties) all non-privileged documents and information included in the extracted files and file fragments, together with a privilege log which identifies each document for which defendant claims privilege and describes the nature of the documents withheld (but without revealing information which is itself privileged), so as to enable plaintiff to assess the applicability of privilege.

(g) Discovery Disputes:  The referee will resolve any disputes concerning relevancy and privilege. Subject to the parties’ agreement, the referee’s determination will be final.

(h) Cost Sharing:  All costs for the expert will be borne by plaintiff, subject to any possible reallocation of costs at the conclusion of this action.  Plaintiff will indicate if she is willing to bear any other discovery-related costs and, if so, specify her proposed share.

(i) Discovery Deadline:  The parties should agree to a fast-track discovery schedule, subject to an outside ninety-day deadline within which discovery should be completed.

(j) Retention of Clone:  The discovery referee will keep the clone until the action is concluded, at which time the clone will be returned to defendant’s counsel for disposal.