Citing Sedona Principles, State Court Allows Forensic Imaging of Former Employee’s Home Computer

Quotient, Inc. v. Toon, 2005 WL 4006493 (Md. Cir. Ct. Dec. 23, 2005)

In this case, Quotient alleged that while still a Quotient employee, Mr. Toon intentionally and surreptitiously provided a former Quotient employee access to Quotient’s computer system so that the former employee could obtain Quotient’s trade secrets and confidential information and use such information to compete with Quotient. Quotient sought an order to permit Quotient’s retained computer expert access to “Toon’s personal computer system, hard drives and back-up hard drives, disks, C.D.’s and/or other data, back up devices or vehicles in order to capture an image of these items.” Quotient represented it would pay the full and complete cost of the copying process and would abide by any restriction on access and use imposed by the court.

In support of the motion, Quotient presented email and Instant Messages (IMs) obtained from its computer system which it argued substantiated the allegations of the complaint. Quotient also presented an affidavit from its retained expert, indicating that digital evidence is fragile and could be easily lost through the continued use of a computer system. The expert asserted that the destruction of potential evidence could be completely unintentional:

By the mere fact that a computer is turned on or off, the Operating System (OS) writes data to the hard disk, which could be overwriting data of possible evidentiary value that may exist in unallocated clusters. Unallocated clusters may contain data that was written to the disk at an earlier time; this data or its fragments continue to reside on the system’s hard disks even after the original files were deleted from the system. The data from the original files continue residing in these unallocated clusters until they are over-written by a new file. The OS routinely writes temporary files to the hard disk that may also contain data of possible relevance. Given that the OS only intends to cache this data to the hard disk on a temporary basis, any fragmentary information left behind could be overwritten at a later time, while a computer system continues to be in use.

The expert further stated that acquiring a hard disk image would be the least invasive way to examine the type of computer system at issue, and that the forensic examiner would not view the underlying data while acquiring a forensically sound image.

In response, Toon argued that Quotient had not established the need for such emergency relief, and that there was no evidence that he had intentionally destroyed documents of any type or sought to hide them. He further argued that the examination would invade the personal privacy of Toon and his spouse who also used the computer.

The court concluded that both parties had presented legitimate concerns, but rejected one theory advanced by Quotient:

There is no evidence at this juncture that Toon has concealed or destroyed evidence, and Quotient’s argument on this point seems to be that he may have motive and opportunity to do so having now been sued for millions of dollars. While this may be true as a general theory, that theory would apply in every case. This is not a convincing rationale for the special extraordinary relief sought by Quotient.

However, it found Quotient’s argument that the unintentional destruction of relevant evidence should be halted when it can be done so in a fashion that is minimally intrusive (and where Quotient was willing to bear the full cost of the process) more persuasive. “This Court is persuaded from the evidence before it that there is a substantial probability that evidence in the form of deleted or undeleted e-mails, IMs, and/or other files that are relevant to this case could be made less accessible to the parties merely by Toon’s normal course of computer use, regardless of his intentions and motive.” It noted that the evidence showed that communications relating to the litigation were present in Toon’s computer, and opined that “all parties and the interest of justice will be likely advanced if the nature of the alleged communications can be determined without several more months of ‘overwriting’ on the hard drive occurring.”

The court further noted that Toon did not dispute that he had a duty to preserve relevant evidence in his possession, but that he had not articulated how he would meet the preservation obligation by a means other than the one advocated by Quotient, i.e., the copying of the hard drive of Toon’s personal computer.

The court further reasoned:

One of the leading authorities on electronic document production recognizes that preservation orders should only be entered when necessity has been shown. The Sedona Principles: Best Practices, Recommendations & Principles for Addressing Electronic Document Production, 27 (July 2005), available at http:// www.thesedonaconference.org. However, that report recognizes the value of such orders in promoting efficient litigation:

Preservation orders may in certain circumstances aid the discovery process by defining the specific contours of the parties’ preservation obligations … Preservation orders should be tailored to require preservation of documents and data that are potentially relevant to the case, and should not unduly interfere with the normal functioning of the affected computer systems.

Accordingly, the court concluded that it would permit the copying process to proceed, but only under the following restrictions:

1.A sufficiently qualified forensic computer expert shall be allowed access to Toon’s computer system to make a copy of the hard drive.

2.In making the copy, the expert shall not inspect or review any document or communication that may exist on the hard drive.

3. Once made, the copy of the hard drive shall be kept secure by the expert and not used by the expert or anyone else except by further order of this Court.

4.Toon, his counsel, and any expert of their choosing may observe the copying process.

5. The copying process shall proceed at a place and time agreed to by counsel but as quickly as possible to minimize the further loss of potentially relevant data.

6. Copies made shall be limited to those devices where the unintentional destruction of evidence is taking place by the routine continuing use of the device. For example, CDs not in current use and stored would not be unintentionally erased and will be subject to the usual discovery process.

7. The expert designated to perform this function shall be considered to be the Court’s expert for this purpose and shall operate under the direction of the Court’s order.

8. The expert, prior to beginning the expert’s work, shall agree in writing to abide by the terms of this Memorandum and Order.

9. Quotient shall be responsible for any harm or damage to Toon’s computer system that may result from the application of the process requested by Quotient and ordered by this Court.

10. The expert should follow a standard forensic protocol such as that of the National Institute of Justice and shall file, upon completion of the process, a certification with the court that the process is complete and the precautions taken to secure the data obtained.

(Footnote omitted.)