Court Orders Forensic Examination of Defendants’ Business and Home Computers, Articulating 20-Step Protocol
Koosharem Corp. v. Spec Personnel, LLC, 2008 WL 4458864 (D.S.C. Sept. 29, 2008)
In this breach of contract case, plaintiffs alleged that defendants wrongfully obtained and used confidential information from former employee, Kenneth Fuston, who went to work for the defendants. Specifically, plaintiffs alleged that defendants used the information to hire approximately 20 of plaintiffs’ employees, open new offices in eight cities, and embark upon a new line of business in competition with plaintiffs. Plaintiffs moved to compel production of computers believed to contain information related to those claims. The court had previously granted a motion to compel and ordered defendants to produce emails to or from any current or former employee or customer of the plaintiff found on Fuston’s home computer and documents reflecting communication with the defendant and certain former employees of the plaintiff. Defendants produced 1,936 pages of email. Believing the production was incomplete, plaintiffs brought a second motion to compel.
Plaintiffs noted several problems with defendants’ original production. Notably, all of the emails produced reflected the date compiled rather than the date received or sent, several emails allegedly retrieved from Trevor Doyle did not have Doyle listed as a sender or recipient, and many emails were missing their attachments. These irregularities, plaintiffs argued, called the authenticity of the documents into question. Plaintiffs also argued that documents were modified even after notice of litigation and that defendants made no document retention efforts after the lawsuit was filed. Specifically in support of production of home computers, plaintiffs argued that defendants’ new hires were not immediately provided with a company email account and thus conducted work from home computers and personal email accounts. Also, according to the plaintiffs, former employees emailed confidential information to their homes before going to work for defendants.
The court rejected defendants’ argument that the inspection be denied based upon relevance objections to the underlying requests. Relying upon the prior order compelling production, the court stated that the only issue before it was whether forensic analysis should be allowed in light of defendants’ failure to produce documents and because of relevant information stored on the computers. Finding that forensic analysis was appropriate, the court issued a lengthy and detailed protocol for the forensic examination:
(1) Defendants will make available for forensic analysis and data recovery to be conducted by an expert forensics firm (“Expert”) any business computers and/or any personal computers used to conduct business, correspond in any way regarding business, Spec and/or its current or employees, and/or plaintiffs and/or their current or former employees, for Steve Arnold, Walter Chudowsky, Benita Dillard, Trevor Doyle, Ken Fuston, Kevin Moore, Steve Roberson, and Jude Tallman.
(2) The time frame for the forensic analysis and data recovery will encompass the period September 1, 2007, to present.
(3) The parties will jointly agree within five (5) calendar days after entry of this order on an Expert that will be used to conduct the data recovery and forensic analysis.
(4) Defendants will produce to the Expert within ten (10) calendar days after entry of this order the computers identified in paragraph 1.
(5) The Expert will recover only the documents and email account or accounts used by individuals identified in paragraph 1 (or those accounts and documents accessed remotely using another computer).
(6) The Expert also will conduct a search or run other appropriate programs to determine whether any emails or documents have been deleted, destroyed, altered, or otherwise compromised since January 25, 2008, and whether any programs have been installed that would alter, destroy, erase, modify, or otherwise compromise any portion of each computer or its contents as of January 25, 2008. The Expert also will be permitted to conduct such search efforts as are necessary to form an opinion as to whether any procedures were put into place to preserve emails and documents as of January 25, 2008.
(7) The recovery of emails will include all emails in any form whatsoever including, but not limited to, deleted emails, forwarded emails, copied (“cc”) and blind-copied (“bcc”) emails and draft emails. The recovery of documents will include all documents including drafts, multiple versions, and final versions.
(8) The Expert will securely maintain the original data recovered in order to establish a chain of custody.
(9) The Expert will produce a copy of the recovered data to defendants’ local counsel of record attorney John Glancy (“defendants’ counsel”).
(10) Defendants’ counsel will review the data to identify any privileged or personal emails that it seeks to withhold from document production.
(11) Within ten (10) business days of obtaining the recovered data from the Expert, defendants’ counsel will prepare and provide to counsel for plaintiffs: (I) a log of privileged emails (“Privileged Email Log”) protected against disclosure by a relevant legal privilege and include the identity of the email, the sender and recipient (and any individuals identified in the “cc” and “bcc” fields), the date sent, the nature of the privilege, a general description of the email and the basis for asserting the privilege; and (ii) a log of personal emails (“Personal Email Log”) and include the identity of the email, the sender and recipient (and any individuals identified in the “cc” and “bcc” fields), the date sent, a general description of the email and the basis for claiming it is a personal email. To the extent that defendants’ counsel asserts privilege as to any documents obtained from the forensic analysis, such documents also must be set forth on a document privilege log (“Privileged Document Log”) and be produced within ten (10) business days of obtaining the recovered data.
(12) Together with the Privileged Email Log, Personal Email Log, and Privileged Document Log, defendants shall produce (within 10 business days after obtaining the recovered data from the Expert) all emails and documents recovered by the Expert, which are not identified on the Logs.
(13) For purposes of the procedure described herein, a personal email is one that does not relate to or in any way concern: defendants’ employment, whether it deals with past, present, future or prospective employment; plaintiffs’ business; plaintiffs’ customers and former customers (including contacts at customers and former customers); plaintiffs’ employees and former employees; defendants’ drivers or plaintiffs’ former drivers; plaintiffs and any of its employees; or Spec Personnel and any of its employees, including but not limited to, communications regarding Spec’s closing of offices staffed by plaintiffs’ former employees or efforts to have anyone take over, purchase or otherwise assume responsibility for any Spec office staffed by plaintiffs’ former employees.
(14) If any document attachment to an email is identified through the discovery of an email, and such document was opened, saved from, detached or otherwise transferred or reproduced on the hard-drive of defendants’ computers, such attachment shall be produced or the Expert shall be given access to defendants’ computer to conduct further data recovery in order to obtain such document(s).
(15) If any document is identified by the Expert as being opened, saved, altered, transferred or reproduced and it falls within the scope of the request, such document must be produced by the Expert and handled by defendants’ counsel in the same manner as though it was an email communication.
(16) If plaintiffs disagree with the assertion of any privileges, the parties shall submit to the court the disputed documents and Logs for the court to view in camera and determine whether the documents must be produced.
(17) Defendants are responsible for any and all fees, costs and expenses associated with gathering the computers and transmitting them to the Expert.
(18) At this time, the parties will share equally the fees, costs and expenses charged by the Expert. When the Expert is retained, the Expert will be jointly informed that any billing or retainer must be split evenly between the parties. If any retainer is required, the parties are obligated to provide the retainer within three (3) business days of the Expert’s request so that the process is not delayed in any way. Neither party waives its right to seek reimbursement or payment of any fees, costs and expenses charged by the Expert if it is determined that award of such is appropriate pursuant to the Federal Rules of Civil Procedure, Local Rules or case law.
(19) By agreeing to this order, no party waives its rights or objections to the discovery sought herein.
(20) The parties understand and agree that this order addresses the preliminary scope for the computer production and forensic analysis. If the initial production and analysis determines that additional searches are necessary, either party may petition the court to revisit the scope of this order.