If we value the pursuit of knowledge, we must be free to follow wherever that search may lead us.”

Adlai E. Stevenson Jr. (American politician, 1900-1965).

Since the e-discovery related amendments to the Federal Rules of Civil Procedure in December 2006, it has become increasingly common for litigants to seek complete copies, or images, of computer hard drives from their adversaries. Not all appreciate, however, that such requests are not likely to be supported by the court in the absence of special circumstances that justify such an invasive and often overreaching demand.

This article will discuss how the rules and court decisions have addressed the propriety and parameters of hard drive image requests.

Pursuant to Federal Rule of Civil Procedure 34, a party may certainly request copies of electronically stored information maintained by an adversary. In particular, Rule 34 permits a party “to inspect, copy, test, or sample any designated documents or electronically stored information.” While there is no doubt as to a party’s right to request duplication of relevant electronic data, requests calling for complete copies of a party’s computer hard drives for searching and production of select ESI are often met with resistance.

The official comment to Rule 34, the numerous decisions and commentary from the well-known e-discovery think tank, the Sedona Conference, make it clear that forensic imaging of an adversary’s computer is an extraordinary request that will generally be permitted only in exceptional circumstances. These include cases in which there is evidence of egregious discovery abuses or suspicious or unusual computer use or data preservation practices, or situations in which a computer or computer systems are directly related to a cause of action. Even in these circumstances, hard drive imaging is usually carefully controlled by the parties and the court.

The reasons for this are obvious. Requests for production of hard drive images are almost always tantamount to requests to preserve and produce at least some volume of ESI that bears no relevance to the dispute at issue. In the vast majority of cases, even the hard drives of the most central witnesses will contain only a relatively small subset of information that will actually be relevant to the issues in litigation. Moreover, in many cases, information contained on the hard drive may be subject to legitimate claims of privilege.

Not surprisingly therefore, the Rule 34 2006 Advisory Committee notes provide that “[t]he addition of testing and sampling to Rule 34(a) with regard to documents and electronically stored information is not meant to create a routine right of direct access to a party’s electronic information system, although such access might be justified in some circumstances.” The second edition of The Sedona Principles: Best Practices, Recommendations & Principles Addressing Electronic Document Discovery provides additional guidance on the topic. Comment 8.c. of The Sedona Principles echoes the 2006 Advisory Committee Note of Rule 34(a)(1), providing that while making a forensic image of an adversary’s computer may be “appropriate in some circumstances, it should not be required unless exceptional circumstances warrant the extraordinary cost and burden.”

MEETING THE IMAGE PRODUCTION STANDARD

In cases addressing requests for forensic imaging and examination, as a threshold matter, federal district courts have consistently held that electronic data stored on computer hard drives, including “deleted” files and related data, is subject to discovery.

However, courts have been hesitant to provide a party direct access to an adversary’s computer without a showing of “good cause.” Recent decisions have demonstrated that this standard is more likely to be met when the requesting party is able to demonstrate the adversary’s destruction or alteration of potentially relevant ESI or the operation and/or content of a computer or computer systems is directly related to a cause of action.

In contrast, forensic imaging and examination requests are likely to be denied where the request is broad in nature, where the connection between the computers and the claims in the lawsuit is unclear and/or where it appears that the request is based on a “mere suspicion” that the responding party is withholding ESI from production.

For example, in Peskoff v. Faber, plaintiff was a former managing partner of a venture capital fund who sued defendant, also a managing partner of the fund, alleging misconduct in the fund’s management. In response to plaintiff’s discovery requests, defendant initially produced computer disks containing electronic documents, including e-mails, that were obtained from plaintiff’s computer, but these disks did not include any e-mails that plaintiff received or authored between mid-2001 and mid-2003, a relevant period in the case. Nor did defendant explain why there were no e-mails produced for that period, where the e-mails might be located within the company’s computer system or archives, or what specific steps were taken to locate the e-mails.

Defendant’s failures at various stages of the litigation to take any meaningful steps to preserve relevant ESI are chronicled in a series of opinions by Judge John M. Facciola. In the most recent of these decisions, Facciola concluded that defendant’s flagrant discovery abuses — including a failure to deactivate network maintenance tools that automatically deleted ESI well after the duty to preserve had been triggered — justified the need for a forensic examination of defendant’s computer systems.

Similarly, in Treppel v. Biovail Corp., a defamation case, plaintiff was able to successfully demonstrate that the defendant corporation and its CEO (also a defendant), failed to take appropriate and timely steps to preserve relevant evidence. In particular, the CEO’s laptop had not been first imaged and preserved until over two years after the litigation commenced. Compounding this misconduct, discovery had revealed that the CEO was the sole company employee who engaged in the unusual practice of downloading his e-mails from the company server onto his laptop on a daily basis, thereby removing them from any corporate backup protocols.

This process resulted in the CEO having sole control over whether e-mails to or from him were preserved or discarded and eliminated any protections afforded by the company’s backup system. For these reasons, the court sanctioned the defendants, ordering, among other penalties, that the CEO permit a thorough forensic examination of his laptop by the plaintiffs expert.

A number of courts have also permitted forensic imaging where there was a clear nexus between the requesting party’s claims and the responding party’s computer or computer systems.

In Balboa Threadworks Inc .v. Stucky, plaintiffs brought an action against defendants pursuant to the Copyright Act and the Lanham Act, alleging that defendants wrongfully copied digital embroidery designs and sold the designs. Although the case presented no discovery abuses of the type generally required for a forensic imaging, the court explained, “because the infringement … claimed to have occurred through the use of computers to download copyrighted material, the importance and relevance of computer evidence is particularly important.” Accordingly, the court ordered that all of defendants’ computers and peripheral equipment, including ZIP drives, be made available for mirror imaging.

It is important to note, however, that courts will be less apt to grant motions to compel a forensic imaging and examination “on the mere suspicion, based solely on the nature of the claims asserted” that the responding party may be withholding information in discovery responses.

In Diepenhorst v. City of Battle Creek, a former employee of the City of Battle Creek Police Department brought an action for sexual harassment, alleging that her supervisor subjected her to unwelcome sexual advances. Plaintiff brought claims of quid pro quo sexual harassment and hostile work environment under both Title VII and the Michigan Elliot-Larsen Civil Rights Act. In a discovery motion, defendant demanded production of plaintiff’s computer hard drive to make a “mirror image” of its contents. In support of its motion for a forensic examination, defendant did not adequately describe the purpose of the examination or why the imaging was necessary. Accordingly, the court rejected defendant’s motion, explaining that it was “loathe to sanction intrusive examination of an opponent’s computer as a matter of course, or on the mere suspicion that the opponent may be withholding discovery information.”

As the court further noted, while there is always the possibility that a party may withhold information “the courts have not allowed the requesting party to intrude upon the premises of the responding party just to address the bare possibility of discovery misconduct.”

PRACTICE TIPS

These decisions emphasize that courts will generally support a party’s request to conduct a forensic imaging and examination of an adversary’s computer where exceptional circumstances, i.e., “good cause” is demonstrated. Accordingly, such requests made as a matter of course, early in litigation and absent any indicia of misconduct or a showing that the computer contents as a whole are central to the litigation issues, will likely be thwarted.

Moreover, without more, merely the very commonly held suspicion that a responding party is withholding information is not likely to constitute adequate justification for image demand. Litigants seeking this extraordinary form of discovery would be well served first develop a record of discovery abuses, including data deletion, untimely or absent preservation efforts or unusual computer and data management practices, before pressing their adversary and the court for production of a hard drive image.

Scott Etish is an associate in Gibbons’ business and commercial litigation department. He is a member of the firm’s e-discovery task force and frequently publishes and lectures on e-discovery and information management best practices.

Related posts

• 6 Reasons why a website is critical to your business
• 6 Simple Tips To Help Potty Train Your Puppy
• 6 Tips to Explode Your Offline or Online Business
• SATELLITE TV BY DIRECT TV DEALS A BLOW TO MARRIAGE PROBLEMS
• Niche Marketing
• 6 Steps On How To Install Confidence Into Your Clients
• Researching the Market
• 6 Key Points to Evaluate Online Lenders
• Rogue Dialers - The Nets Latest Scamola!