September 14, 2012

Can Mirror-Imaging Orders Better Preserve Electronic Data?

by Alan Brooks

The wiping of work computers or business smartphones will likely be considered spoliation after a duty to preserve evidence arises, but what about home computers or cell phones? Evidence on personal computers is held to the same standard as business computers, but the electronic data is harder to control or preserve. One way plaintiff trial attorneys may prevent disaster may be to ask for a mirror-imaging order, as was done in United Factory Furniture v. Alterwitz, 2012 WL 1155741 (D. Nev. April 6, 2012).

This case centered on former employees as defendants whom the plaintiff-employer accused of copying and destroying evidence on work computers and creating a “back door” on personal computers to gain access to the employer’s server. The plaintiff-employer believed that some of this deleted information remained on the defendant’s personal devices, and asked the court to expedite discovery under Rule 26(d) to issue an injunctive order against destruction of evidence and to issue a mirror-image order. A mirror image order captures every piece of data in a computer’s operating system and is also sometimes called a “forensic copy.”

The court considered the request for mirror imaging within the undue burden test of Rule 25(b)(2)(B). After weighing the need for a mirror image order against the privacy concerns of the defendants, the court noted that mirror image orders are proper when party has been engaged in the willful destruction of emails or data and would prevent the need for an injunction.

To minimize the intrusiveness of this mirror imaging order to defendants, the court appointed an objective computer specialist to carry out the order and instituted a Protective Order dictating that any evidence as a result of the mirror imaging order be delivered in a sealed envelope to remain in the court’s custody throughout the litigation. If the plaintiff later believed the defendant engaged in spoliation, they could later move to open the mirror-imaging documentation.

Mirror imaging is one technique that is becoming more popular as courts struggle with enforcing compliance with the duty to preserve evidence. For more information on how expert computer forensics can capture and uncover deleted files or email chains, call us at 888-313-4457.

ILS – Plaintiff eDiscovery Experts