• Technologies
    • Review Platforms
    • ILS Social Media Data Analysis Suite
  • Consulting & Services
    • Consulting
    • Forensics & Collections
    • Review Platform Hosting & Management
    • Managed Review
    • Our Experts
  • AI Resources
  • ILS Articles
  • Company
    • About Us
    • Careers
    • Support
    • Contact Us
  • ILS
  • Sales
  • Support
  • Technologies
    • Review Platforms
    • ILS Social Media Data Analysis Suite
  • Consulting & Services
    • Consulting
    • Forensics & Collections
    • Review Platform Hosting & Management
    • Managed Review
    • Our Experts
  • AI Resources
  • ILS Articles
  • Company
    • About Us
    • Careers
    • Support
    • Contact Us

November 11, 2013

Is Forensic Imaging Warranted if Defendant Metadata Appears Inconsistent?

by Alan Brooks

Metadata, or data about data, is becoming a real hot topic in the area of plaintiff electronic discovery law. In an eDiscovery order in the case Teledyne Instruments, Inc. v. Cairns, et al., Case No. 6:12-cv-854-Orl-28TBS (M.D.Fl. October 25, 2013), plaintiff sued defendant for breach of contract and other business torts arising from a former employee applying for a patent that plaintiff claimed was its proprietary property.

The parties agreed to an ESI Protocol Order, and defendants initially produced 13,800 native files, each file containing a “load file,” called a “DAT file” with metadata. However, the initial DAT files did not have individual Bates stamping. The defendants then produced a “Replacement DAT” with updated files, and these files reflected electronic data from 18 separate electronic storage devices in defendants’ control.

So what was the problem? Plaintiff’s forensic computer expert noticed discrepancies and inconsistencies in the metadata from the original DAT files and the Replacement DAT files. Plaintiff therefore requested forensic imaging of all 18 devices, and even offered to bear the cost of such additional production. Defendants objected to the forensic examination of the devices and averred they had produced everything in accordance with the ESI Protocol Order, and that additional production would be unduly burdensome. Defendants also noted that the discrepancies in metadata were legitimate and expected: the initial production in native file format reflected the “application metadata,” while the Replacement DAT was from the file system and reflected the “system metadata.”

The court sided agreed that comparing dates and other information from “application metadata” vs. “system metadata” was NOT an apples to apples comparison. Plaintiff had not shown that this additional discovery would uncover relevant evidence. Finally, the court also noted that even if plaintiff bore the expense of the forensic imaging, it would still unfairly prejudicial to defendants to have 18 devices containing personal and irrelevant data collected.

So what is the difference between “application metadata” and “system metadata,” and why did the court agree that discrepancies between the two are normal and expected? More on this in our next blog!

ILS – Plaintiff eDiscovery Experts

Categories: Forensics

Tags: metadata, plaintiff ediscovery, plaintiff electronic discovery

ILS
17744 Sky Park Circle, Suite 270
Irvine, CA 92614
(888) 313-4457
sales@ilsteam.com
  • About ILS
  • Consulting
  • Forensics & Collections
  • Review Platform Hosting & Management
  • Managed Review
  • Sales
  • Support
  • LinkedIn
  • X

© 2025 ILS.

  • Privacy Statement
  • Cookie Statement
  • Terms of Use/Legal
ILS
Manage Cookie Consent
We use cookies to optimize our website and our service.
Functional Always active
The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user.
Statistics
The technical storage or access that is used exclusively for statistical purposes. The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you.
Marketing
The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes.
Manage options Manage services Manage {vendor_count} vendors Read more about these purposes
View preferences
{title} {title} {title}