July 7, 2015

Update on Forensic Examination of Hard Drives and Computers

by Alan Brooks

When Can a Party Obtain a Computer Forensic Examination?

A year ago, ILS focused its monthly newsletter on the forensic examination of hard drives, computers, and mobile devices. Since then, the federal courts have issued several new decisions on the subject. Below is a summary of recent case law regarding eDiscovery disputes over computer forensics, many of which involve case-changing moments for the plaintiff’s trial attorneys involved.

Disputes Where the Court Denied the Request for Forensic Examination

Thompson v. Workmen’s Circle Multicare Center, No. 11 Civ. 6885 (DAB)(HBP)(S.D.N.Y. June 9, 2015). Plaintiff failed to provide the required threshold information, including the purpose, methodology, and time frame for the proposed forensic examination. The court denied this pro se plaintiff’s request.

In Re VERP Investment, LLC, No. 05-15-00023-CV, (Tx. Ct. App. Feb. 17, 2015). Texas Court of Appeals reversed the order for forensic examination, holding that the requesting party failed to meet the threshold evidentiary showing. Specifically, the requesting party must prove that: (i) the producing party defaulted in its obligation to search and produce the requested data, and (ii) the production was inadequate and a mirror image would recover relevant electronic data.

Hawkins v. The Center for Spinal Surgery, No. 3:12-1125(M.D.Tenn. June 18, 2015). Defendants sought forensic examination of a flash drive in Plaintiff’s possession. Plaintiff alleged that she produced all documents and data contained on the flash drive. The court found that Defendants did not provide sufficient threshold evidence to necessitate a forensic examination, and that doing so would require extending the discovery deadline and trial date, which the court declined to do.

Boston Scientific Corporation v. Dongchul Lee, Case Nos. 5:14-mc-80188-BLF-PSG, 1:13-cv-13156-DJC (N.D. Cal. August 4, 2014). Plaintiff sought forensic examination of two laptops: one used before the lawsuit and one issued to Defendant’s employee after Defendant segregated the first laptop for litigation. The court declined to order the forensic examination of either laptop, concluding that forensically examining the laptop used after litigation commenced posed too great a risk of disclosing proprietary information in a contentious business tort suit, and that Defendant had already provided sufficient ESI from the first laptop, including metadata, USB reports and web browsing history.

Disputes Where Court Allowed the Forensic Examination

Electrified Discounters, Inc. v. MI Technologies, Inc. et al., Case No. 3:13cv1332 (RNC) (D. Conn. May 19, 2015). The District of Connected granted a forensic examination after the court found that the party failed to implement a litigation hold for over two years, deleted over 1,000 emails after the duty to preserve evidence arose, and made an inadequate production of ESI. The court held that discrepancies and inconsistencies in discovery warranted computer mirror imaging.

HMS Holdings Corp. v. Arendt, et al., 2015 NY Slip Op 50750(U) (Sup. Ct., Albany County, May 19, 2015). The parties stipulated to a forensic examination of hard drives at issue, which revealed evidence that two of the Defendants (who were licensed attorneys) had used wiping software to delete electronic data before turning over the laptops for forensic imaging. Evidence of the data destruction remained, and the court ordered a mandatory adverse inference instruction and attorney fees, and referred the case to the New York State Bar Association for ethical review of the attorney-Defendants.

Looking for a Plaintiff Computer Forensics Expert?

Unlike many other eDiscovery companies, ILS only works for the plaintiff’s bar so we understand the goals that plaintiff trial lawyers pursue every day.

Learn more about our expert computer forensics and subscribe to our plaintiff eDiscovery blog for the latest electronic discovery case law summaries delivered straight to your inbox.