As businesses and companies increasingly use computer systems to store and maintain important data, the need to recover data from these systems has become an essential part of eDiscovery. In order to deal with complex data storage systems, litigators must rely on experts in digital forensics to preserve and collect potentially responsive data. In addition to preserving and collecting primary data, digital forensic experts often address instances in which data has been hidden, deleted, or otherwise altered, as well as collecting metadata that indicates when and how primary data has been modified. Digital forensic experts provide comprehensive reports for use at trial and often testify at trials regarding their data collection efforts.
The following case provides for the many important roles that digital forensic experts may have in eDiscovery. In Cenveo Corp. v. Slater, No. 06-2632, 2007 WL 442387, (E.D. Pa. Jan. 31, 2007), the court addressed a dispute between the parties concerning how and under what circumstances materials on hard drives in defendants’ possession would be produced to the plaintiff. The plaintiff alleged its former employees improperly used plaintiff’s computers, confidential information, and trade secrets to divert business from plaintiff to defendants.
The Plaintiff sought “to use a mirror or digital imaging method to access the information on the hard drives whereby digital image[s] of the hard drives would be created and turned over to a third party computer forensics expert of plaintiff’s choosing who would search the image for relevant information.” Plaintiff also sought that defendants “provide a privilege log to plaintiff’s third party forensic expert, and that the forensics expert would be bound not to disclose any privileged information provided to him.” The defendants, concerned about the disclosure of confidential or privileged information, instead proposed that “they create a digital image of the hard drives in question and search that image using terms that plaintiff provides and defendants agree upon,” and that they would disclose all data uncovered by the search terms that was not confidential.
The court ordered the following:
- The plaintiff would select a data forensics expert to produce a digital or mirror image of all of defendant’s computers and portable hard drives. The expert would sign a confidentiality agreement with both parties.
- The defendants would make computers and other equipment available to the plaintiff’s expert at the defendant’s place of business. The plaintiff’s expert would inspect and forensically image (i.e., copy the contents) of defendants’ computers, without removing the equipment from the defendants’ premises. The defendants may have their own digital forensics expert present during the inspection and imaging.
- “Within ten days of inspection and imaging, [the] plaintiff’s expert [would] provide the parties with a report describing the computer equipment [the] defendants produced and the actions [the] plaintiff’s expert took with respect to each piece of equipment.”
- “[The] plaintiff’s expert [would] recover all documents from the mirror images, including but not limited to all word-processing documents, email messages, PowerPoint or similar presentations, spreadsheets and other files, including ‘deleted’ files. [The] plaintiff’s expert [would] provide the recovered files to [the] defendants in a reasonably convenient and searchable form, along with, to the extent possible, information showing when any files were created, accessed, copied, or deleted.”
- “Within forty-five days of receipt, [the] defendants would review the recovered materials for privilege and responsiveness, supplement [the] defendants’ responses to [the] plaintiff’s discovery requests, and send to [the] plaintiff’s counsel all non-privileged responsive documents, as well as a privilege log complying with Federal Rule of Civil Procedure 26(b)(5)(A).”
As can be seen from these extensive and detailed instructions, digital forensics experts are essential in managing the intricacies that arise from the collection of data in eDiscovery. In this case, the plaintiff’s expert would need to be competent in performing a variety of complex tasks, including: (1) forensically imaging computers and hard drives; (2) creating a report or log of all data collected; (3) ensuring that there is a record of the chain of custody for all devices inspected and imaged as well as for all files collected; (4) discovering files that were deleted; (5) collecting metadata, such as dates of when files were created and deleted; (6) providing files to the defendant’s in a searchable form; and (7) keeping all information strictly confidential. Likewise, the defendants would likely need to contract with a forensic data expert to oversee the plaintiff’s inspection and imaging of their devices, as well as to search the files collected by the plaintiff’s expert and filter out confidential and privileged information. In a case like this, centered on trade secrets and confidential information, such forensic data collection during discovery could be pivotal to the outcome of the case.
As shown by Cenevo Corp., forensic data collections can be complex, particularly when confidential files are at issue and when data may have been deleted. Often, an independent expert is needed in these cases. As such, litigators should consult with an experienced eDiscovery service provider before forming their discovery plans or filing motions to compel, in order to understand the best methods and limitations of forensic collections in any given case. Similarly, litigators should rely on digital forensic experts throughout the eDiscovery process.
For more information about forensic collections and eDiscovery services, contact the professionals at LITeGATION.
