Electronic Discovery and Computer Forensics Case List - Kroll Ontrack

that were temporarily stored in the cache files but not downloaded onto the defendant’s hard
drives, entitled it to a spoliation inference at trial. The court rejected the plaintiff’s argument and
accepted the defendant’s summary judgment motion on the issue, holding it impractical for the
defendant to have had the duty to preserve such evidence.
� Cenveo Corp. v. Slater, 2007 WL 442387 (E.D. Pa. Jan. 31, 2007). In a trade secrets
misappropriation case, the parties presented two differing approaches for how electronic data
contained on hard drives in the defendant’s possession would be produced to the plaintiff. The
plaintiff requested that the hard drives be completely imaged and given to a third-party expert to
search for relevant information. Under the plaintiff’s approach, the expert would sign a
confidentiality agreement to protect privileged information. The defendant argued, however, that
the parties agree upon search terms and the defendant will provide the search results from the
images of the hard drives. Agreeing with the plaintiff’s method, the court ordered a third-party
computer forensics expert to image and examine the hard drives. The expert will be chosen by the
plaintiff and the actual imaging will take place on the defendant’s premises under the supervision of
an expert chosen by the defendant. Furthermore, the court ordered the expert to provide the
defendant with a report of the documents recovered. The defendant must review the documents for
privileged material and thereafter produce relevant documents to the plaintiff.
� In Re the Twenty-Fourth Statewide Investigating Grand Jury, 907 A.2d 505 (Pa. 2006). During
a grand jury investigation, the court reviewed objections to the grand jury’s subpoena requiring a
newspaper publisher to produce four computer workstations and two hard drives. The newspaper
eventually produced the four computer workstations pursuant to the subpoena but refused to
produce the two hard drives. The lower court held the newspaper in contempt and imposed a
$1,000 per day sanction for failure to comply with the subpoena. The newspaper filed an
emergency application for review of the grand jury’s subpoena with the state supreme court. The
newspaper argued the subpoena’s requirement for the hard drives was overly broad. It further
argued that production of hard drives is much like producing an entire file cabinet filled with files.
Furthermore, the newspaper stated such production would produce a “chilling effect” on many of
the newspaper’s confidential sources for news stories since their identities may be revealed during
the investigation. The state countered by asserting the only information desired was the internet
browsing history of several employees and assuring any confidential information would be
safeguarded from disclosure. In vacating the lower court’s sanctions for failure to comply, the state
supreme court held that the state’s “particular method of disclosure is unduly intrusive in the
circumstances presented.” The court agreed with the newspaper’s argument and further held that
entire “filing cabinets” cannot be extracted and held by the government under the guise of a grand
jury subpoena when the result could be the disclosure of confidential information vital to the
newspaper’s business.
� Paramount Pictures Corp. v. Davis, 234 F.R.D. 102 (E.D. Pa. 2005). Alleging the defendant
infringed upon its motion picture copyright, the plaintiff sought a permanent injunction, attorneys’
fees and costs, and money damages. After uncovering the defendant’s alleged activities by tracing
his Internet protocol address, the plaintiff was granted access to the defendant’s computer and
hired a Kroll Ontrack computer forensic expert to conduct an examination. The expert determined
that, after wiping all data off of his hard drive, the defendant reinstalled the operating system just
16 days after the defendant received notice of the lawsuit. As a result, it was impossible to
determine whether the motion picture or related software was on the computer prior to the
investigation. In defending his actions, the defendant claimed he wiped the drive in preparation for
selling it to another individual. The court declared: “This argument does not obviate his duty to
102