Electronic Discovery and Computer Forensics Case List - Kroll Ontrack

interceptions must occur contemporaneously with transmission. The court further held that the emails
did not fall within that requirement because they “were stored on, and recovered from, the
hard drive of the family computer” rather than intercepted at the time of transmission.
� Commissioner v. Ward, 580 S.E.2d 432 (N.C. App. 2003). In this matter, the plaintiffs and the
defendants engaged in a long and complex discovery battle relating to the protocols for discovery
of both paper and electronic documents stored off-site by the defendants. Upon the plaintiffs’ first
motion to compel, the court ordered the defendants to permit the plaintiffs to examine, review and
copy stored documents and make a good faith search for other documents, including all electronic
data on DAT tapes, for inspection and review by the plaintiffs. When the defendants failed to
cooperate, the plaintiffs sought a second motion to compel. Prior to the hearing on this second
motion, the parties entered into a consent order which included provisions allowing the plaintiffs to
examine, inspect and copy “all information stored in computers, computer hard drives, removable
electronic data storage media, diskettes, magnetic tapes, CD ROMs, zip discs and jazz discs” and
requiring the defendants to produce all backup data and describe in writing the process used to
access the data. Again the defendants failed to comply with the consent order in providing the
required electronic information. The plaintiffs then made its third motion to compel and sought
sanctions. Finding that the defendants had intentionally and willfully refused to comply with
discovery, the trial court sanctioned the defendants by ordering them to produce, at their cost,
copies of the backup tape data. The appellate court affirmed the sanctions.
� DeLoach v. Philip Morris Co., 206 F.R.D. 568 (M.D.N.C. 2002). The plaintiffs sought discovery
sanctions alleging that the defendant’s expert report relied on computerized transaction data that
was deliberately withheld from the plaintiffs during discovery. The discovery request at issue
sought "[a]ll summary documents (including electronic data) relating to your leaf tobacco bids,
purchases, or price paid, including but not limited to the entire Tobinet database in electronic form,
but excluding individual transaction documents such as purchase orders and invoices." The
plaintiffs were only provided the database data after the defendant’s expert report was issued (in
which the defendant’s expert relied heavily on this other computerized data). The court held that
the withholding of the data resulted in unfairness to the plaintiffs and allowed the plaintiffs to
respond to the report and provided no opportunity for the defendant to reply.
� Burroughs v. Barr Lab., Inc., 143 F.R.D. 611 (E.D.N.C. 1992), vacated in part on other grounds
40 F.3d 1223 (Fed. Cir. 1994). The court held that the attorney work product privilege applied to
printed results of computerized database searches.
South Carolina
� Uhlig LLC v. Shirley, 2011 WL 2728445 (D.S.C. July 13, 2011). In this discovery dispute, the
plaintiff moved to impose sanctions and modify the forensic examination protocol for the
defendants’ computers and peripheral devices. The parties had agreed to the protocol following
numerous interventions by a magistrate judge; however, disputes continued to arise after forensic
experts conducted searches and the plaintiffs sought to broaden the scope of discovery. Finding
the plaintiff presented sufficient evidence that the broader scope of e-discovery was warranted, the
court lifted the protocol’s date restrictions and agreed that running hash value comparisons
eliminated any need to limit search terms. Finally, the court declined to impose sanctions against
the defendants, who were simply opposing the plaintiffs’ efforts to modify and extend a previously
agreed upon discovery protocol.
110