Electronic Discovery and Computer Forensics Case List - Kroll Ontrack

equesting “any and all electronic storage media including hard drives, zip drives, thumb drives,
CD’s, DVD’s, etc. from and pertaining to any computer including desk top computers and/or
laptops, used by [the plaintiff] from January 1, 2002 to the present.” Before terminating the plaintiff,
the defendant hired a computer consultant to analyze the plaintiff’s hard drive to determine the
authenticity of certain e-mails. Following this, the defendant retained a computer forensics expert,
Kroll Ontrack Inc., to create a forensic image of the hard drive, conduct a more thorough
investigation of the computer media, and store the hard drive with the defendant’s law firm for
preservation. Although the defendant withheld the computer consultant’s records, the defendant
provided the plaintiff with the more in-depth report by Kroll Ontrack, insisting the plaintiff conduct its
own forensic analysis if unsatisfied with the investigation. Arguing it had maintained strict chain-ofcustody
procedures, the defendant submitted affidavits stating “there has been no change in the
data or information on the hard drive from the time it was retrieved…to the present.” Finding the
plaintiffs failed to show evidence that information on the hard drive had been altered, the court
granted the defendant’s motion to quash and ruled the plaintiffs had not met their burden in
demonstrating substantial need for the computer consultant’s analysis or showing they would suffer
undue hardship in obtaining the relevant information through other means. The court continued by
granting the plaintiff’s motion to quash, noting a party cannot issue a subpoena to another party
under Rule 45, but should have requested production of the plaintiff’s personal computer pursuant
to Rule 34.
� QZO, Inc. v. Moyer, 594 S.E.2d 541 (S.C. Ct. App. 2004). A corporation alleged that the
defendant, a former officer and shareholder of the corporation, violated state trade secret laws by
planning to compete with the corporation. The corporation requested the defendant turn over a
computer, which allegedly contained evidence of the defendant’s plans to compete. The trial court
granted a temporary restraining order (TRO) directing the defendant to hand over the computer to
the corporation or to a neutral third party. The defendant waited until seven days after the TRO was
issued to deliver the computer to the corporation. After receiving the computer, the corporation
hired a computer expert to inspect and retrieve any potential evidence from the computer’s hard
drive. The expert discovered the hard drive had been reformatted a day before the defendant
delivered the computer to the corporation, which erased any evidence that may have been on the
computer. The corporation requested sanctions in the form of a default judgment against the
defendant for intentionally violating the TRO. The trial court granted the corporation’s motion for
sanctions and entered the default judgment in favor of the corporation. The defendant appealed
stating that the evidence was insufficient to support such severe sanctions. On appeal, the
appellate court affirmed the trial court’s judgment, determining that the sanctions were not too
severe.
West Virginia
� Hanson v. First Nat’l Bank, 2011 WL 5201430 (S.D.W. Va. Oct. 31, 2011).
In this case, the plaintiff sought production of a defendant-employee’s e-mails with his attorney.
The plaintiff contended that the employer’s data policy, which stated that employee e-mails were
not confidential and were subject to review, constituted a waiver of any existing attorney-client
privilege. The defendant, while conceding awareness of the policy, tried to show that he
nonetheless believed the e-mails were confidential by relying on a different section of the policy.
The relevant section provided that other employees should regard messages as confidential and
accessible only by the intended recipient. Noting that the defendant’s reliance was misplaced as it
112