Electronic Discovery and Computer Forensics Case List - Kroll Ontrack

devices that contain relevant electronically stored information. The court held the imaging of the
media primarily for the purpose of preservation was an abuse of discretion, citing the fact that the
record “lacks any evidence that defendants have intentionally destroyed relevant ESI” and noting
the significant privacy and confidentiality concerns raised by the order.
� John B. v. Goetz, 2007 WL 3012808 (M.D.Tenn. Oct. 10, 2007). In this discovery dispute, the
court granted the plaintiffs’ motion to compel and ordered the defendants to provide complete
responses to the plaintiffs’ ESI requests, including all metadata and deleted information for any of
the defendants’ key custodians. Additionally, the court ordered the defendants to file certifications
regarding whether ESI was removed from any state computer or personal computer provided by
the state. Any managed care contractors (MCCs) were ordered to respond to ESI requests and if
production was found inadequate, the plaintiffs were allowed to renew their motion to compel
further production. Addressing the plaintiffs’ spoliation concerns, the court allowed the plaintiffs’
ESI expert to oversee the defendants’ production and inspect whether any changes were made to
the defendants’ computer(s). Finally, the court ordered the defendants to respond as to why they
should not be required to pay all production costs and attorney fees as provided in the order.
� Univ. of Pittsburgh v. Townsend, 2007 WL 1002317 (E.D. Tenn. Mar. 30, 2007). In a case where
the plaintiff alleged that the defendants misappropriated the plaintiff’s rights to medical scanning
technology, the defendants moved the court to sanction the plaintiff for spoliation of evidence by
excluding the testimony of the plaintiff’s proposed experts. The defendants alleged that the experts
and plaintiff’s counsel destroyed copies of e-mails and draft expert reports, to which they were
entitled. The experts stated that they did not retain e-mail from the plaintiff’s counsel because they
were instructed not to do so by the plaintiff’s counsel. The experts stated that they did not have the
prior draft expert reports because they only worked from one copy. The court rejected the
defendants’ argument and denied the request for sanctions. It ruled that although a draft an expert
report may be discoverable under the Federal Rules of Civil Procedure, an expert need not
preserve the drafts until the need to retain exists. Here, the experts and the plaintiff’s counsel were
not under an obligation to preserve the reports until the defendants subpoenaed records from the
experts. Since the draft reports were destroyed prior to the creation of any obligation to retain, the
court held that the destruction of the draft reports was “not done intentionally, fraudulently, and with
‘a desire to suppress the truth,’ and therefore, [was] not sanctionable.” However, the court did hold
that it was improper for the plaintiff’s counsel to have instructed or otherwise suggested to the
experts that all e-mails be destroyed, as they were the subject of multiple discovery requests. The
plaintiff’s counsel apologized for the error, and the court did not issue sanctions.
� Inventory Locator Serv., LLC v. Partsbase, Inc., 2005 WL 2179185 (W.D.Tenn. Sept. 6, 2005).
The plaintiff alleged the defendant unlawfully accessed the plaintiff’s computerized database, and
the defendant counterclaimed arguing similar conduct on the part of the plaintiff. In support of its
counterclaims, the defendant offered "Web server logs," purporting to record various unlawful
entries into the defendant’s computer system from an internet protocol ("IP") address assigned to
the plaintiff. The plaintiff sought, inter alia, to exclude the evidence, arguing the logs were
"incredible on their face," appeared to have been altered, had been moved and deleted, and were
inadmissible hearsay. As evidence that the logs were altered or fabricated, the plaintiff noted a
"cookie anomaly." When a user from a specific IP address logs onto the defendant’s Web site, a
“cookie” containing information such as the IP address from which the user was logging in, would
be created and recorded alongside the entry in the server logs. According to the plaintiff, none of
the cookies corresponded with the entries allegedly coming from its IP address. In response, the
defendant submitted the affidavit from a technology services company president who explained the
169