Electronic Discovery and Computer Forensics Case List - Kroll Ontrack
Electronic Discovery and Computer Forensics Case List - Kroll Ontrack
Electronic Discovery and Computer Forensics Case List - Kroll Ontrack
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
against the defendant as a sanction for the state’s discovery violations. Pursuant to a court order,<br />
the defendant had requested a “forensically sound” image copy of his computer hard drive, which<br />
had been turned over to the state by someone other than the defendant. When the state failed to<br />
comply with this <strong>and</strong> other discovery requests, the defendant moved to suppress any evidence<br />
derived from the computer <strong>and</strong> to have the charges dismissed. Refusing to award sanctions at that<br />
time, the district court granted the state more time to produce the disclosures. However, the state<br />
still had not produced the requests or allowed the defendant to access the computer even after<br />
several months had passed. As a result, the trial court granted the defendant’s motions for<br />
suppression <strong>and</strong> dismissal. On appeal, the state argued that it did not want to lose the forensic<br />
value of the computer by giving access to the defendant since that would violate laws prohibiting<br />
dissemination of child pornography. Affirming the trial court’s decision, the appellate court noted,<br />
“[a]lthough dismissal is an extreme sanction, ‘[t]he values sought to be achieved through reciprocal<br />
discovery will be attained only if the rules are properly observed, <strong>and</strong> to this end the trial courts<br />
must have the ability to make those obligations meaningful’.”<br />
� In re Pemstar, Inc. Secs. Litig., Civ. No. 02-1821 (DFW/SRN) (D. Minn. Apr. 23, 2004). In a<br />
securities fraud class action lawsuit, the plaintiffs filed a motion to compel production of<br />
spreadsheets, electronic documents <strong>and</strong> databases in native format. In support of its argument, the<br />
plaintiffs declared that the “usual course of business” requirement set forth in Fed. R. Civ. P. 34<br />
should be interpreted as requiring production of the data in native format. The defendants claimed<br />
that the production format should be either paper, TIFF or PDF <strong>and</strong> argued that Fed. R. Civ. P. 34<br />
does not require native production <strong>and</strong> TIFF production would adequately address any of the<br />
plaintiffs’ concerns about retaining metadata <strong>and</strong> file structure. The court ordered the defendants to<br />
produce a sub-set of documents in native format, stating that “production of electronic discovery in<br />
native format is appropriate, feasible, <strong>and</strong> important under the circumstances of this case.” The<br />
court further noted that in this case the substantive allegations were based upon an employee’s<br />
native Lotus Notes file, making it “most useful to the fact finder to view, underst<strong>and</strong>, <strong>and</strong> step into<br />
the shoes of the information source that actually provided the alleged knowledge <strong>and</strong> access.”<br />
� Anderson v. Crossroads Capital Partners, L.L.C., 2004 WL 256512 (D.Minn. Feb. 10, 2004). In<br />
a sexual harassment <strong>and</strong> whistleblower lawsuit, the defendants sought to recover the hard drive of<br />
the plaintiff’s personal computer because it allegedly contained an October 2001 document<br />
outlining the harassment. After a protracted discovery battle, the defendants sought a Motion to<br />
Compel <strong>and</strong> the judge ordered the plaintiff to furnish the defendant with a "copy of all<br />
documents/files relevant to this litigation that exist on Ms. Anderson’s personal computer as well as<br />
those that have been deleted or otherwise adulterated." Pursuant to the judge’s Order, the<br />
defendants’ computer forensic expert examined the plaintiff’s hard drive <strong>and</strong> discovered that a data<br />
wiping software application had been installed after the plaintiff had agreed not to “delete any<br />
existing documents” in a deposition. The computer forensic expert also found that the hard drive<br />
installed in the machine was manufactured in August 2002. The plaintiff claimed that she did not<br />
use the software program to destroy evidence, but that she used it routinely to protect her<br />
computer files. She also stated that in her view she owned the same computer throughout the<br />
litigation despite changing the hard drive in 2002. The defendants then moved to dismiss the<br />
complaint due to the plaintiff’s alleged discovery violations <strong>and</strong> destruction of evidence. The court<br />
noted that the plaintiff’s “exceedingly tedious <strong>and</strong> disingenuous claim of naiveté! regarding her<br />
failure to produce the requested discovery…defies the bounds of reason” but was not sufficiently<br />
egregious to warrant dismissal of the case. Instead, the court issued an adverse inference jury<br />
206