Electronic Discovery and Computer Forensics Case List - Kroll Ontrack

including those from their homes. A disclosure process, including provisions regarding production
of documents and privilege issues, was also ordered.
� In re Celexa and Lexapro Prods. Liab. Litig., 2006 WL 3497757 (E.D. Mo. Nov. 13, 2006). In this
multi-district litigation regarding two prescription drugs, the parties agreed to a document
management plan which the court incorporated into its order. The parties established that the
plaintiffs would preserve the hard drives of computers used by the plaintiffs and the plaintiffs’
decedents, and such hard drives would be imaged and analyzed pursuant to an agreed forensic
examination protocol. The parties also decided the defendants would not be required to restore any
of their backup tapes at this time, and instead, responsive electronically stored information would
be collected from the defendants’ active IT environment. They must preserve the thirty-five backup
tapes set aside for this litigation, but may otherwise resume backup tape recycling. The plaintiffs
deferred the production format decision to the defendants and allowed them to produce data in any
format that is generally searchable and manageable. The parties were unable to agree on how
costs should be apportioned, the scope of discovery into electronic databases, and who should
perform the forensic examination of the computer hard drives. The court determined it would
decide these issues after more briefing by the parties.
� State v. Tripp, 168 S.W.3d 667 (Mo. Ct. App. 2005). The defendant appealed a murder, rape and
kidnapping conviction, arguing the trial court erred in admitting evidence regarding the contents of
his laptop. The defendant alleged, inter alia, the testimony was legally irrelevant and that its
prejudicial effect outweighed any probative value it might have had. At trial, the State’s computer
forensic expert testified that a significant amount of unallocated space remained on the hard drive
and that the space was filled with zeros. The expert also uncovered a reference to “wipinfo.exe” in
the computer’s swap file on the hard drive. Based on these factors, the expert concluded that a
wiping utility was used on the computer and that 160 files had been accessed, modified or deleted
the day the victim disappeared. The defendant’s computer expert argued it was impossible to
distinguish between a hard drive on which a wiping utility had been used and a hard drive on which
the unallocated space was in the same condition as it was when the manufacturer delivered it. On
appeal, the court noted the “State’s position would be stronger if there had been any testimony or
other evidence that suggested that the laptop ever had anything on it that would connect [the
defendant] with the offenses for which he was being tried.” Despite this, the court affirmed the trial
court’s judgment, stating that admission of the testimony and evidence did not constitute plain error
as the state only made a passing reference to the free space on the computer and the evidence of
a wiping utility.
Nebraska
� Union Pac. R.R. Co. v. United States Envtl. Prot. Agency, 2010 WL 2560455 (D.Neb. June 24,
2010). In this environmental contamination dispute, the plaintiff sought a temporary restraining
order and preliminary injunction against the Environmental Protection Agency (EPA). Seeking to
evaluate the merits of the EPA’s lead contamination claim, the plaintiff requested information
pursuant to the Freedom of Information Act (FOIA). Based on information contained in e-mails
gathered from the initial disclosure, the plaintiff argued that an EPA supervisor ordered employees
to destroy information responsive to the plaintiff’s FOIA requests and "relevant in future
enforcement actions." Granting the temporary restraining order to prevent further destruction of
evidence, the court ordered the defendant to produce all relevant data and designate "an individual
211