Electronic Discovery and Computer Forensics Case List - Kroll Ontrack

documents included an inaccurate billing statement and five letters pertaining to “future” meetings.
A computer forensics investigation of the defendant’s computer revealed that the letters were
actually created after the “future” meetings were set to occur. In addition, the billing statement was
created within an hour of the letters. The trial court held that this evidence was insufficient to show
that the defendant created the documents after he found out about the audit. On appeal, the
government argued that because that the defendant’s fellow director knew about the audit the day
before the defendant created the documents, a fact finder could reasonably infer that the defendant
created the backdated letters in response to the audit. Determining that the evidence supported the
government’s argument, the appellate court reversed the trial court’s decision and declared that a
reasonable person could conclude that the defendant was aware of the audit when he created the
backdated documents.
� People v. Dominguez, 2004 WL 1068809 (Cal. Ct. App. May 13, 2004). In a child pornography
prosecution case, the State examined the defendant’s computer for illegal material. The
prosecution’s computer forensic expert recovered 45 child pornography images, deleted from the
computer’s active memory, and 20 deleted “favorites folders,” which marked prior visits to child
pornography Web sites. The expert also testified that he discovered child pornography “cookie
files,” files designed to make return visits to a Web site faster. In response, the defendant noted,
inter alia, that, because the evidence was located in his computer’s inactive memory and could not
be recovered without the use of specialized computer programs, it was insufficient evidence to
support the conviction. In rejecting the defendant’s argument, the court declared that “[t]he fact that
the evidence of that possession was the result of a forensic examination of the inactive memory of
his computer is meaningless.” As such, the court determined that the evidence supported the
defendant’s conviction for possession of child pornography.
� In re Verisign, Inc. Sec. Litig., 2004 WL 2445243 (N.D. Cal. Mar. 10, 2004). In a class action
securities lawsuit, the plaintiffs sought to compel production of electronic documents in electronic
form. The magistrate judge granted the order, specifically stating that a tiff document production
was insufficient and ordered the defendants to produce the documents in a searchable electronic
format – such as a native .pst format – that included metadata. The defendants objected to the
magistrate’s order, arguing that production in native format rather than in tiff format was contrary to
Fed.R.Civ.P. 34. The district court judge rejected this argument and declared the Rules “required
[the defendants] to produce responsive electronic documents in their native .pst format if that is
how they were stored in Defendants’ usual course of business.”
� OpenTV v. Libertate Technologies, 219 F.R.D. 474 (N.D.Cal. 2003). The plaintiff requested that
the defendant produce copies of its source code for various products at issue in the litigation. The
defendant objected to the request, claiming that producing this data would be overly burdensome,
but offered to make the source code data available for review at its facilities. The plaintiff rejected
this offer, claiming that it inappropriately shifted the costs of production to the requesting party as
the code must be extracted at its expense. Relying on the analysis set forth in Zubulake cases, the
court found that the source code data was stored in an inaccessible format for purposes of
discovery. The court used the Zubulake seven factor balancing test to determine that the parties
should split the costs of extracting the data equally, with the defendant bearing the copying costs
once the data has been extracted.
� Dodge, Warren, & Peters Ins. Servs. v. Riley, 130 Cal. Rptr. 2d 385 (Cal. Ct. App. 2003). Prior to
termination of their employment, the defendants copied and took with them volumes of
computerized data maintained in the plaintiff’s files and storage media. The plaintiff sued the
defendants alleging claims of misappropriation of trade secrets, unfair business practices, breach
249