Electronic Discovery and Computer Forensics Case List - Kroll Ontrack

More documents

Recommendations

Info

computer usage policy. Before returning the laptops to her employer, the plaintiff deleted all personal files, including protected communications. Two years later, the employer’s computer forensic expert restored some deleted files and e-mails. The employer produced the recovered data to the plaintiff’s counsel, who claimed many of these documents were privileged. Agreeing with the magistrate that the plaintiff reasonably believed the documents and e-mails were confidential, the court noted, “Plaintiff’s laptops were not connected to [the employer’s] computer server and were not located in [the employer’s] offices; thus, [the employer] was not able to monitor Plaintiff’s activity on her home-based laptops or intercept her e-mails at any time.” � Treppel v. Biovail Corp., 233 F.R.D. 363 (S.D.N.Y. 2006). In a defamation action alleging the defendants engaged in a “smear campaign” and destroyed his career, the plaintiff moved to compel the defendants to: 1) preserve electronic and paper data, 2) answer questions about their electronic data management practices, and 3) produce all accessible and responsive data. Before filing the motion, the plaintiff’s counsel sent defense counsel a proposed e-discovery preservation order that included provisions for exchanging document retention policy information, identifying a deposition witness with computer system knowledge, and preserving all relevant electronic data. The proposed order also declared accessible data would be produced in its native format and inaccessible data would be identified but not immediately produced. Declining to agree to the order, defense counsel stated they would abide by their preservation obligations under the Federal Rules of Civil Procedure. They further argued the proposed order was onerous and it was inappropriate to consider production format in the absence of specific production requests. Although the court found a preservation order would be unduly burdensome and premature at that point in the litigation, the court ordered the defendants to answer the electronic data management questions as if they were interrogatories. The court also ordered the defendants to search for relevant data and provide the plaintiff with a detailed explanation of the search protocol. The court found native production was appropriate as the defendant failed to offer a substantive basis for its objection to native format. � Gilliam v. Addicts Rehab. Ctr. Fund, Inc., 2006 WL 228874 (S.D.N.Y. Jan. 26, 2006). In a class action lawsuit, the plaintiffs requested records relating to the defendants’ timekeeping, payroll, and policies and procedures. The defendants produced some timekeeping records but failed to produce the other requested information including data contained on 148 compact discs. The defendants claimed producing the compact discs would reveal private employee data and stated they would produce paper records containing the relevant information. Observing the paper production would comprise 46 boxes and approximately 36,000 pages, the court declared, “there seems little doubt that the time and cost expenditure could be disproportionate to the interests sought to be protected.” The court contrasted this with an electronic review whereby the “plaintiffs could make duplicates of the computer discs quickly and inexpensively. These discs could then be reviewed in a more efficient manner and the sensitive information skipped by the reviewer(s).” The court further assured confidentiality concerns would be covered in a confidentiality order. � Quinby v. WestLB AG, 2005 WL 3453908 (S.D.N.Y. Dec. 15, 2005). Objecting to a request for the production of e-mails, the defendant claimed the e-mails were stored on backup tapes and not readily available, making them too expensive to retrieve. In response, the court ordered the defendant to consider the guidelines set forth in Zubulake v. UBS Warburg LLC, to provide an affidavit addressing technical issues and a deposition witness who could discuss these issues, and to restore and put sample tapes into a searchable format. The defendant produced affidavits from its chief information officer and a Kroll Ontrack expert explaining that each tape would need to be “uncompressed” before it could be put into a searchable format. Further, the affidavits set forth the 58
cost and time considerations required to complete this work. The plaintiff argued the affidavits were “incomplete, misleading and contain ‘outright false statements’ because they improperly focused on back-up tapes and…[failed to address] the costs of searching and contents of the Database and archives that Kroll [Ontrack] maintains containing WestLB e-mails” from past e-discovery projects. Rejecting this argument, the court declared the defendant correctly focused on the backup tapes as “they were the most complete source for the e-mails.” In refusing to award sanctions, the court stated, “the fact that defendant is producing e-mails from the most complete, but most expensive, source is compelling evidence of defendant’s honesty and good faith.” See also Quinby v. WestLB AG, 2006 WL 59521 (S.D.N.Y. Jan. 11, 2006)(order granting motion to quash two subpoenas seeking “all e-mails sent to or received by plaintiff’s personal e-mail account during the period from October 2002 throughout July 2004, other than e-mails between plaintiff and her current and former counsel.”) � In re Natural Gas Commodity Litigation, 2005 WL 3036505 (S.D.N.Y. Nov. 14, 2005) decision set aside in part by 235 F.R.D. 241 (S.D.N.Y. Apr 18, 2006). In a lawsuit relating to natural gas price fixing, the plaintiffs sought to compel production of published trade data from two non-parties. The non-parties objected arguing, inter alia, that producing the information would be unduly burdensome. The court found the subpoena was not unduly burdensome with respect to one of the non-parties, and noted the non-party had already produced redacted and un-redacted electronic versions of requested spreadsheets to the government in connection with a criminal matter. The court stated, “While those spreadsheets themselves will not satisfy plaintiffs’ subpoenas here, they do show the [non-party] can produce this information in electronic format and still redact information about companies other than the target sources. . . .” The court also pointed out that the non-party had an outside document management firm overseeing the production and that the plaintiff agreed to pay for associated costs. The other non-party claimed some of the historical data sought was located on “old” and “antiquated individual computers.” In addressing this issue, the court required the parties to use a sampling protocol, “perhaps searching one of the ‘old’ computers, with leave to re-visit the burden vs. utility question based on information from that process.” � Tilberg v. Next Mgmt. Co., 2005 WL 2759860 (S.D.N.Y. Oct. 24, 2005). During discovery, the court ordered the defendants to give the plaintiff’s computer forensic expert access to two e-mail servers and ordered the parties to split costs. However, when the forensic expert began his examination, he was unable to access the defendants’ second server. The defendants claimed this was the result of a system crash. After the discovery deadline passed, the plaintiff again sought access to the second server as well as permission to search the defendants’ central non-e-mail server and two specific employees’ desktop computers. The defendants submitted an affidavit from its information technology personnel indicating the computer system did not contain relevant documents. However, the plaintiff’s expert “found 187 occurrences of the word ‘Tilberg’ in ‘active space,’ which could have been found with standard search tools, and 97 occurrences of ‘Tilberg’ in deleted files.” The plaintiff declared the defendants should have produced these files without the need for a forensic search. Additionally, the plaintiff presented documents obtained from third parties that further proved relevant documents existed despite the defendant’s contrary claims. Finding the defendants “either inadvertently or deliberately delayed and obstructed discovery in this case,” the court ordered the defendants to provide the expert with access to the second e-mail server, the central server, and the two desktop computers. See also Tilberg v. Next Mgmt Co., 2005 WL 3543701 (S.D.N.Y. Dec. 28, 2005)(addressing the issue of privileged e-mails uncovered in the search). 59
Page 1 and 2:
Electronic Discovery and Computer F
Page 3 and 4:
Florida ...........................
Page 5 and 6:
protocol. The search protocol allow
Page 7 and 8: Finally, the court expressed disple
Page 9 and 10: should rely on IT professionals to
Page 11 and 12: to compel, the plaintiff sought pro
Page 13 and 14: had been withheld, and if e-mails w
Page 15 and 16: the defendants continued to destroy
Page 17 and 18: ordering recovery and production of
Page 19 and 20: evidence supporting this contention
Page 21 and 22: ehavior as a direct contradiction o
Page 23 and 24: the effort required to conduct a pr
Page 25 and 26: defendant’s motion to dismiss was
Page 27 and 28: under Rule 803(6) of the Federal Ru
Page 29 and 30: pay judgment in favor of the plaint
Page 31 and 32: equally all costs associated with h
Page 33 and 34: subpoena would not “prejudice the
Page 35 and 36: stopped the automatic deletion of e
Page 37 and 38: far produced refuted an inference o
Page 39 and 40: commentary that “privacy is no lo
Page 41 and 42: documents since resorting to the Ha
Page 43 and 44: � Arista Records LLC v. Usenet.co
Page 45 and 46: expense of production. The court he
Page 47 and 48: substantive. Rejecting the SEC’s
Page 49 and 50: claimed these requests raised user
Page 51 and 52: efused to issue adverse jury instru
Page 53 and 54: evidence would have been favorable
Page 55 and 56: failed to issue a proper litigation
Page 57: tapes were meant only for disaster
Page 61 and 62: defendant’s investment officer wa
Page 63 and 64: Aug. 22, 2003). Stating the order w
Page 65 and 66: which the court issued severe sanct
Page 67 and 68: ordered a computer forensics examin
Page 69 and 70: evidence, and/or failed to make rea
Page 71 and 72: information from its computer netwo
Page 73 and 74: production was incomplete, and move
Page 75 and 76: falsely claimed to have been raped
Page 77 and 78: � State v. Voorheis, 2004 WL 2581
Page 79 and 80: sanctions were disproportionate and
Page 81 and 82: the defendants were responsible for
Page 83 and 84: was not equitable to force the defe
Page 85 and 86: choose not to heed the court’s or
Page 87 and 88: magistrate judge improperly minimiz
Page 89 and 90: appropriate. The court refused to m
Page 91 and 92: plaintiffs waived any privilege cla
Page 93 and 94: defendants failed to preserve and d
Page 95 and 96: portions of the plaintiff’s Faceb
Page 97 and 98: court denied sanctions, but issued
Page 99 and 100: equire the non-party to allow the p
Page 101 and 102: server. The court also granted the
Page 103 and 104: preserve the computer’s memory .
Page 105 and 106: � Itzenson v. Hartford Life and A
Page 107 and 108: � Eckhardt v. Bank of America, 20
Page 109 and 110:
� Bank of Amer. Corp. v. SR Int
Page 111 and 112:
� Morris v. Metals USA, 2011 WL 9
Page 113 and 114:
did not address the employer’s ab
Page 115 and 116:
� Mezu v. Morgan State Univ., 201
Page 117 and 118:
any such information was irrelevant
Page 119 and 120:
plaintiff’s motion for sanctions
Page 121 and 122:
at Dulles airport, the defendants f
Page 123 and 124:
documents in a manner that was resp
Page 125 and 126:
“destroyed some documents because
Page 127 and 128:
“would be even more reliable than
Page 129 and 130:
defendant’s withholding of respon
Page 131 and 132:
when it was reasonably anticipated.
Page 133 and 134:
Mississippi � PIC Grp., Inc. v. L
Page 135 and 136:
he allegedly sent to the victim. Th
Page 137 and 138:
absent a motion to compel. The cour
Page 139 and 140:
disclosure of the hard drive to the
Page 141 and 142:
to all payment histories of account
Page 143 and 144:
aware that a party in litigation mu
Page 145 and 146:
not clear enough to warrant enforce
Page 147 and 148:
ecause the computer expert testifie
Page 149 and 150:
database contained proprietary info
Page 151 and 152:
should have provided the substance
Page 153 and 154:
protective relief (including cost s
Page 155 and 156:
drive from a vital computer in the
Page 157 and 158:
preserve ‘every shred of paper, e
Page 159 and 160:
defendant plainly manifested an exp
Page 161 and 162:
argued that it previously produced
Page 163 and 164:
� United States v. Premera Blue C
Page 165 and 166:
overwritten] well before th[is] law
Page 167 and 168:
documents for use in her wrongful d
Page 169 and 170:
devices that contain relevant elect
Page 171 and 172:
asserting that the Federal Rules of
Page 173 and 174:
excuse” for the obvious discovery
Page 175 and 176:
defendants were not entitled to rec
Page 177 and 178:
� Whitlow v. Martin, 2009 WL 3338
Page 179 and 180:
documents belonging to the plaintif
Page 181 and 182:
the filing of the claim, its failur
Page 183 and 184:
confidential customer lists, quotat
Page 185 and 186:
defendants at a cost of more than $
Page 187 and 188:
expert. The court also held that an
Page 189 and 190:
electronic discovery of the defenda
Page 191 and 192:
within the plaintiff’s control an
Page 193 and 194:
� Perfect Barrier LLC v. Woodsmar
Page 195 and 196:
citing the defendants’ considerab
Page 197 and 198:
� Kasten v. Doral Dental USA, LLC
Page 199 and 200:
destruction of evidence indicating
Page 201 and 202:
incident, her attorney’s letter c
Page 203 and 204:
question to this court to determine
Page 205 and 206:
� State v. Levie, 695 N.W.2d 619
Page 207 and 208:
instruction because the plaintiff i
Page 209 and 210:
plaintiffs’ alleged failure to me
Page 211 and 212:
including those from their homes. A
Page 213 and 214:
litigation was pending, he had not
Page 215 and 216:
the illegal images onto his compute
Page 217 and 218:
portions of the e-mail were not pro
Page 219 and 220:
the resources to oppose the subpoen
Page 221 and 222:
drive in temporary internet file fo
Page 223 and 224:
"wireless sniffers" to intercept ap
Page 225 and 226:
communications sent over her work c
Page 227 and 228:
court also determined the attorneys
Page 229 and 230:
� Keithley v. Homestore.com, Inc.
Page 231 and 232:
destroyed relevant electronic docum
Page 233 and 234:
personal sanctions due to an absenc
Page 235 and 236:
Qualcomm, Inc. v. Broadcom Corp., 2
Page 237 and 238:
liable for the destruction of the h
Page 239 and 240:
investigation where the defendant r
Page 241 and 242:
motion was denied by the trial cour
Page 243 and 244:
documents with titles indicating th
Page 245 and 246:
defendants had received requests to
Page 247 and 248:
the backup tape data and to bear pr
Page 249 and 250:
documents included an inaccurate bi
Page 251 and 252:
� Playboy Enters., Inc. v. Welles
Page 253 and 254:
� Peschel v. City of Missoula, 20
Page 255 and 256:
spoliation. Through forensic analys
Page 257 and 258:
Phoenix and determined that an elec
Page 259 and 260:
the defendant was in possession, cu
Page 261 and 262:
Nevertheless, the defendants believ
Page 263 and 264:
one violation of the second order,
Page 265 and 266:
delays and financial harm. In suppo
Page 267 and 268:
plaintiff produced a mere ten e-mai
Page 269 and 270:
defendant’s employees continuousl
Page 271 and 272:
the e-mails and attachments to be r
Page 273 and 274:
elating to any ex parte communicati
Page 275 and 276:
“unadulterated fishing expedition
Page 277 and 278:
e-mails establishing the documents
Page 279 and 280:
metadata, the parties agree that th
Page 281 and 282:
expense in restoring and searching
Page 283 and 284:
and create a more organized and und
Page 285 and 286:
� Phillip M. Adams & Assoc., LLC
Page 287 and 288:
� ClearOne Communications, Inc. v
Page 289 and 290:
� Wright v. AmSouth Bancorp, 320
Page 291 and 292:
metadata or searchable text. Follow
Page 293 and 294:
� In re Fontainebleau Las Vegas C
Page 295 and 296:
nature of the destroyed evidence, i
Page 297 and 298:
appropriate because the plaintiffs
Page 299 and 300:
The award stemmed from the court’
Page 301 and 302:
were also overwritten per departmen
Page 303 and 304:
order, the teacher declared the pro
Page 305 and 306:
investigation of the plaintiff’s
Page 307 and 308:
Regarding the defendants’ relevan
Page 309 and 310:
� ABC Home Health Servs. v. IBM C
Page 311 and 312:
document preservation order. The re
Page 313:
search,” the court ordered the De
show all

Electronic Discovery and Computer Forensics Case List - Kroll Ontrack

Create successful ePaper yourself

Delete template?

Save as template?