Summary
allowing an independent expert to obtain and search a mirror image of defendants' computers after court had "cause to question whether defendants have produced all responsive documents"
Summary of this case from Delta T, LLC v. WilliamsOpinion
No. 4:06CV524-DJS.
February 23, 2007
MEMORANDUM AND ORDER
Now before the Court is the parties' joint motion to clarify the Court's December 27, 2006, Memorandum and Order. The Court's Order required defendants to allow a computer forensics expert ("the Expert"), selected by plaintiff, to obtain and search mirror images of defendants' computer equipment. The Court prescribed a three-step protocol for the "imaging, recovery and disclosure" of the information on the computer equipment. In the instant motion, the parties recommend several clarifications to the Court's Order and request the Court to decide a remaining disputed issue.
The parties seek approval to implement a search term protocol in the recovery step, whereby the following steps are performed: (1) the parties would initially meet and confer to identify the nature and scope of the search (e.g., the parties would agree upon certain search parameters, such as the types of files to be searched, as well as the appropriate words, phrases, date ranges, and people — senders, receivers, and/or authors — to guide the search); (2) upon agreement regarding the search criteria and parameters, the Expert would run those searches; (3) the Expert would then generate a report for the parties identifying the number of "hits" generated by each search (identifying the volume of files that were "hits" on each of the search terms); and (4) as necessary, the parties would continue to meet and confer to refine the Expert's searches to reduce the number of false positives generated by the searches. Upon completion of the searches, the content of the files that are "hits" on any search term should be provided by the Expert to defense counsel, who will then perform the remainder of the recovery and disclosure steps.
Plaintiff further requests that it be provided the information regarding the "hits" generated by the searches. As discussed in the Court's Memorandum and Order of December 27, 2006, plaintiff can submit discovery requests for any discoverable information recovered by the Expert, including the list of "hits." The Court will approve the parties' search protocol as discussed above, but will deny plaintiff's request for the list of "hits" generated by the searches.
As agreed to by the parties, the Court will also order the Expert to provide the parties with information concerning defendants' usage of their computer equipment. More specifically, plaintiff seeks information concerning the following matters: (1) whether programs, such as erasure software or "defragmentation" software, were installed and run on the computers, and, if so, when the software was installed; (2) whether defendants utilized any detachable, portable storage media with their computers (e.g., a detachable "zip" drive or "flash" drive), and, if so, what the names of the files that were accessed or downloaded using such a device are; (3) whether any defendant engaged in mass deletions of files from his or its computer, and, if so, when the deletions occurred; and (4) whether there are large gaps in the contents of the files on any of the hard drives (e.g., whether any of the hard drives devoid of files were created prior to the date suit was filed). As the parties make this request jointly, the Court will order the Expert to provide the requested usage information to the parties.
Accordingly,
IT IS HEREBY ORDERED that the parties' joint motion to clarify the Court's December 27, 2006, Memorandum and Order [Doc. #62] is granted as follows.
IT IS FURTHER ORDERED that the Court's December 27, 2006, Memorandum and Order [Doc. #52] is hereby amended to the extent that it is inconsistent with the instant Memorandum and Order.
IT IS FURTHER ORDERED that the parties and the Expert shall implement the search term protocol discussed in the above Memorandum as part of the recovery stage of the Court's three-step "imaging, recovery, and disclosure" procedure discussed in the Court's December 27, 2006, Memorandum and Order [Doc. #52].
IT IS FURTHER ORDERED that plaintiff's request that it be provided with the information regarding the "hits" generated by the searches is denied.
IT IS FURTHER ORDERED that, as part of the recovery step, the Expert shall provide the parties with the information concerning defendants' usage of their computer equipment as discussed in the above Memorandum.