Use this link to access the full blog

http://shrinkster.com/12gg

Sent to you by pakurilecz via Google Reader: Court Orders Forensic
Examination of Defendants' Business and Home Computers, Articulating
20-Step Protocol via Electronic Discovery Law by
[log in to unmask] (K&L Gates) on 10/14/08
Koosharem Corp. v. Spec Personnel, LLC, 2008 WL 4458864 (D.S.C. Sept.
29, 2008)

In this breach of contract case, plaintiffs alleged that defendants
wrongfully obtained and used confidential information from former
employee, Kenneth Fuston, who went to work for the defendants.
Specifically, plaintiffs alleged that defendants used the information
to hire approximately 20 of plaintiffs’ employees, open new offices in
eight cities, and embark upon a new line of business in competition
with plaintiffs. Plaintiffs moved to compel production of computers
believed to contain information related to those claims. The court had
previously granted a motion to compel and ordered defendants to produce
emails to or from any current or former employee or customer of the
plaintiff found on Fuston’s home computer and documents reflecting
communication with the defendant and certain former employees of the
plaintiff. Defendants produced 1,936 pages of email. Believing the
production was incomplete, plaintiffs brought a second motion to compel.

Plaintiffs noted several problems with defendants’ original production.
Notably, all of the emails produced reflected the date compiled rather
than the date received or sent, several emails allegedly retrieved from
Trevor Doyle did not have Doyle listed as a sender or recipient, and
many emails were missing their attachments. These irregularities,
plaintiffs argued, called the authenticity of the documents into
question. Plaintiffs also argued that documents were modified even
after notice of litigation and that defendants made no document
retention efforts after the lawsuit was filed. Specifically in support
of production of home computers, plaintiffs argued that defendants’ new
hires were not immediately provided with a company email account and
thus conducted work from home computers and personal email accounts.
Also, according to the plaintiffs, former employees emailed
confidential information to their homes before going to work for
defendants.

The court rejected defendants’ argument that the inspection be denied
based upon relevance objections to the underlying requests. Relying
upon the prior order compelling production, the court stated that the
only issue before it was whether forensic analysis should be allowed in
light of defendants’ failure to produce documents and because of
relevant information stored on the computers. Finding that forensic
analysis was appropriate, the court issued a lengthy and detailed
protocol for the forensic examination:
(1) Defendants will make available for forensic analysis and data
recovery to be conducted by an expert forensics firm (“Expert”) any
business computers and/or any personal computers used to conduct
business, correspond in any way regarding business, Spec and/or its
current or employees, and/or plaintiffs and/or their current or former
employees, for Steve Arnold, Walter Chudowsky, Benita Dillard, Trevor
Doyle, Ken Fuston, Kevin Moore, Steve Roberson, and Jude Tallman.
(2) The time frame for the forensic analysis and data recovery will
encompass the period September 1, 2007, to present.
(3) The parties will jointly agree within five (5) calendar days after
entry of this order on an Expert that will be used to conduct the data
recovery and forensic analysis.
(4) Defendants will produce to the Expert within ten (10) calendar days
after entry of this order the computers identified in paragraph 1.
(5) The Expert will recover only the documents and email account or
accounts used by individuals identified in paragraph 1 (or those
accounts and documents accessed remotely using another computer).
(6) The Expert also will conduct a search or run other appropriate
programs to determine whether any emails or documents have been
deleted, destroyed, altered, or otherwise compromised since January 25,
2008, and whether any programs have been installed that would alter,
destroy, erase, modify, or otherwise compromise any portion of each
computer or its contents as of January 25, 2008. The Expert also will
be permitted to conduct such search efforts as are necessary to form an
opinion as to whether any procedures were put into place to preserve
emails and documents as of January 25, 2008.
(7) The recovery of emails will include all emails in any form
whatsoever including, but not limited to, deleted emails, forwarded
emails, copied (“cc”) and blind-copied (“bcc”) emails and draft emails.
The recovery of documents will include all documents including drafts,
multiple versions, and final versions.
(8) The Expert will securely maintain the original data recovered in
order to establish a chain of custody.
(9) The Expert will produce a copy of the recovered data to defendants'
local counsel of record attorney John Glancy (“defendants' counsel”).
(10) Defendants' counsel will review the data to identify any
privileged or personal emails that it seeks to withhold from document
production.
(11) Within ten (10) business days of obtaining the recovered data from
the Expert, defendants' counsel will prepare and provide to counsel for
plaintiffs: (I) a log of privileged emails (“Privileged Email Log”)
protected against disclosure by a relevant legal privilege and include
the identity of the email, the sender and recipient (and any
individuals identified in the “cc” and “bcc” fields), the date sent,
the nature of the privilege, a general description of the email and the
basis for asserting the privilege; and (ii) a log of personal emails
(“Personal Email Log”) and include the identity of the email, the
sender and recipient (and any individuals identified in the “cc” and
“bcc” fields), the date sent, a general description of the email and
the basis for claiming it is a personal email. To the extent that
defendants' counsel asserts privilege as to any documents obtained from
the forensic analysis, such documents also must be set forth on a
document privilege log (“Privileged Document Log”) and be produced
within ten (10) business days of obtaining the recovered data.

(12) Together with the Privileged Email Log, Personal Email Log, and
Privileged Document Log, defendants shall produce (within 10 business
days after obtaining the recovered data from the Expert) all emails and
documents recovered by the Expert, which are not identified on the Logs.
(13) For purposes of the procedure described herein, a personal email
is one that does not relate to or in any way concern: defendants'
employment, whether it deals with past, present, future or prospective
employment; plaintiffs' business; plaintiffs' customers and former
customers (including contacts at customers and former customers);
plaintiffs' employees and former employees; defendants' drivers or
plaintiffs' former drivers; plaintiffs and any of its employees; or
Spec Personnel and any of its employees, including but not limited to,
communications regarding Spec's closing of offices staffed by
plaintiffs' former employees or efforts to have anyone take over,
purchase or otherwise assume responsibility for any Spec office staffed
by plaintiffs' former employees.
(14) If any document attachment to an email is identified through the
discovery of an email, and such document was opened, saved from,
detached or otherwise transferred or reproduced on the hard-drive of
defendants' computers, such attachment shall be produced or the Expert
shall be given access to defendants' computer to conduct further data
recovery in order to obtain such document(s).
(15) If any document is identified by the Expert as being opened,
saved, altered, transferred or reproduced and it falls within the scope
of the request, such document must be produced by the Expert and
handled by defendants' counsel in the same manner as though it was an
email communication.
(16) If plaintiffs disagree with the assertion of any privileges, the
parties shall submit to the court the disputed documents and Logs for
the court to view in camera and determine whether the documents must be
produced.
(17) Defendants are responsible for any and all fees, costs and
expenses associated with gathering the computers and transmitting them
to the Expert.
(18) At this time, the parties will share equally the fees, costs and
expenses charged by the Expert. When the Expert is retained, the Expert
will be jointly informed that any billing or retainer must be split
evenly between the parties. If any retainer is required, the parties
are obligated to provide the retainer within three (3) business days of
the Expert's request so that the process is not delayed in any way.
Neither party waives its right to seek reimbursement or payment of any
fees, costs and expenses charged by the Expert if it is determined that
award of such is appropriate pursuant to the Federal Rules of Civil
Procedure, Local Rules or case law.
(19) By agreeing to this order, no party waives its rights or
objections to the discovery sought herein.
(20) The parties understand and agree that this order addresses the
preliminary scope for the computer production and forensic analysis. If
the initial production and analysis determines that additional searches
are necessary, either party may petition the court to revisit the scope
of this order.

A copy of the full decision is available here.


Things you can do from here:
- Subscribe to Electronic Discovery Law using Google Reader
- Get started using Google Reader to easily keep up with all your
favorite sites