e-Discovery and Computer Forensics Docket Sheet

The defendant sought a preservation order requiring the plaintiff to preserve documents and other items, including electronic documents. The plaintiff, in responding to the defendant's motion, countered with a preservation order request of its own, requiring the defendant to preserve and produce documents. In addressing the need for these orders, the court focused on the medium in which the evidence was stored. The court stated that “[if] the evidence is stored upon a computer floppy disk or hard drive, finding physical space to store the evidence will not be as much of an issue … [but] evidence stored within a computer hard drive may present a difficulty in that it may be compromised or degraded as new information is added and pieces of old information are 'deleted' and subsequently written over by the computer.” In discussing when an order would be appropriate, the court declared that timing is of the essence, particularly in cases where a party does not know that electronic evidence must be preserved. The court denied both preservation order requests, determining that there was insufficient proof showing that evidence would be lost or destroyed absent these orders. Capricorn Power Co. v. Siemens Westinghouse Power Corp., 2004 WL 870659 (W.D.Pa. Apr. 21, 2004).

Alleging that the government mismanaged trust funds, the plaintiff moved for a confidentiality agreement and protective order. Determining that good cause existed for approval and entry of the order, the court issued specific procedures for the production of electronic records. In defining records that needed to be produced, the court included computer or network activity logs, data, databases, images, e-mails, spreadsheets and metadata. The court also determined that if the parties provided access to electronic data rather than making actual copies of it, the parties should designate which electronic records are available for production by categorizing them in writing by record, category, search parameters or other reasonable methods. In addressing production format, the court directed the parties to produce records “in the format in which that party routinely uses or stores them, provided that electronic records shall be produced along with available technical information necessary for access or use.” The court indicated that if the requesting party is unable to access or use an electronic record, then the requester may ask that the responding party provide a paper version of or underlying source data for the electronic record. Jicarilla Apache Nation v. United States, 2004 WL 842264 (Fed. Cir. Apr. 19, 2004).

The plaintiff, who alleged that the government mismanaged Indian tribe trust funds and other properties, moved for a document preservation order. The requested order would require the government to index electronic documents and would allow the plaintiff limited inspection of the documents. The government contended that the proposed order was unnecessary and overly burdensome, in part because document-retention policies were already in place at the government agencies likely to be implicated in the suit. The court held that the plaintiff was required to demonstrate “that absent a court order, there is significant risk that relevant evidence will be lost or destroyed.” Additionally, the plaintiff “must show that the particular steps to be adopted will be effective, but not overbroad.” The plaintiff was able to produce evidence that the government had lost and destroyed documents in the past, including electronic records containing potentially relevant information. Based on this evidence, the court ordered the government to preserve all documents, including electronic information, e-mail, and metadata that contained relevant information or that might lead to the discovery of relevant information. The court also required the government to index all the documents and to report any documents that were destroyed. The court indicated that the possibility of sanctions “which the case law suggests may be severe … provides the incentive … needed to effectuate this preservation plan.” The Pueblo of Laguna v. United States, 60 Fed. Cl. 133 (Fed. Cl. 2004).

In a patent-infringement suit, the plaintiffs moved for production of documents relating to the development of the products in question. When the plaintiffs uncovered that the defendant had been deleting all of its e-mails every 30 days since the initiation of the suit, the court entered a protective order requiring the defendant to make a full and complete effort to recover any and all deleted electronic documents, including e-mail. The order also stated that the plaintiffs could petition for the appointment of a computer-forensics expert to assist in recovering electronic data, and that the plaintiffs could request that the defendant pay for the expert. Responding to the order, the defendant produced 45 pages of documents and an expert's report that described the defendant's efforts to recover the deleted e-mails. Although the plaintiffs found these submissions unacceptable, they did not file a petition seeking appointment of a neutral computer-forensics expert. In denying the motion, the court declared that the plaintiffs, as was their right pursuant to the protective order, should have filed a petition seeking the appointment of a computer-forensics expert. The court also held that awarding sanctions would be unjust, because plaintiffs waited more than 7 months before filing the discovery motion. Aero Prods. Int'l v. Intex Rec. Corp., 2004 WL 417193 (N.D. Ill. Jan. 30, 2004).

In a copyright-infringement suit, the court issued an order compelling the defendant to produce computer servers that hosted the plaintiffs' Web site and contained user records. When the plaintiffs' computer expert inspected the servers, he discovered that the vast majority of that information had been intentionally destroyed after the defendant learned litigation was imminent. The expert found that the defendant ran a program, designed to erase electronically stored information, more than 50 times from a remote location in an attempt to delete all electronic data from the servers. Despite the defendant's attempts, the expert recovered a small amount of data to support the plaintiffs' claims. Although the defendant attempted to attack the plaintiffs' methodologies for extrapolating the number of users and downloads, the court indicated that the defendant was “in a poor position to attack plaintiffs' evidence,” noting that “[d]estruction of evidence raises the presumption that disclosure of the materials would be damaging.” The court decided not to issue sanctions but instead encouraged the plaintiffs to move for appropriate sanctions as the case progressed. Arista Records, Inc. v. Sakfield Holding Co. S.L., 2004 WL 881851 (D.D.C. Apr. 22, 2004).

In a case involving the violation of a state trade-secrets act, an employer alleged that a former employee copied proprietary electronic documents from his work laptop to a compact disc (CD), shortly before he went to work for a competitor. The employee stated that, for the sake of simplicity and because he did not know how to save individual files onto a CD, he had transferred his entire “My Documents” folder, which contained personal files such as his wedding photographs, and inadvertently captured some of his former employer's confidential business documents. The employer's computer-forensics expert refuted the employee's claims, testifying that a file, which was not contained in the “My Documents” folder, was also copied to the CD. The expert also determined that the employee had attempted to hide the document transfer by deleting information about the downloads from the laptop. Based on this evidence, the appellate court affirmed the lower court's ruling that the evidence supported a finding of trade secret misappropriation. LeJeune v. Coin Acceptors, Inc., 2004 WL 1067795 (Md. May 13, 2004).

The defendant, an Internet lottery game operator, moved for summary judgment on a breach-of-contract claim filed by a lottery player. Contending that a genuine issue of material fact existed, the plaintiff argued that there was a dispute about the creation, transmission and receipt of two notification e-mails the defendant sent her on the same day. In support of her argument, the plaintiff submitted affidavits and documents that attempted to show a conflicting record regarding the date- and time-stamping procedures for the e-mails. The plaintiff contended that the e-mail record revealed the defendant conspired to defraud her of her winnings after a computer generated “winning” numbers that matched her selections. The defendant contended that the first notification e-mail the plaintiff received had no relation to the official winning numbers because the e-mail time stamp showed that it had been sent several hours before the defendant selected the winning lottery numbers. In granting summary judgment for the defendant, the court noted that even if it were “correct that all email received by her bears the date and time it is received by her email account … that fact would undermine her case rather than support it.” Ermolaou v. Flipside, Inc., 2004 WL 503758 (S.D.N.Y. Mar. 15, 2004).

A corporation alleged that the defendant, who was a former officer and shareholder, violated state trade-secret laws by planning to compete with the corporation. The corporation requested that the defendant turn over a computer, which allegedly contained evidence of the defendant's plans to compete. The trial court granted a temporary restraining order (TRO) directing the defendant to hand over the computer to the corporation or to a neutral third party. The defendant waited until 7 days after the TRO was issued to deliver the computer to the corporation. After receiving the computer, the corporation hired a computer expert to inspect and retrieve any potential evidence from the computer's hard drive. The expert discovered that the hard drive had been reformatted a day before the defendant delivered the computer to the corporation, which erased any evidence that may have been on the computer. The corporation requested sanctions in the form of a default judgment against the defendant for intentionally violating the TRO. The trial court granted the corporation's motion for sanctions and entered the default judgment in favor of the corporation. The defendant appealed, stating that the evidence was insufficient to support such severe sanctions. The appellate court affirmed the trial court's judgment, determining that the sanctions were not too severe. QZO, Inc. v. Moyer, 594 S.E.2d 541 (S.C. Ct. App. 2004).

Court Denies Protective Order Absent Proof
of Destruction Or Degradation Of e-Evidence

The defendant sought a preservation order requiring the plaintiff to preserve documents and other items, including electronic documents. The plaintiff, in responding to the defendant's motion, countered with a preservation order request of its own, requiring the defendant to preserve and produce documents. In addressing the need for these orders, the court focused on the medium in which the evidence was stored. The court stated that “[if] the evidence is stored upon a computer floppy disk or hard drive, finding physical space to store the evidence will not be as much of an issue … [but] evidence stored within a computer hard drive may present a difficulty in that it may be compromised or degraded as new information is added and pieces of old information are 'deleted' and subsequently written over by the computer.” In discussing when an order would be appropriate, the court declared that timing is of the essence, particularly in cases where a party does not know that electronic evidence must be preserved. The court denied both preservation order requests, determining that there was insufficient proof showing that evidence would be lost or destroyed absent these orders. Capricorn Power Co. v. Siemens Westinghouse Power Corp., 2004 WL 870659 (W.D.Pa. Apr. 21, 2004).

Alleging that the government mismanaged trust funds, the plaintiff moved for a confidentiality agreement and protective order. Determining that good cause existed for approval and entry of the order, the court issued specific procedures for the production of electronic records. In defining records that needed to be produced, the court included computer or network activity logs, data, databases, images, e-mails, spreadsheets and metadata. The court also determined that if the parties provided access to electronic data rather than making actual copies of it, the parties should designate which electronic records are available for production by categorizing them in writing by record, category, search parameters or other reasonable methods. In addressing production format, the court directed the parties to produce records “in the format in which that party routinely uses or stores them, provided that electronic records shall be produced along with available technical information necessary for access or use.” The court indicated that if the requesting party is unable to access or use an electronic record, then the requester may ask that the responding party provide a paper version of or underlying source data for the electronic record. Jicarilla Apache Nation v. United States, 2004 WL 842264 (Fed. Cir. Apr. 19, 2004).

The plaintiff, who alleged that the government mismanaged Indian tribe trust funds and other properties, moved for a document preservation order. The requested order would require the government to index electronic documents and would allow the plaintiff limited inspection of the documents. The government contended that the proposed order was unnecessary and overly burdensome, in part because document-retention policies were already in place at the government agencies likely to be implicated in the suit. The court held that the plaintiff was required to demonstrate “that absent a court order, there is significant risk that relevant evidence will be lost or destroyed.” Additionally, the plaintiff “must show that the particular steps to be adopted will be effective, but not overbroad.” The plaintiff was able to produce evidence that the government had lost and destroyed documents in the past, including electronic records containing potentially relevant information. Based on this evidence, the court ordered the government to preserve all documents, including electronic information, e-mail, and metadata that contained relevant information or that might lead to the discovery of relevant information. The court also required the government to index all the documents and to report any documents that were destroyed. The court indicated that the possibility of sanctions “which the case law suggests may be severe … provides the incentive … needed to effectuate this preservation plan.” The Pueblo of Laguna v. United States , 60 Fed. Cl. 133 (Fed. Cl. 2004).

In a patent-infringement suit, the plaintiffs moved for production of documents relating to the development of the products in question. When the plaintiffs uncovered that the defendant had been deleting all of its e-mails every 30 days since the initiation of the suit, the court entered a protective order requiring the defendant to make a full and complete effort to recover any and all deleted electronic documents, including e-mail. The order also stated that the plaintiffs could petition for the appointment of a computer-forensics expert to assist in recovering electronic data, and that the plaintiffs could request that the defendant pay for the expert. Responding to the order, the defendant produced 45 pages of documents and an expert's report that described the defendant's efforts to recover the deleted e-mails. Although the plaintiffs found these submissions unacceptable, they did not file a petition seeking appointment of a neutral computer-forensics expert. In denying the motion, the court declared that the plaintiffs, as was their right pursuant to the protective order, should have filed a petition seeking the appointment of a computer-forensics expert. The court also held that awarding sanctions would be unjust, because plaintiffs waited more than 7 months before filing the discovery motion. Aero Prods. Int'l v. Intex Rec. Corp., 2004 WL 417193 (N.D. Ill. Jan. 30, 2004).

In a copyright-infringement suit, the court issued an order compelling the defendant to produce computer servers that hosted the plaintiffs' Web site and contained user records. When the plaintiffs' computer expert inspected the servers, he discovered that the vast majority of that information had been intentionally destroyed after the defendant learned litigation was imminent. The expert found that the defendant ran a program, designed to erase electronically stored information, more than 50 times from a remote location in an attempt to delete all electronic data from the servers. Despite the defendant's attempts, the expert recovered a small amount of data to support the plaintiffs' claims. Although the defendant attempted to attack the plaintiffs' methodologies for extrapolating the number of users and downloads, the court indicated that the defendant was “in a poor position to attack plaintiffs' evidence,” noting that “[d]estruction of evidence raises the presumption that disclosure of the materials would be damaging.” The court decided not to issue sanctions but instead encouraged the plaintiffs to move for appropriate sanctions as the case progressed. Arista Records, Inc. v. Sakfield Holding Co. S.L., 2004 WL 881851 (D.D.C. Apr. 22, 2004).

In a case involving the violation of a state trade-secrets act, an employer alleged that a former employee copied proprietary electronic documents from his work laptop to a compact disc (CD), shortly before he went to work for a competitor. The employee stated that, for the sake of simplicity and because he did not know how to save individual files onto a CD, he had transferred his entire “My Documents” folder, which contained personal files such as his wedding photographs, and inadvertently captured some of his former employer's confidential business documents. The employer's computer-forensics expert refuted the employee's claims, testifying that a file, which was not contained in the “My Documents” folder, was also copied to the CD. The expert also determined that the employee had attempted to hide the document transfer by deleting information about the downloads from the laptop. Based on this evidence, the appellate court affirmed the lower court's ruling that the evidence supported a finding of trade secret misappropriation. LeJeune v. Coin Acceptors, Inc., 2004 WL 1067795 (Md. May 13, 2004).

The defendant, an Internet lottery game operator, moved for summary judgment on a breach-of-contract claim filed by a lottery player. Contending that a genuine issue of material fact existed, the plaintiff argued that there was a dispute about the creation, transmission and receipt of two notification e-mails the defendant sent her on the same day. In support of her argument, the plaintiff submitted affidavits and documents that attempted to show a conflicting record regarding the date- and time-stamping procedures for the e-mails. The plaintiff contended that the e-mail record revealed the defendant conspired to defraud her of her winnings after a computer generated “winning” numbers that matched her selections. The defendant contended that the first notification e-mail the plaintiff received had no relation to the official winning numbers because the e-mail time stamp showed that it had been sent several hours before the defendant selected the winning lottery numbers. In granting summary judgment for the defendant, the court noted that even if it were “correct that all email received by her bears the date and time it is received by her email account … that fact would undermine her case rather than support it.” Ermolaou v. Flipside, Inc., 2004 WL 503758 (S.D.N.Y. Mar. 15, 2004).

A corporation alleged that the defendant, who was a former officer and shareholder, violated state trade-secret laws by planning to compete with the corporation. The corporation requested that the defendant turn over a computer, which allegedly contained evidence of the defendant's plans to compete. The trial court granted a temporary restraining order (TRO) directing the defendant to hand over the computer to the corporation or to a neutral third party. The defendant waited until 7 days after the TRO was issued to deliver the computer to the corporation. After receiving the computer, the corporation hired a computer expert to inspect and retrieve any potential evidence from the computer's hard drive. The expert discovered that the hard drive had been reformatted a day before the defendant delivered the computer to the corporation, which erased any evidence that may have been on the computer. The corporation requested sanctions in the form of a default judgment against the defendant for intentionally violating the TRO. The trial court granted the corporation's motion for sanctions and entered the default judgment in favor of the corporation. The defendant appealed, stating that the evidence was insufficient to support such severe sanctions. The appellate court affirmed the trial court's judgment, determining that the sanctions were not too severe. QZO, Inc. v. Moyer , 594 S.E.2d 541 (S.C. Ct. App. 2004).