Logo
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Forensic Discoveries Newsletter

November 2007
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Welcome to Knoxville's EDiscovery and Computer Forensics Newsletter. Keeping you and your practice informed of the ever-changing realm of Electronic Discovery and Computer Forensics is the purpose of this newsletter. If you have a colleague that may be interested in subscribing, the link to subscribe is http://www.forensicdiscoveries.com/newsletter.html or follow the instructions at the bottom of this newsletter. If you choose not to continue receiving this newsletter, follow the directions at the bottom of this newsletter and accept my apologies for intruding.
in this issue
Upcoming CLE Seminar
Preparing You for Your Clients' EDiscovery
Local Rules of United States District Courts Addressing E-Discovery Issues
EDiscovery Case Law
I would like to thank each of you that attended the CyberSecurity Summit here in Knoxville last month. For each of you that I was able to speak with, I enjoyed the conversation and look forward to working with you in the future. I am working with the Knoxville Bar Association to see if I can give the same presentation at Knoxville's legal tech expo in the spring. For anyone interested in a CLE credit course on "Presenting Digital Evidence in Court" or any other Electronic Discovery topic , please contact the Knoxville Bar Association and express your interest.

 

Upcoming CLE Seminar 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
On Thursday, November 15, I will be joining Charles E. Young from Kramer Rayson LLP in the CLE course "Security Issues for E-mail and Electronic Communications". The session begins at 11:00am and will be in the Main Assembly Room in the City County building. Visit http://www.knoxbar.org for more details.
Preparing You for Your Clients' EDiscovery 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
We have spent the last two newsletters discussing ways that you can assist your clients in preparing themselves for EDiscovery. I don't know how to break this to you, but not all of your clients will be willing to take on this task. The clients that have endured EDiscovery are likely to prepare, but others will consider it a legal issue that will be put into the category of "deal with it if it happens". This is because historically the role of the Information Technology (IT) department is not legal matters; it is to keep the business running and to provide a competitive edge. I have spent more than 12 years in and around large IT departments and there is a common theme that typically exists; IT departments are understaffed and over worked. If you have recently dealt with an IT department in EDiscovery, you know exactly what I am talking about. Many IT professionals are working 50 hour weeks just to "keep the lights on" in a profession that is typically reactive (that is why they are all so friendly). Therefore, the tasks of EDiscovery can be the proverbial "straw that broke the camel's back". To complicate matters for attorneys, Zubulake set the expectation that lawyers will know how their clients create and store electronically stored information; how they save it, and how it may be deleted or lost. This is needed so all discoverable ESI can be disclosed, preserved, and produced. To summarize, you will have clients that will not prepare themselves for EDiscovery and their attorneys are expected to know everything about their environment to "oversee" the EDiscovery process to ensure that it is handled properly. Don't worry; it is doable with some help.
 
It will obviously be very difficult to understand every aspect of your client's information technology infrastructure. The best you can do is to gather enough information to prompt your client about the crucial aspects you will need during EDiscovery. The essential pieces of information revolve around some of the following topics:
· The locations and mechanism that e-mail is stored and purged.
· The types of software applications they have and the data they contain.
· Locations that office documents are stored (Word, Excel, etc.)
· Details about their backup infrastructure.
· Data retention policies and the technical details of implementation.
· Information about de-centralized ESI (Blackberrys, telecommuters, etc.)
 

With the needed information from the topics above, critical questions pertaining to the EDiscovery process can be answered when the time comes:
· Did we gather all of the E-mail from the server(s), personal computers, and       Blackberrys?
· Did we gather the applicable information from the payroll or claims system?
· Have all office documents been gathered from the file server(s), personal computers, and home users?
· To adhere to the Preservation Order, have you removed the applicable backup tapes from the rotation to prevent them from being overwritten?
· Have you stopped the automatic deletion of data from your systems?
· Is there any relevant data on the Blackberrys and laptops of mobile users?

 
Please understand that the information above is not an exhaustive list and is used as an example only. Each of your clients will have unique environments that will need to be addressed differently.
 
The best way to gather this information is to either develop a standard questionnaire to send to your clients or schedule a meeting with them. A standard questionnaire will provide great value but could require additional follow up conversations to make sure that there is a mutual understanding. A scheduled meeting of 1-2 hours would be preferred to discuss their technical environment. Regardless of which method is chosen, be certain to work with a technical expert that has extensive experience in Information Technology departments in addition to being sensitive to the needs of the EDiscovery process. In case you haven't experienced it, there can be communication "challenges" between attorneys and technical professionals. In reviewing case law pertaining to ESI, you will find that these "challenges" often result in spoliation. This technical resource is also very important to the process to; develop the questionnaire, lead the meetings, interpret the information from the IT department, and assist you in creating the plan for your clients' EDiscovery for your files. If you do not have a technical resource to assist you with this matter, contact Forensic Discoveries and we will be glad to assist you.  Once the initial information is gathered and a EDiscovery checklist is created, follow up with your clients semi-annually to ask about any applicable technology changes that that has been added and removed. You will use this information to keep the checklist for your clients up to date.
 
Local Rules of United States District Courts Addressing E-Discovery Issues  (Knoxville and Chattanooga)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Form Scheduling Order (Knoxville) (Senior District Judge Leon Jordan )  (see Item 4(d))
 
Form Scheduling Order (Knoxville) (District Judge Thomas A. Varlan )  (see Item 4(d))  
 

Form Scheduling Order (Chattanooga) (Magistrate Judge Susan K. Lee) (see Item 5(a)) 

EDiscovery Case Law 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Court Imposes Sanctions for Purposeful Sluggishness in Discovery


In re Seroquel Prod. Liab. Litig., 2007 WL 2412946 (M.D.Fla. Aug. 21, 2007). In this multidistrict product liability litigation, the plaintiffs motioned the court to impose sanctions on the defendant for failing to comply with discovery obligations. The plaintiffs pointed to numerous instances where the defendant failed to produce documents in an accessible or useable format, in addition to missing numerous deadlines. While the court found two of those instances to be excusably negligent, the other behavior warranted sanctions. The court was extremely displeased with the defendant's failure to discuss keyword search terms with the plaintiffs, failure to include page breaks between documents it did produce and failure to produce usable single-page tiff documents. The court also noted the defendant's omission of attachments and relevant e-mails and purposeful sluggishness in making an effective production. The court stayed its determination of which sanctions it should impose to allow the plaintiffs an opportunity to present evidence as to their damages or prejudice. 

 

  

Wife Allowed to Access Husband's Email in Marital Dissolution Action 


White v. White
, 781 A.2d 85 (N.J. Super. Ct. Ch. Div. 2001). In a divorce action, the husband filed a motion to suppress his email that had been stored on the hard drive of the family computer. The court held that the wife did not unlawfully access stored electronic communications in violation of the New Jersey Wiretap Act and did not intrude on his seclusion by accessing those emails. "Having a legitimate reason for being in the files, plaintiff had a right to seize evidence she believed indicated her husband was being unfaithful-Is rummaging through files in a computer hard drive any different than rummaging through files in an unlocked file cabinet-Not really." 

 

 

Adverse Inference Sanctions Granted Where Plaintiff Destroyed Computer Evidence 

 


Anderson v. Crossroads Capital Partners, L.L.C., 2004 WL 256512 (D.Minn. Feb. 10, 2004). In a sexual harassment and whistleblower lawsuit, the defendants sought to recover the hard drive of plaintiff's personal computer because it allegedly contained an October 2001 document outlining the harassment. After a protracted discovery battle, the defendants sought a Motion to Compel and the judge ordered the plaintiff to furnish the defendant with a "copy of all documents/files relevant to this litigation that exist on Ms. Anderson's personal computer as well as those that have been deleted or otherwise adulterated." Pursuant to the judge's Order, the defendants' computer forensic expert examined the plaintiff's hard drive and discovered that a data wiping software application had been installed after the plaintiff had agreed not to "delete any existing documents" in a deposition. The computer forensic expert also found that the hard drive installed in the machine was manufactured in August 2002. The plaintiff claimed that she did not use the software program to destroy evidence, but that she used it routinely to protect her computer files. She also stated that in her view she owned the same computer throughout the litigation despite changing the hard drive in 2002. The defendants then moved to dismiss the complaint due to plaintiff's alleged discovery violations and destruction of evidence. The court noted that the plaintiff's "exceedingly tedious and disingenuous claim of naiveté! regarding her failure to produce the requested discovery-defies the bounds of reason" but was not sufficiently egregious to warrant dismissal of the case. Instead, the court issued an adverse inference jury instruction because the plaintiff intentionally destroyed evidence and attempted to suppress the truth. 

 

 

 Defendant Ordered to Pay Costs Associated with Computer Forensic Investigation 


Trigon Ins. Co. v. United States, 204 F.R.D. 277 (E.D.Va. 2001); Trigon Ins. Co. v. United States, 2002 WL 31864265 (E.D.Va. Dec. 17, 2002). Based on computer forensic expert analysis, the court found that the defendant willfully and intentionally destroyed documents that should have been produced during discovery. The court issued adverse inferences and reimbursement of plaintiff's attorneys fees as damages for the spoliation. Trigon Ins. Co. v. United States, 2002 WL 31864265 (E.D.Va. Dec. 17, 2002.). Despite objection by the defendant, the court found plaintiff's fees and expenses (in the amount of $179,725.70) for hiring and deposing computer forensics experts and briefing and adjudicating the issues related to the spoliation warranted and reasonable. 

 

 

 

Defendants Must Allow Computer Expert Access to Servers and Computers

 

 Tilberg v. Next Mgmt. Co., 2005 WL 2759860 (S.D.N.Y. Oct. 24, 2005). During discovery, the court ordered the defendants to give the plaintiff's computer forensic expert access to two email servers and ordered the parties to split costs. However, when the forensic expert began his examination, he was unable to access the defendants' second server. The defendants claimed this was the result of a system crash. After the discovery deadline passed, the plaintiff again sought access to the second server as well as permission to search the defendants' central non-email server and two specific employees' desktop computers. The defendants submitted an affidavit from its information technology personnel indicating the computer system did not contain relevant documents. However, the plaintiff's expert "found 187 occurrences of the word 'Tilberg' in 'active space,' which could have been found with standard search tools, and 97 occurrences of 'Tilberg' in deleted files." The plaintiff declared the defendants should have produced these files without the need for a forensic search. Additionally, the plaintiff presented documents obtained from third parties that further proved relevant documents existed despite the defendant's contrary claims. Finding the defendants "either inadvertently or deliberately delayed and obstructed discovery in this case," the court ordered the defendants to provide the expert with access to the second email server, the central server, and the two desktop computers. See also Tilberg v. Next Mgmt Co., 2005 WL 3543701 (S.D.N.Y. Dec. 28, 2005)(Addressing issue of privileged emails uncovered in the search).


 
Quick Links...
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
Forensic Discoveries is available to provide onsite presentations or Q&A sessions on topics such as Electronic Discovery, Technical Implications of the updated Federal Rules of Civil Procedure, or Computer Forensics. Forensic Discoveries is also available to you, obligation free, to answer any specific questions pertaining to these topics. Simply give us a call and we will be glad to answer any questions pertaining to Electronic Discovery and Computer Forensics.
Contact Information
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
phone: (865)-809-7590
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 

If you have a topic that you would like addressed in the newsletter, please let us know. Either visit http://www.forensicdiscoveries.com/newsletter.html and submit your suggestion there or reply to this e-mail with your suggestion. 

For previous versions of Forensic Discoveries EDiscovery newsletters, visit http://www.forensicdiscoveries.com/pastnewsletters.html  

 

This document does not provide legal or other professional advice and should not be relied upon as anything other than a starting point for research and information on the subject of electronic evidence.