When Must Litigant Provide Computer to Opponent for Examination?

Most courts agree that compelling a forensic examination of a litigant’s computer hard drive should not be granted lightly and generally only after a showing of discovery misconduct by the device owner.

Courts Must Weigh Privacy and Confidentiality Concerns Against Need for Forensic Image

For instance in Fastners For Retail, Inc. v. DeJohn 2014-Ohio-1729 (Ohio App. 2014), the court examined factors courts consider before compelling production of a computer for forensic imaging and search.  In the case, Fasteners for Retail (FFR) sued two former employees and a competitor alleging patent infringement, misuse of trade secrets, false advertising, and other claims.  After various discovery skirmishes between the parties, FFR moved to compel production of the employees’ computer hard drives.

In support of the motion, FFR contended that the former employees engaged in evasive and perjurious conduct and “potentially” spoliated critical evidence.  The trial court ordered production of the computer hard drives and the employees successfully appealed. In reversing the trial court, the appellate court noted that courts are reluctant to compel forensic imaging of computer hard drives “largely due to the risk that the imaging will improperly expose privileged and confidential material . . . .”  To prevent such intrusion, a court must weigh the interest in obtaining the discovery against the privacy concerns of the computer owner and, if a litigant is compelled to produce a computer hard drive, the court must set a protocol to ensure forensic imaging is not unduly intrusive.

In support of its opinion, the court took guidance from Bennett v. Martin, 186 Ohio App.3d 412 (10th Dist. 2009) which cautioned:

. . . before compelling forensic imaging, a court must weigh “the significant privacy and confidentiality concerns” inherent in imaging against the utility or necessity of the imaging. . . . In determining whether the particular circumstances justify forensic imaging, a court must consider whether the responding party has withheld requested information, whether the responding party is unable or unwilling to search for the requested information, and the extent to which the responding party has complied with discovery requests. . . When a requesting party demonstrates either discrepancies in a response to a discovery request or the responding party’s failure to produce the requested information, the scales tip in favor of compelling forensic imaging.

The FFR court, citing several federal cases, noted that federal courts are also reluctant to order examination of a litigant’s computer as a matter of course or on the mere suspicion that a party withheld evidence. See Playboy Enterprises v. Welles, 60 F.Supp. 2d, 1050, 1054 (S.D. Cal. 1999) (allowing access to party’s computer system on a finding of systematic deletion of relevant e-mails after litigation had commenced). See, e.g., Williams v. Mass. Mut. Life Ins. Co., 226 F.R.D. 144, 146 (D. Mass. 2005) (denying motion to appoint computer forensic expert because moving party failed to present any “credible evidence that Defendants are unwilling to produce computer-generated documents”); Bethea v. Comcast, 218 F.R.D. 328, 329-30 (D.D.C. 2003) (denying motion to compel because, “[i]n the context of computer systems and computer records, inspection or seizure is not permitted unless the moving party can demonstrate that the documents they seek to compel do, in fact, exist and are being unlawfully withheld”); Simon Prop. Group L.P. v. Simon, Inc., 194 F.R.D. 639, 641 (S.D. Ind. 2000) (allowing plaintiff to inspect defendant’s computer system because plaintiff demonstrated “troubling discrepancies with respect to defendant’s document production”); Ameriwood Indus., Inc. v. Liberman, Case No. 4:06CV524-DJS, 2006 U.S. Dist. LEXIS 93380, 2006 WL 3825291, *1 (E.D. Mo. Dec. 27, 2006) (unpublished) (granting motion to compel imaging of defendant’s hard drive because the court had “cause to question whether defendants have produced all responsive documents”).

Applying those principles to FFR’s motion, the court concluded that the trial court erred in ordering the former employees to produce their computers for forensic imaging because FFR did not establish the defendants’ noncompliance with discovery and noted that FFR, itself, failed to fully comply with discovery requests served upon it.  The court also noted that the trial court also erred in compelling the production of the hard drives without a protocol governing the forensic examination of the hard drives.

Other Courts Agree Mere Suspicion of Discovery Misconduct Not Enough to Compel Forensic Imaging of Computers

Other courts agree that ordering a forensic examination of litigants’ electronic devices should be a last resort. The Texas Supreme Court in In Re Shipman, 540 S.W.3d 562 (Tex. 2018) noted that “[p]roviding access to information by ordering an examination of a party’s electronic storage device is particularly intrusive and should be generally discouraged, just as permitting open access to a party’s file cabinets for general perusal would be. The state high court held further that as “a threshold to granting access to electronic devices, ‘the requesting party must show that the responding party has somehow defaulted in its obligation to search its records and produce the requested data.’ and “mere skepticism or bare allegations that the responding party has failed to comply with its discovery duties” is not enough. (Citations omitted).

Similarly in Motorola Solutions v. Hytera Communications, 314 F. Supp. 3d 931 (ND Ill. 2018) the court declined to order a forensic examination of computers noting that such an order is generally regarded as a “drastic step” because it is expensive and an extreme means to obtain information absent a showing of wrongdoing.

What to Think About if You Need to Image a Computer Hard Drive

If you do find yourself in need of obtaining a forensic image of an electronic device, either your own, your client’s, or your opponent’s, you will need to retain a computer forensics company with the appropriate digital forensics software and tools to collect the data. 

Before reaching out to the forensics vendor, be ready to answer a few questions:

• What type of operating system does the computer run? Windows, Mac, or Linux?
• Is the drive encrypted? If so, you will need to provide passwords and encryption keys to unlock the device.
• What kind of image acquisition is needed? Physical (a byte by byte clone of a computer hard drive) or Logical (a more streamlined collection of just files and folders on a device) or a targeted search that looks only for certain files and data.

If you need help with a digital forensics collection, let us know. We can help.

Other Articles You May Be Interested In:

Overview: The Three Types of Forensic Collections – Physical vs. Logical vs. Targeted

Protecting ESI Integrity During Collection

What is Unallocated and Slack Space on a Computer Hard Drive?