In litigation, discovery requests for computer hard drives have become commonplace. An ever increasing percentage of relevant documents are in electronic form, rather than paper form. When a computer is identified as possibly containing electronic evidence, a strict set of procedures must be followed to ensure an admissible extraction of any evidence that may exist on the subject computer. The “golden rule of electronic evidence” is that the original media should never be modified in any way, if at all possible. So, before any data analysis occurs, it usually makes sense to create an exact copy of the original storage media. This exact copy is referred to as a “mirror image” or “forensic image.” Forensic imaging of a computer’s hard drive creates a mirror image that replicates, bit for bit, sector for sector, all information on the hard drive, including embedded, residual, and “ghost” images of deleted data. The best way to accomplish this extraction of admissible evidence is to hire a professional. A computer forensic expert can, for example, analyze a forensic image of a storage device to determine what was stored on the device, what files were accessed, and when the files were last accessed or modified. Such an expert can ensure third-party objectivity and avoid accusations of evidence tampering.
Forensic imaging can also reveal what files were deleted or copied and when. These issues often arise in the context of trade secret misappropriation cases and copyright infringement cases. For example, in AdvantaCare Health Partners, L.P. v. Access IV, 2004 WL 1837997 (N.D. Cal. Aug. 17, 2004), two employees resigned and began a competing business. The defendant former employees were served with a temporary restraining order (“TRO”) prohibiting them from using, copying or destroying any of the plaintiff’s data, and required defendants to permit plaintiff to make forensic copies of the hard drives and network servers of their new company. The plaintiff’s forensic expert was eventually able to determine that after receiving the TRO, one of the defendants deleted more than 13,000 files from his home computer using an anti-forensic software program. The expert also discovered that this defendant copied a large number of the plaintiff’s files prior to leaving, including files containing company policies and procedures, patient databases, employee lists, and contracts. He then tried to conceal his copying efforts by deleting copied files from his hard drive. These electronic pieces of data resulted in the plaintiff obtaining a sanction instructing the jury that they must find that the defendants copied all of the files on the plaintiff’s computers.
When forensic imaging becomes a discovery dispute in litigation, the court may be required to weigh two competing interests. This balancing of interests was discussed in Bennett v. Martin, 186 Ohio App.3d 412, 928 N.E.2d 763, ¶ 40 (2009). The court cautioned against undue intrusiveness, and stated that courts generally are reluctant to compel forensic imaging. Before compelling forensic imaging, a court must weigh “the significant privacy and confidentiality concerns inherent in imaging against the utility or necessity of the imaging.” Id. at ¶ 41. In making this determination, a court must consider whether the responding party has withheld requested information, whether they are unable or unwilling to search for the requested information, and the extent to which the responding party has complied with discovery requests.
When a requesting party demonstrates either discrepancies in a response to a discovery request or the responding party’s failure to produce requested information, the scales tip in favor of compelling forensic imaging. Id.
In addition, when an electronic discovery dispute (including forensic imaging) arises in federal court, the factors listed in the newly amended Federal Rule of Civil Procedure 26(b) addressing the scope and limits of discovery must be weighed:
Parties may obtain discovery regarding any nonprivileged matter that is relevant to any party’s claim or defense and proportional to the needs of the case, considering the importance of the issues at stake in the action, the amount in controversy, the parties’ relative access to relevant information, the parties’ resources, the importance of the discovery in resolving the issues, and whether the burden or expense of the proposed discovery outweighs its likely benefit.
This six-factor balancing test applied by courts has come to be known as the “proportionality test.” No one factor appears to be any more important than another, so courts will have to look at all six factors depending on the facts of each case. Ultimately, the parties need to carefully consider the cost and complexity of electronic discovery in comparison to the subject and value of the case. If they cannot agree on the need and procedure for electronic discovery, then they can turn to the court to weigh the factors and decide.