Upload
others
View
6
Download
0
Embed Size (px)
Citation preview
ML/~
STATE OF ILLINOIS IN THE CIRCUIT COURT OF THE TWENTY-1HIRD JUDICIAL CIRCUIT
DEKALB COUNTY, ILLINOIS
VANTAGE ELECTRIC GROUP, INC., d/b/a) VANTAGE GROUP, an Illinois Corporation,)
) Plaintiff, )
) v. )
) NICOLE M. HUMMER, an individual )
) Defendant, )
) & )
) SUPPLYFORCE.COM, LLC, )
) Respondent in Discovery. )
RE-NOTICE OF MOTION
Case No.: 14 L 79
Jvt.aureen .JI.. ]osfi Electronically Filed
DeKalb County. Illinois
Transaction JD : 170373520
14L79
11/03/2015
YOU ARE HEREBY NOTIFIED that that on the 9th day of November, 2015, at the hour of 9:00 a.m., or as soon then~after as counsel may be heard, I shall appear before the Honorable Judge Presiding, or any Judge sitting in his stead, in the courtroom usually occupied by him in the in the DeKalb County Courthouse and there present Plaintiffs attached Motion and Memorandum to Compel Forensic Examination.
Respectfully Submitted,
/s/ C. Nicholas Cronauer
C. Nicholas Cronauer BURNS, CRONAUER & BROWN, LLP 1101 DeKalb Ave Suite 2 Sycamore, IL 60178 (815)895-8585/(815)895-4070 Fax
l4L/~
STATE OF ILLINOIS IN THE CIRCUIT COURT OF THE TWE NTY-THIRD JUDICIAL CIRCUIT
DE KALB COUNTY, ILLINOIS
VANTAGE ELECT RIC GROUP, INC., d/b/a) VANTAGE GROUP, an Illinois Corporation,)
) Plaintiff, )
) v. )
) NICOLE M. HUMMER, an individual )
) Defendant, )
) & )
) SUPPLYFORCE.COM, LLC, )
) Respondent in Discovery. )
Case No.: 14L 79
Jvt.aureen Jt. ]osfi Electronically Filed
DeKalb County. Illinois
Transaction ID : 170373520
14L79
11/03/2015
MOTION & MEMORANDUM TO COMPEL PRODUCTION OF RELEVANT ELECTRONICALLY STORED
INFORMATION (ESI) AND OTHER RELATED MATERIALS
Plaintiff submits this Brief in support of its Motion to Compel Production of Relevant ESI
and other Related Materials, pursuant to Illinois Supreme Court Rules 214 & 219, for an Order
compelling Defendant Hummer to produce all relevant data stored on relevant computer hard
drives by permitting Plaintiffs electronic discovery expert to exatnine the hard drive images the
Defendant has in her possession (through counsel), extract relevant data therefrom, and produce a
Report of Relevant Data colloquially known as a "hash list" from the hard drives referenced in
Defendant Hummer's sworn testimony and identified by her in interrogatories, in accordance with
established protocols. See, i.e., Simon Properry G1'ot1p v. vrySimo11, Inc. 194 F.R.D. 639, 2000
U.S.Dist.LEXIS 8950 (S.D.lnd. 2000).
l'+L/~
.BACKGROUND
This court is intimately aware with the factual procedural background in this case given the
multi-day hearing that occurred. Vlaintiff has been attempting to examine Defendant Hummer's
electronically stored information, but so far has not been saccessful. To date, Plaintiff and
Defendant have been conferring about the issue, but no agreement has been reached. Defendant
proffered a potential expert, however, Plaintiff was not comfortable using Defendants tendered
expert Jim Fatz, a Northern Illinois University employee. Mr. f<'atz' personal company, CT-Security,
would be using Northern Illinois University's software/licensing agreement for this pt:ivate
engagement. Included herein and attached as Exhibit J\ is a proposed protective order to be entered
for the examination of relevant ESL
LEGAL ST AND ARD
Jllinois Supreme Court Rule 214 aUows a party to "direct any other party to produce for
inspection, copying, reproduction photographing, testing or sampling, including electronically
stored information ... , objects or tangible things." Further, the State of Illinois has a broad
discovery standard, allowing requests which demand "full disclosure regarding any mailer relevant
Lo the subject matter invohrcd in the pending action." Ill. Sup. Ct. Rule 201Q))O). This rule has been
interpreted to permit liberal pretrial discovery. IPil!/i~y v. Chicago Park Dist., 274 Ill. App. 3d 939, 949
(1st Dist. 1995). "Computer records, including records that have been 'deleted,' arc discoverable"
documents. See Citing Civ11111 Lffe 1"s111'(111cc Co. v. Craig, 995 F.2d 1376 (7th Cir. 1993; flli11ois Tool
Wo1k.1~ Im: v. Metro lvfark P1vd11cts LI-fl., 43 F.Supp.2d 951 (N.D. Ill. 1999) (discussing the Federal
Discovery Rules to produce)
ANALYSIS
I. GIVEN THE TESTIMONY HEARD IN THIS CASE, A FORENSIC EXAMINATION FOR ESI IS REASONABLY CALCULATED TO LEAD TO DISCOVERABLE INFORMATION BECAUSE DEFENDANT HUMMER DELETED DATA, EMAILS, AND DESTROYED HARD DRIVES AFTER
HL/~
SWAPPING IDENTICAL HARD DRIVES AND ELECTRONICALLY STORED INFORMATION MUST ALSO BE PRESERVED TO PREVENT THE DATA FROM BEIN G OVERWRITTEN OR LOST.
While e-discovery in Illinois state courts is permitted, there is a dearth of case law discussing the
concept. Courts in other jurisdictions, mainly federa l court, have repeatedly allowed such examinations where
the party's discovet}' responses contain "discrepancies or inconsistencies;' including a failure to produce
responsive documents, and/ or evidence that 1:elcvant data has been deleted. See e.g., Ge11J})orth Fi11. Wealth
Mgmt.,. 267 F.R.D. 443, 447-448 (D. Conn. 2010) (forensic examination allowed based, in part, upon
defendant's admission to evidence spoliation by discarding cotr1puter); Koos!tm-em Co,p. v. Spec Pen, LLC 2008
WL 4458864 at *2 (D.S.C. Sept. 29, 2008) (forensic examination allowed where defendant failed to produce
documents); ./1111enivood l11d11s. If It: u. Uhm11t111, 2006 WL 3825291 at *3 (E.D. Mo. Dec. 27, 2006) (forensic
examination allowed where forensic evidence showed defendant failed to produce all responsive email); Si1J1011
Prop. G,p. LP. 11. 111)'Si1110111 194 F.R.D. 639, 641 (S.D. Incl. 2000) (forensic examination allowed to recover
"deleted files" based, in part, on defendant's failure to produce documents). Herc, Plaintiff has admitted
to having backed up, transferred, and emailed Plaintiffs data, and then destroyed a hard drive T>laintiff requested
be retutned. Thus, Plaintiff must be allowed to conduct a forensic examination of Defendant Hummer's
electronic devices in order to determine whether additional relevant evidence has been withheld, transferred,
and/ or destroyed.
Plaintiff's electronic discovery expert, Andrew Garrett, identified a u:easure trove of Plaintiff's
data being transferred vie, a hard drive that was subsequently destroyed and by the Defendant's
personal email address. Accordingly, under Rule 214, Defendants cannot in good faith argue that
Plaintiff cannot maintain a Motion to Compel access to Defendant's computers in order to create a
forensic analysis. Defendant has admittedly engaged in some actjvity that resulted in the deletion,
hiding, or other destruction of relevant data.
ML/Y
In addition to data being overwritten by the normal functioning of the computers' operating
system, data on defendants' computers is at risk of loss from system crashes, malfunctions, viruses,
and physical shock. Only by ci:eating a forensic, bit stream, n~tror image copy of the relevant
computers can all evidence be preserved for this litigation
II. PRODUCING COMPUTERS DISCOVERY.
DEFENDANT HUMMER'S PERSONAL IN ORDER TO MATCH FILES IS PROPER
Defendirnt has admitted to transferring and destroying ESI evidence pertaining to the allegations
Pktintiffs lawsuit against Defendant, despite Plaintiffs request that the hard drive be returned to it. These facts,
alone nccessitntes a forensic examination. See Ge11J1Jortb Fin lfeal!h l'vJgmt., J,u: :ind Si111011 P,vp. G,p. 267 F.R.D.
443 , 447-448 (D. Conn. 2010). In Ge111vot1h, the plaintiff requested a forensic examination of the defendant's
computers after the defendant exhibited considerable bad faith in discover)', including admitting to throwing
away a computer containing relevant evidence. In ruling that n forensic examination was justified, the court
explained that "the timing of the computer's disposal [coming nfter accusations of unlawful conduct had been
levied against the defendant) evidences n consciousness of wrongdoing." 267 F.R.D. at 447-48. Here, just like
in Ge111vo11b, Defendant nclmitted to backing up and destroying relevant evidence and acknowledged that she did
so qjier receiving a letter from the Plaintiff requesting that the proprietary u1formation be returned. As in Si111011,
Defendant Hummer's destruction of the lrnrd drive she admittedly backed darn up to- only nfter returning to
Plnintiff no identical new, blnnk hard drive-is evidence of her consciousness wrongdoing. Thus, Defendant is
entitled to a forensic exmnination just like in Gemvo11h.
Plaintiff is entitled to discover all relevant data, including deleted data from Defendants'
cotnputers. See Antioch Co. v. Scmphook JJorders, 111c., 210 F.R.D. 645, 652 (D. Mfon. 2002) ("lllt is a
well accepted proposition d1at deleted computer files , whether they be emails or otherwise, are
discoverable") ; Ro1JJ11 E 11!JJ1't, Inc. v. The Willia111 Monis / Ige119,, Ille., 205 F.R.D. 421, 427-431 (S.D.N.Y.
2002) (stating that "[e]lcctronic documents are no less subject to disclosure than paper records," and
only questioning which patty should bear the cost of such discovery, especially for backup tapes or
deleted e-mail.s); McPeek 11. Ashcrqfi, 202 fo.R.D. 31, 34 (D.D.C. 2001) (stating that, "[djuring
discovery, the producing party has an obligation to search available electronic systems for
.information demanded," and ordering a limited backup restoration of e-mails); Kleiner v. B11ms, 48
Fed. R. Serv. 3d 644, 2000 \XIL 1909470 (D. Kan. Dec. 15, 2000) (noting that Rule 26(a)(l)(B)
requires description and categorization of computerized data, .including deleted e-mails, and stating
that "[t]he disclosing party shall take reasonable steps to cns1..1te that it discloses any backup copies
of ftlcs or archival tapes that will provide information about any 'deleted' electronic data"); S1111011
Prope,j,y Gro11p LP. v. "()'Simon, file., 194 F.R.D. 639, 640 (S.D. Ind. 2000) ("F.i.rst, computer records,
including t:ecords that have been 'deleted,' are documents discoverable under Fed. R. Civ. P. 34."
Citing CroJ/111 I--!/c fos11m11,-e Co. 11. Craig, 995 F.2d 1376 (7th C.i.r. 1993; Illi11ois Tool !Porks, Inc. u. Metro
Mark Pro1h1ds Lid., 43 F.Supp.2d 951 (N.D. Ill. 1999)); Pk!Jbq)' E11te1: v. IIVe/leJ; 60 r. Supp. 2d 1050,
1053 (S.D. Cal. 1999) ("Plaintiff needs to access the hard dcive of Defendants' computer only
becaus~ Defendants' actions in deleting those e-mails made it crnrently impossible to produce tJ1e
information as a 'document."'). Anli-Mo11opofy, Im~ v. Hasbro, I11c. WL 649934 (S.D.N.Y., Nov. 3,
1995); Seattle Al!d11bo11 Socie(y v. 1=,yons, 871 F. Supp. 1291 (W.D. Wash. 1994); Li11ne11 u. A.H.Rohi11J; Co.
WL 462015 (.tvfass. Super., June 16, 1999); Cro1JJ11 Life lns11m11ce Co., v. Cmig 995 F.2d 1376 (7th Cir.
1993)
It is a legal maxim beyond reasonable debate that deleting data on a hard drive docs not
remove the data from the scope of discovery. Dodge, IVam11 & Peter.,· Ins. SerN. 11. Ri.efy \XIL 245586
(Cal. Ct. App. Feb. 5, 2003); Si.111011 Proper(} G,v11p 11. 11rySi111011, l11c. 194 P.R.D. 639, 2000
U.S.Dist.LEXIS 8950 (S.D.Tnd. 2000). This is because data that has been "deleted" from a computer
is still resident on the computer's hard drive-the data has simply been rendered "invisible" to the
14L/~
computer's operating system.' While deleted data is certainly the most common form of "invisible"
data, it is not the only type of data that is invisible to the operating system 'Invisible" data .includes
back-up copies of work in progress, data related to tasks being done by the processor, log data, and
various other forms of information needed by the compntet to work.
When data is "deleted", the location at which this data is written on the hard drive is
"tagged" by the operating system and identified as a location available to the operating system to use
to store new data as needed. Thus, as the Defendants in the matter at bar continue to use their
computers, the operating system overwrites all forms of data, including data relevant to the
Plaintiffs claims or the Defendants' defenses. /111/ioch v. Scmphook Bordm, l,11:, 210 F.R.D. 645
(D.Mion. 2002).
Although the compute.r's operating system cannot v1c,v the "invisible" data on the
computer's hard dtives, forensic software can read, extract, and process i1l1 data on hard drives,
including "invisible" data in l\ non-disruptive, economical manner. The procedure used by computer
forensic experts to identify and extract all relevant data from a computer hard drive begins with the
creation of a mirror-image oi: copy of the relevant hard drives. P!qybqy Ente,plim~ Inc. 1J. Welles, 60 F.
Supp.2cl 1050 (S.D. Cal. 1999). State v. Cook, 149 Ohio App.3d 422 (2nd Dist. Mont. County, 2002)
Creating an image of a relevant hard drive recruires that Plaintiffs eDiscovery expert,
Andrew Garrett, have access to the Defendants' hard drives contained therein for an average of two
to five hours.2 Dming this period of time, Plaintiffs expert will attach a write-blocking device to the
Defendants hard drive (to prevent any change to any of the data on any of the relevant hard drives),
Computers store two major categories of data: data that is viewable by the operating system (such as documents, spreadsheets, memos, etc.) and data that is not vicwnble by the operating system. In the normal opcrntion of a computer, data is written onto the computer's hard drive and this data is not intended to be viewed br, and is invisible to, the operating si1stem.
2 This is an avcrnge time. l\·lany cases can be completed in less than two hours. Sometimes, the imaging process takes longer depending on 1·he condition of the relevant hard drives, the speed at which they operate, and other factors.
1£1-L/~
and create a copy of each relevant hard drive. Each image will be copied to a hard drive supplied by
Plaintiffs expert and will use the standard prnctices of the Department of Justice. The imaged hard
drive will then be left in the Defendant's possession and control for safe-keeping.
In this matter, Defendants Hummer's personal computct has finally been identified. To
minimize any i.nconveni.cnce to Defendants, Plaintiff has offered to match hash list fites during times
convenient for Defendant, including evenings, after business hours, Saturday or Sunday. The
forensic process is not disruptive to Defendant Hummer. In fact, this process is very efficient,
allowing the identification and exertion of relevant data to be accomplished electxonically. The
Plaintiff's expert has already created the list of files known as a hash list and the Plaintiff is only
requesting an opportunity to compare Defendant Hununer's hash list of files form her personal
computer and access opernting system files and logs to determine no intellectual property is being
hiu:bo1:ed or was loaded but then wiped. This is proper and permitted under the civi.1 discovery rules.
III. IDENTIFICATION OF RELEVANT DATA IS COMPLETED ELECTRONICALLY, AND ONLY RELEVANT DATA IS EXTRACTED; ENSURING THAT NO "FISHING EXPEDITION" CAN OCCUR.
After Plaintiffs expert created copies of the images from the Defendant's Vantage-issued
computer, he electronically searched and analyzed the images for related ESL Keywot:d searches,
combined with analysis of metadata and system. ai:tifacts, comprised the usual tools used to complete
an analysis. Plaintiff's expert already has a hash list of files he located as being transfened from
Plaintiffs work-issued laptop and can easily identify th tough hash Jist matching whether those files
appear on Defendant Hum1ner's personal laptop or were destroyed.
Electronic searching for Plaintiffs telated E SI on the Defc.ndant's personal computer is the
only practical means of identifying relevant data on a hard drive. An average size hard drive can have
millions of pieces of data thereon, and it is imp.tactical to search for relevant data by randomly
viewing folders or files. All searching for Defendant's related E S! will be conducted electronically.
14L/~
As a result, through hash list matching, unrelated ESI data wilJ not be identified, extracted, or
viewed by Plaintiff's expert. Plaintiff's expert will not view any data that does not have references to
Plaintiffs files b)1 systematically exempting any £ile that does not meet the hash list file registry.
Defendants may argue that they should be given the right to approve of the search and
analysis strategy used by Plaintiffs expert, including the right to veto the use of search terms or
analysis of system artifacts. Defendants should have no right to limit Plaintiffs discovery or t·he
discretion of Plaintiffs expert. This procedure absolutely protects Defendants' interests and vitiates
any concern related to random searching of Defendants' hard drives. Plaintiff's Motion to Compel
will allow Plaintiff access to data that Plaintifrs expert has acknowledged exists and was not refuted
at the multi-day hearing.
a. THE PROTOCOL BELOW IS NECESSARY TO ENSURE RELEVANT ESI IS DISCOVERED.
The Plaintiff suggest the following protocol to ensure that information is reasonably
calculated to lead to discoverable information:
1. Answer the following questions for each co1npute1::
a. \'v'hat operating system is installed and what date was it installed (MFT File Date, Registry);
b. What USB Devices have been connected to the computer (Serial Number, Last Date Connected); and
c. Review Event Logs and PreFetch for evidence of anti forensic tool use.
2. Determine if spoliation of data has occurred;
a. Compute the amount of drive space that is written with a pattern such as all O's 01: l's or pattern of chamcters/ numbers;
b. Search for the following keywords and if found exu:act the file containing the string of data or bookmark and export the 100 words before and after in the unallocated:
BCWipe 131eachBit
CCleaner Darik1s Boot and Nuke (DTIAN) Data Shreddct: Disk Utility HDDerasc hdparm shred Shredit srm Zeero
14L/~
3. Complete file carving for files with extensions:
doc-Legacy Word document; Microsoft Office refers to tl1em as "Microsoft Word 97-2003 Document" dot- Legacy Word templates; officially designated "Microsoft Word 97 - 2003 Template11
docx-Word document docm-Word macro-enabled document; same as .docx dotx- Word template dotm- Word macro-enabled template; same as dotx, but may contain macros and scripts docb- Word binary document introduced in Microsoft Office 2007 pptx-PowerPofr1t presentation pptm-Power1)oint macro-enabled presentation potx-PowerPoint template poan-PowerPoint macro-enabled template ppsx- PowerPoin t slides bow ppsm- PowerPoiot macro-enabled slideshow sldx-PowerPoint slide sldm- PowerPoint macro-enabled slide xis-Legacy Excel worksheets xlm - Excel macro xlsx - Excel workbook xlsm - E xcel macro-enabled workbook; same as xlsx but may contain macros an<l scripts xlw - Excel workspace; previously known as uworkbook11
ACCDB - The file extension for the new Office Access 2007 file format. This takes the place of the MDB file extension. ACCDE - The frle extension for Office Access 2007 files that are in 11execute only" mode.
4. .After file recovery, attach a hash list to the case and process again to find files that match the hashes provided and then bookmark any files matching. Create a report of the artifacts matching and export those files noting the tvfDS hash v!llucs in the report with the file times.
CONCLUSION
14LN
Granting Plaintiff's Motion to Compel would finally allow Plaintiff to accomplish the inquiry
permitted by Supreme Court Rules of civil discovery applicable u1 this case. Using special software,
an expert such as Plaintiff's expert, Andrew Garrett, or Defendants expert, can easily match hash
lists of files from all the relevant hard drives in this case. The matching can occur at a time and
location of the Defendants choosing, and the process does not cause any disruption in her personal
affairs or business. Using computer forensic softwate, an c-discovery expert like Andrew Garrett
can make easily match a list of files al.i:cady known to have been backed up to a hard ddve that is
now allegedly destroyed but not returned, and ensute all televant hard drives in this case are not
repositories for Plaintiff's pi:opcietary property.
WHEREfi'ORE, the foregoing reasons, Plaintiff request their Motion to Compel Production
of Relevar\t Electronic Stored Information (ESI) and other related materials be granted.
Respectfully Submitted,
VANTAGE ELECTRIC GROUP, !NC.
By: ?.i1'c,~ One of its Attorneys
C.. Nicholas Cto11auer (6305683) TI URNS, CRON.-\UER, & BROWN, LLP A ttomey for Plaintiff 1101 DeKalb Ave., Suite 2 Sycamore, IL 60178 (815) 895-8585/(815) 895-4070 Fax
November 3, 2015
CERTIFICATE OF SERVICE-ATTORNEY
I hereby certify that on November l-, 2015, l mailed by United States Postal Service, with proper postage affixed and prepaid, the foregoing documents to the following participants:
HARRIS & ASSOCIATES
c/o Regina Harris 513 West State Street
Sycamorfi IL 60178 ~
By ~- ~A._.-: ~ C. Nicholas. Cronauer
THE COLLINSL·\\v' FIR~!
Britt M. Anderson 1770 Park Street, Suite 200 Naperville, Illinois 60563
ML/~
STATE OF ILLINOIS IN THE CIRCUIT COURT OF THE TWENTY-THIRD JUDICIAL CIRCUIT
DEKALB COUNTY, ILLINOIS
VANTAGE ELECTRIC GROUP, INC. , d/b/a) VANTAGE GROUP, an Illinois Corporation,)
) ~~~ )
) v. )
) NICOLE M. HUMMER, an individual )
) Defendant, )
) & )
) SUPPLYFORC12.COM, LLC, )
) Respondent in Discovery. )
Case No.: 14 L 79
MUTUAL ELECTRONIC DISCOVERY AND PROTECTIVE ORDER
T he parties agree that Electronically Stored Information (EST) that may be relevant to
this matter may be found on computcr(s) located at the defendant's place of business. In order
to locate and search for relevant ESI, an expert is needed to examine computer(s) at the
Respondent in Discovery's place o f business. Purportedly, the computers containing ESI that
are relevant to th is matter, may contain confidential information such as "attorney work
product" (A WP), "Attorney-Client Communication" (ACC) and "HIP J\J\" protected (HIP AA)
patient medical records. The following protocol and protective order is entered by mutual
agreement of the parties.
1) Expert Identification. The requesting party has solicited the services of Garrett
Discovery Inc., an Illinois cDiscovery and Computer Forensic Fittn. Garrett Discovery has
£;. A-
ML/':J
assigned Andrew Ganett eDiscovery/Computer Forensic expert to this matter. Expert Garrett's
CV and cast history is attached and marked as 'Attachment IV. Expert Garrett has performed
eDiscovery and Computer Forensic Services for the Department of Defense, Department of
Justice, redetal and State courts and has collected ESI from government facilities, jails, hospitals,
governmental units and healthcare facilities using similar protocol to what listed below.
2) . Identification. The Respondent in Discovery shall identify computer(s) used by
Defendant Hummer in the normal course of business. This includes the server used to store
records ot: backup Defendant Hummei:'s software and files.
3) Scope. Documents and materials collected by the 'expert' in the course of
discovery of this case, including initial disclosures, responses to discovery requests, all deposition
testimony and exhibits, and information derived directly therefrom (hereinafter collectively
"documents"), are subject to th.is Order concerning Confidential Information as set fotth below.
Expert shall not share or disclose the contents of hard drives or setvers examine to Plaintiff, his
agents, attorneys, or any other person not approved, in writiJ1g, by the Defendant or Respondent
in Discovery. His role will simply be to perform identification of users, operating system, file
metadata, keyword searching, file matching, if any, among devices mid review for any evidence of
spoliation.
4) Defini tion of Confidential Information. As used in this Order, "Confidential
Information" is defmed as information that the producing party designates in good faith has been
previously maintained in a confidential manner and should be protected from disclosure and use
outside the litjgatiou because its disclosure and use is restricted by statute or could potentially
cause harm to the interests of disclosiJ1g party or nonparties. for purposes of this Order, the
parties will limit their designation of "Confidential Information" to the following categories of
2
14L /~
information or documents:
[The parties sho11ld ide11tf(y the Jpecijic cmd 11a,ro1p categoties of i11Jor111t1tio11 thry seek lo p,vtec/ s11ch as medit,,I records, diCJII lists, peno1111el flies, tax ret11ms,fi11c111cia/ state111e11/s a11d recorcb~ p,vprietatJ b11Ji11ess records (prici11g sheets), tmde secrets, ncords 1vhose disdosm-e is res/tided or prohibited~ stat11te, etc.]
5) Collection of ESI. T he 'expert' will make forensic images (copies) of the hard
drives and servers in the possession and control of the prodncing party. It is necessary to ask
questions of the custodians of such records and that they fully comply with the inquiry. It is
agreed that in order for the expert to col.lect evidence in a timely manner, that the producing
patty agrees to answer all questions ful.ly. None of the answers will be considered
interrogatories. The process of making a forensic image allows for the business to remain
operational with little to no down time, ensures that the original hard drive is not changed or
altered in anyway by use of write blocking software and allows for the examination to be
completed off site in a laboratory enviroiunent which reduces.
6) Discovery Protoco l. The following steps will be strictly folJowed by the expert:
a) Plaintiff's shall bear the cost of an <expert';
b) Expert will interview the producing party custodians;
c) Expert will make forensic images (copies) of hard drives in the possession
and control of the p roducing party;
d) Expert will search for and locate ESI relevant to the matter including ESI
regarding the creation, deletion, modification or h.istory of the ESJ, suggested
search parameters submitted by the requesting and producing party, and hash
list matching;
e) Expert will bundle all ESI collected from the searches and produce that EST 3
14L/~
in a 'review package' to the producing party for privilege review;
f) J\ review package is a software package that allows for the producing party
to view and mark files are either 'Confidential - Attorney Work Product',
'Confidential- Attorney Client Communication', 'Confidential- HIPAA' or
'For Release to Requesting Party' 'Confidential- IP." Additionally, the review
package allows the producing party to export from the review package a
privilege log in Microsoft Excel format.
g) The time period for fu1ishing the review will be thirty (30) days. Producing
party will send the log file expert creates by the review package of the expert
h) Expert, within 3 business days, will create a second review package with
only the ESI designated as 'Por Release to Requesting Party' and submit to
Producing patty for review and subsequent submission to the requesting party.
i) Witl1in 14 days of receipt of the second review package (g) the producing
party will submit the second review package and privilege log to the requesting
party and copy the expert for validation
k) Expert w.i ll validate that all ESI is accounted for and that if any files are
deemed privileged that may be marked inadvertentl)' the cxpc1:t will notify the
producing party and the producing party can either rectify the inadvertent
privilege designation or the expert can submit directly to the court for in
camera inspection under seal.
7) Search. All parties will submit to each other suggestions for
searching the ESI, that the parties believes in good faith will retnrn a reasonably
high proportion of responsive documents within 14 days of the signing of this
4
14L/~
agreement.
8) Inadvertent Failure to Designate. Inadvertent failure to designate any
document or material as containing Confidential Information will not constitute a waiver of an
otherwise valid claim of confidentiality pursuant to this Order, so long as a claim of
confidentiality is asse.rted within 30 days after discovery of the inadvertent failure.
9) Depositions. Deposition testimony o f expert will. be deemed confidential
only if designated as such when the deposition is taken or within a reasonable time period after
receipt of the deposition transcript. Such designation must be specific as to the portions of the
transcript and/ or any exhibits to be protected.
10) Protection of Confidential Material.
a) General Protections. Designated Confidential Information must be used or
disclosed solely for purposes of this lawsuit, including any appeals, [or any other
related legal proceeding brought by one of the parties to this litigation].
b) Who May View Designated Confidential Information. Except with the
prior written consent of the designating party or prior order of the cou1:t,
designated Confidential Information may not be disclosed to the following persons:
(1) The parties to tbis litigation, including any employees, agents,and
representatives of the parties;
(2) Counsel for the parties and employees and agents of counsel
(3) The court and court personnel, and members of the ju.ry;
(4) Cou.rt reporters, videographers engaged for depositions;
(5) Any mediator appointed by the court or jointly selected by the
parties;
5
14L/~
(6) Any expert witness, outside consultant, or investigator retained
specifically in connection with this litigation, but only after such
persons have completed the certification contained 111
Attachment A, Acknowledgment and Agreement to be Bound;
(7) Any potential, anticipated, or actual fact witness and his or her
counsel, but only to the extent such confidential documents or
information will assist the witness in recalling, relating, or
explaining facts or in testifying, and only after such persons have
completed the certification contained in Attachment A;
(8) The author or recipient of the document (not including a person
,vho received the document in the course of the litigation);
(9) lndependent providers of document reproduction, electronic
discovery, or other litigation services retained or employed
specifically in connection with this litigation; and
(10) Other persons only upon consent of the producing party and on
such conditions as the parties may agree.
( c) Control of Documents. The parties must take reasonable efforts to
prevent unauthorized or inadvertent disclosure of documents designated as
containing Confidential Information pursuant to the terms of this Order. Counsel
for the parties nrnst maintain a record of those persons, including employees of
counsel, who have reviewed or been given access to tlte documents along with the
originals of the forms signed by those persons acknowledging their obligations
under this Order.
6
ML/';I
11) Filing of Confidential Information. In the ev-cnt a party seeks to file any
document containing Confidential Information subject 10 protection under this Order
with the court, that party must take appropriate action to itlsure that the document receives
proper protection from public disclosure including: (a) filing a redacted document with the
consent of the party who designated the document as confidential; (b) where appropriate
(e.g., in relation to discovery and cvidentiary motions), submitting the document solely for in
camera review; or (c) when the preceding measures arc inadec1uate, seeking permission to
file the document under seal by filing a motion for leave to file under seal
[The mere designation of information as co,!fidential p111wn11t to the prolccli11e order provisions 111q;1 110/ be s1rffed1mt lo satt~/j, the comt's req11ircme11ts forjili11g ii 1111der seal i11 light of the p11hlic '.r q11aliji,ed right lo access to co11rt dockets. Beforejili11g 11 111otio11for lct1ve to.file 1mder sett/, the p(lrties sho11lrl consider other steps to pn!vent the 111meccssc1ry disclos11re co1!fide11tial i1!fom1alio11 i11 co111tflli11gs .mch as.flied redt1cted doc11111e11ts or other 1)1tam short offlh.11g 1111der serdJ
Nothing in this Order will be constrned as a prior directive to allow any document to be
filed under seal. The parties understand that the requested documents may be filed under seal only
with the permission of the court after proper motion. If the motion is granted and the requesting
party permitted to file the requested documents under seal, only counsel of record and
unrepresented parties will have access to the sealed documents. P,v hac vice attorneys [f m!Y, must
obtain scaled documents from local counsel.
12) Challenges to a Confidential Designation. The designation of any material or
document as Confidential Information is subject to challenge by any party. Before filing any
motion or objection to a confidential designation, the objecting part}' must meet and confer in
good faith to resolve the objection informally without judicial i11tctvention. A party that elects to
challenge a confidentiality designation may file and serve a motion that identifies the
challenged material and sets forth in detail the basis for the challenge. The burden of proving
7
lll-L /~
the necessity of a confidentiality designation remains with the party asserting confidentiality.
Until the court rules on the challenge, all parties n:rnst continue to treat the materials as
Confidential Information under the terms of this Order.
13) Use of Confidential Documents or Information at Trial or Hearing.
Nothing in this O rder will be consttucd to affect the use of any document, material, or
information at any trial or hearing. A party that intends to present or that anticipates that
another patty may present Confidential Information at a hearing or trial must bring that issue to the
attention of the court and the other parties without disclosing the Confidential Information.
The comt may thereafter make such ordets as are necessary to govern the use of such documents
or information at the bearing 01: trial.
14) Obligations on Conclusion ofLitigation.
(a) Order Remains in Effect. Unless othc1wise agreed or ordered, all
provisioi1s of this Order will remain in effect and continue to be binding after conclusion of
the litigation.
(b) Return of Confidential Documents. Within 90 days after this litigation
concludes by settlement, final judgment, or final order, includlng all appeals, all docnments
designated as containing Confidential Information, including copies as defined above,
must be returned to the party who previously produced the document unless: (1) the
document has been offered into evidence or filed without restriction as to disclosure; (2) the
parties agree to destruction of the document to the extent practicable in lieu of return? or (3)
as to documents bearing the notations, summations, or other mental impressions of the
receiving party, that party elects to destroy the documents and cc.1:tifies to the producing party
that it has done so.
8
14L/~
(c) Retention of Work Product. Notwithstanding the above requirements to
return or destroy documents, counsel may retain attorney work product, including a11
index which refers or relates to designated Confidential Information, so long as that work
product does not duplicate verbatim substantial portions of the text or images of
designated documents. This work product will continue to be confidential under this Order.
1\n attorney may use his or her own work product in subsequent litigation provided that its
use docs not disclose Confidcntiallnformation.
15) Order Subject to Modification. T his Order is subject to modification by the court
on its own motion or on motion of any party or any other person with standing concerning
the subject matter. The Order must not, however, be modified until the parties have been given
notice and an opportunity to be heard on the proposed modification.
16) Persons Bound by Protective Order. This Order will take effect when
entered and is binding upon all counsel of record and their law firms, the parties, and persons made
subject to this Order by its terms.
17) Jurisdiction. The court's jurisdiction to enforce the provisions of this Orcle.r will
terminate on the final disposition of this case. But a party may file a motion to seek leave to re
open the case to enforce the provisions of this Order.
18) Applicability to Parties Later Joined. ff additional persons or entities
become parties to th.is lawsuit, they must not be given access to any Confidential Information until
they execute and file with the court their written agreement to be bound by the provisions of
this Order.
19) Protections Extended to Third-Party's Confidet1tial Information. The
parties agree to extend the provisions of this Protective Order to Confidential Information
9
14LN
produced in this case by thit:d parties, if timely requested by the third party.
20) Confidential Information Subpoenaed or Ordered Produced in Other
Litigation. If a receiving party is served with a subpoena or an order issued in other litigation
that would compel disclosure of any material or document designated in this action as
Confidential Information, the receiving party must so notify the designating patty, in writing,
immedia tely and i11 no event more than three business days after receiving the subpoena or
order. Such notification must include a copy of the subpoena or court order.
The receiving party also must immediately inform in writing the party who caused the
subpoena or order to issue in the other litigation that some or all of the material covered by the
subpoena or order is the subject of this Order. In addition, the receiving party must deliver a
copy of this Order promptly to the patt)' in die other action that caused the subpoena to issue.
The purpose of imposing these duties is to alert the interested persons to the existence of
this O rder and to afford the designa ting party in this case an opportunity to try to protect its
Confidential Information in the court from which the subpoena or order issued. The designating
party bears the burden and the expense of seeking protection in tliat court of its Confidential
Information, and nothing in these provisions should be construed as authorizing or encouraging
a receiving party in this action to disobey a lawful directive from another court. T he obligations
set forth in this paragraph remain in effect while the party has i11 its possession, custody, or
control Confidential Information by the other party to this case.
21) Inadvertent Disclosure of Confidential Information Covered by Attomey
CHent Privilege or Work Product. T he inadvertent disclosure or production of any
information or docnmcnt that is subject to an objection on the basis of attorney-client
privilege ot: work-product protection, including, but not limited, to information or documents that
10
ML/~
may be considered Confidential Information under the Protective Order, will not be deemed to
waive a party's claim to its privileged or protected nature or estop that party or the privilege
holder from designating the information or document as attorney-client privileged or subject to
the work product doctrine at a later date. Any party receiving any such information or document
must return it upon request to the producing party. Upon receiving such a request as to specific
information or doctunents, the receiving party must return the information or documents to the
producing party within 30 days, regardless of whether the receiving party agrees with the claim of
pri,rilege and/ 01: work-p.coduct protection. Disclosure of the information or document by the
other party prior to such later designation will not be deemed a violation of the provisions of this
Order.
22) Protocol The fo llowing is the agreed upon protocol to determine if any of
Plaintiff's proprietary data has been transferred to other devices:
.A. The following questions are to be answered for each device:
1. What operating system is installed and what date was it installed (MFT File Date, Registry);
2. What USB Devices have been connected to the computer (Serial Number, Last Date Connected); and
3. Review Event Logs and PreFetch for evidence of anti forensic tool use.
n. Determi11c if spoliation of data has occurred;
1. Compute the amount of drive space that is written with a pattern such as all O's
or 1 's or pattern of characters/ numbers;
2. Search for keywords and if found extract the file containing the string of data
or bookmark and export the 100 words before and after keywords:
3. Search for evidence of anti-forensic tool use:
1 L
HL/~
C. Complete file carving for files for Microsoft Office and Portable Document Format (PDF) files:
D. After file recovery, attach a hash list to the case and then process drive again to fmd files that match the hashes provided and then bookmark any files matching. Create a report of the artifacts matching and export those files noting the MDS hash values in the report with metadata ..
IT IS SO ORDERED.
Dated:
Judge
WE SO MOVE AND AGREE TO THE TERMS OF THIS AGREEMENT
Signature Signature
Printed Name Printed Name
Counsel for: Counsel for:-------- --
Dated: Dated:
12
lLtL/'7
ATTACHMENT A
ACKNOWLEDGMENT AND
AGREEMENTTOBEBOUND
The undersigned hereby acknowledges that he/ she has read the Protective Order dated
_______ in the case captioned, , and
attached hereto, understands the terms thereof, and agrees to be bound by its terms. The
undersigned submits to the jurisdiction of the m
matters relating to this Protective Order and understands that the terms of the Protective Order
obligate him/her to use materials designated as Confidential Information in accordance with the
order solely for the purposes of the above-captioned action, and not to disclose any such Confidential
Information to any other person, firm, or concern, except in accordance with the provisions of the
Protective Order.
The undersigned acknowledges that violation of the Protective Order may result in penalties
for contempt of court.
Name:
Job Title:
Employer:
Business Address:
Date:
Signature