‘Nuff Said on Imaging a Laptop

A Plaintiff sought the forensic image of a laptop after the producing party collected the responsive data and placed it on a thumb drive.  Magistrate Judge Nuffer denied the motion. Hansen v. Chevron USA, Inc., 2011 U.S. Dist. LEXIS 58488 (D. Utah May 31, 2011).

In the course of discovery, the Defendant stated in correspondence that a specific individual’s laptop is “where any relevant ESI would be stored.” Hansen, at *2.

The specific individual’s practice was to “print out hard copies of important e-mails in order to preserve the information in the appropriate paper files.” Hansen, at *2.  From the tone of the opinion, the laptop sounded like a personal laptop and the individual possibly a contractor, but the opinion is not specific.

The Plaintiff sought the Defendant to produce the individual’s laptop for an “independent, third-party forensic company, to perform an image copy, or flash image, of the hard drive for indexing, and later harvesting of relevant, non-privileged, information. . . .”  Hansen, at *2.

The Defendant opposed the plan, first challenging the Plaintiffs to show a deficiency in the paper document production and second proposing the individual go through his laptop and transfer relevant files to a thumb drive. Hansen, at *2-3.

The laptop contained propriety, confidential information concerning the Defendant and personal information from the individual, such as social security numbers and credit card information. Hansen, at *3-4.

The Defendant “loaded” the ESI from the laptop to the hard drive regarding the subject matter of the case.  The ESI included searchable ESI and PDF’s.  Hansen, at *3.

The Plaintiffs refused the thumb drive. Hansen, at *3.

The Court swiftly balanced the Federal Rule of Civil Procedure Rule 26(b)(2)(C) limiting factors in favor of the Defendants against forensically imaging the laptop.  The Court noted that the Plaintiffs did not explain their need for the forensic (byte by byte) image of the laptop, other than they “needed” it.  Hansen, at *5.  Coupling the fact the Plaintiff had not reviewed the thumb drive against the fact the laptop contained privileged information, the Court spent little time denying the Plaintiff’s motion. Id.

Bow Tie Thoughts

I am a strong supporter of target collections with portable devices.  In cases where a personal laptop is at issue involving family law to third-party contractors, it is an excellent way to save both time and money in collecting data.  Moreover, it can allow a party to collect directly folders or relevant files while avoiding a private individual’s life from being put on display for legal teams.

No one likes the idea of their tax information, credit card numbers, personal photos and private emails being harvested and reviewed by anyone, even if it their lawyer designating them “non-responsive” or “privileged.”  It is still an invasion.

However, I know many of my friends who are experts in data collection, and normally stoic former law enforcement, whose blood pressure must have skyrocketed at by idea of someone simply copying files over to a thumb drive.

There are numerous problems with this practice, from underlying metadata being changed to the lack of MD5 hash values and a long list of other issues that can fill an expert report.

With that said, there are targeted collection tools available that can provide far greater defensibility than simply copying data to a thumb drive. PinPoint Labs was one of the early proponents of this technology; Access Data Triage is one solution for creating a self-executing collection script on a thumb drive; Guidance EnCase Portable another; Microforensics Titan Collector is one option, as is Nuix Collector Portable.

Fact of the matter is, there are portable collection technologies on the market that can be configured by an expert to collect ESI based on search criteria and generate MD5 hash values and executed by a custodian who signs an affidavit that they used it correctly. A lawyer can then argue such a process created a reasonable, proportional and defensible collection methodology in Court.

The use of portable collection technologically is critical in State Court litigation, such as family law or unlawful detainer cases where cost is an issue.  However, parties should avoid the “fox guarding the hen house” situation of individuals self-selecting ESI without an attorney’s supervision or direction.  There might be situations where a single party has a handful of files and folders where proportionality favors that the data simply be defensibly copied by the individual, but that would highly fact specific.

The technology currently on the market can be prepared in advance for collection, given to a custodian for data acquisition, with affidavits then executed by the expert who prepared the collection device and the custodian who activated it. In short, every step needs to be documented with the mindset a Court may ultimately review the process.

I truly hope to see an opinion similar to this one validating the use of any of the portable collection devices in a lawsuit, whether it is in State or Federal court.  Not all litigants are Titans battling over patents; Portable devices that can collect targeted electronically stored information are necessary for the mere mortals involved in over 90% of litigation in the United States.

2 thoughts on “‘Nuff Said on Imaging a Laptop

  1. Pingback: Hansen v. Chevron USA, Inc: Targeted Forensic Collections » Scope 2.0 - a new perspective

  2. Pingback: The July 23rd weekend edition of the “Top 20 … plus more” – a compendium of e-discovery articles, vendor news and upcoming events | The Electronic Discovery Reading Room

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s