SmartPhone Forensics Hypothetical with Planet Data

SmartPhone discovery is heavily dependent on experts. What steps need to be done to ensure no data is lost? What are the best collection strategies? Can there be a targeted collection on BYOD devices? If not, how can data be reviewed?

Brad Berkshire and Russ Capps from Planet Data joined me for a podcast to discuss these issues and more. You can listen to the podcast on BuzzsproutiTunes, or the YouTube video.

Brad and Russ also discussed the following hypothetical, giving great insight on how to approach mobile forensics:

Executive at start-up uses personal cell phone for work. Receives work email and personal. Executive is an active texter, who communicates with her family by text and business partners.

Executive is sitting at a stoplight when sideswiped by another car. Other driver is at fault. She takes photos of the damaged cars. One is texted to her husband that she is ok, followed by an email from her personal account to her insurance agent with a photo of the damage. Executive also emails business partners to say she was hit by a car and will not be in the office.

What is your collection strategy to only acquire data relevant to the accident? How would you not collect company confidential information? How would you collect potentially privileged data protected by the spousal communication privilege?

Proportionality Prevents Mirror Imaging of Family Computers

The Defendants in employment litigation sought the mirror imaging of the Plaintiff’s personal computers three years after she had been terminated. The crux of the eDiscovery centered on the former employee forwarding emails from her supervisors email to her personal account, which the Defendants claimed were lost by the Plaintiff. The Court denied the motion to compel. Downs v. Va. Health Sys., 2014 U.S. Dist. LEXIS 74415, 6-11 (W.D. Va. June 2, 2014).

Young woman with a laptop on her head

Judge James G. Welsh did a very nice job of summarizing ESI relevant to a case, proportionality, and the rules for conducting forensic analysis on an opposing party’s hard drive. The Court held the following:

(1) Nothing in the record suggests any willful failure, fault or bad faith by the plaintiff on her discovery obligations that would justify the requested computer forensics examination;

(2) The “mirror-imaging” of the plaintiff’s family computers three years after her termination raises significant issues of confidentiality and privacy;

(3) There was no duty on the part of the plaintiff to preserve her family computers as evidence;

(4) Principles of proportionality direct that the requested discovery is not sufficiently important to warrant the potential burden or expense in this case; and

(5) On the current record that the defendants have failed to justify a broad, and frankly drastic, forensic computer examination of the plaintiff’s two family computers. 

Downs, at *9-10, referencing McCurdy Group v. Am. Biomedical Group, Inc., 9 Fed. Appx. 822, 831 (10th Cir, 2001); see also Basile Baumann Prost Cole & Assocs., Inc. v. BBP & Assocs. LLC, 2013 U.S. Dist. LEXIS 51264, *8 (DMd. Apr. 9, 2013).

Bow Tie Thoughts 

Conducting forensic analysis by an opposing party on personal computers is one of the most touchy subjects in eDiscovery. The United States Supreme Court drove home how much personal data can be on a smart phone, so that information only explodes on a personal computer. Tax records, vacation photos with children, and a host of other non-relevant or privileged information can be on a personal computer. The idea of a Court ordering the mirror imaging of personal computer by an opposing party is as invasive as ordering a physical examination of a party. It is not something done lightly.

I think it is part of a lawyer’s duty of competency to ensure relevant information on a client’s personal computers is preserved at the beginning of litigation. However, that does not mean that the entire contents would ever be produced, only what is relevant.

Targeted collections are one way to ensure ESI is preserved. There is also self-executing technology that can be used, as well as remote collections. I would avoid self-collection at all costs.

That being said, I would hold the line and fight against an opposing party that wanted to rummage through a personal hard drive without significant legal justification.

Forensically Examining A Lawyer’s Computer

In a dispute over a will and deed transfer, a New York State Court ordered the examination of a lawyer’s computer.

The idea of an attorney’s computer being searched by third parties should scare lawyers to death.

The attorney objected on the grounds the examination would violate the attorney-client privilege and work-product doctrine for all of the attorney’s other clients.

The Court was also concerned about privilege issues and ordered the following examination:

The computer forensic examiner was directed to review the computer only for documents that refer to Rose Tilimbo and it must not examine files which would not likely lead to the discovery of evidence related to Rose Tilimbo.

In the event the forensic examiner inadvertently examined any information that was not related to Rose it is directed to immediately cease the examination of that file.

In the event that forensic examiner located documents that refer directly to Rose Tilimbo or appear to be related to the purported will or the alleged deed transfer, those documents shall be mailed to the parties’ attorneys.

The attorneys would have 14 days from the receipt of documents to object to disclosure to the movants by notifying counsel for the movants that he is objecting and sending the documents to the court for an in camera inspection together with the reasons for the objection.

In the event that no objections are made to the production of the documents or the court rules that the documents are to be disclosed the computer forensic examiner may thereafter submit the documents to movants’ counsel.

Matter of Tilimbo v. Posimato, 2012 N.Y. Misc. LEXIS 4027, at *13-14 (N.Y. Sur. Ct. Aug. 22, 2012) (Emphases added).

Bow Tie Thoughts

It is very good to see a state court judge address the privilege issues of how to examine a lawyer’s computer.

If you ask three different computer forensic examiners how they would comply with the Court Order, you would probably have three different answers. The right approach will depend on how data is stored and multiple other factors best left to the experts.

One option is to make a “mirror image” of the computer and then search for responsive data. This is likely the least desirable for the attorney, because the entire contents of his computer have now been copied and are in the hands of a third-party. Short of a protective order and the computer experts acting as court-appointed neutral examiners who return or destroy the mirror image at the end of the examination, this is least desirable from an attorney’s perspective.

There is software available where the attorney could effectively self-collect his client files. While this might provide the most piece of mind to the attorney, it likely causes the most stress for the requesting party. It also raises issues of how searches were conducted and can easily cast doubt on the adequacy of the collection.

Another option is for a targeted collection of the attorney’s hard drive. This might take more time then doing a mirror image of the hard drive, but provides more piece of mind to the attorney. The collection is based on search terms devised by the computer forensic expert and attorneys to specifically identify the relevant information. This conceptually is a good middle ground approach to both preserve the parties’ interests and the confidentiality of the attorney’s clients.

Instead of the computer forensic examiner “mailing” documents to the attorneys, a hosted repository is an option the parties and court should consider. The producing party could first review the responsive information for any privileged ESI, creating all the necessary information for a privilege log right in the database. The requesting party could then perform its own review and note any challenges to any asserted privileges. The Court itself could then review the information “in camera” and rule on any privilege issues without protracted motion practice.