Electronic Discovery and Computer Forensics Case List - Kroll Ontrack

expense in restoring and searching the tapes in light of their largely irrelevant content. Thus, the
court ordered the defendants to produce copies of all ESI from the backup tapes for the plaintiff to
review, dismissing the plaintiff’s arguments that this constituted a document dump. The court also
ordered the defendants to produce user logs for 135 hard drives to determine which one (if any)
belonged to a particular defendant. Both the production of the backup tapes and hard drive were
subject to a Fed.R.Civ.P. 502(d) order.
Oklahoma
� Calixto v. Watson Bowman Acme Corp., 2009 WL 3823390 (S.D. Fla. Nov. 16, 2009). In this
tortious interference of a contract suit, the plaintiff alleged the defendant "spoliated electronic
documents in the face of ongoing litigation." As such, the plaintiff sought an order requiring the
defendant to obtain and fund a restoration and search of its 37 backup tapes. The defendant
argued the backup tapes were not reasonably accessible and that no further relevant evidence
existed on the tapes as a litigation hold was in effect. Finding the plaintiff failed to establish a
reasonable expectation that the benefit of restoring the backup tapes would outweigh the burden,
the court declined to impose the significant costs to restore, search and review the tapes on the
defendant. The court also declined to impose sanctions because no bad faith existed regarding the
defendant’s IT employee’s deletion of an e-mail box as part of a regular practice. However, the
court concluded one of the backup tapes may contain discoverable records because it was unclear
when the e-mail box deletion occurred and ordered the tape’s restoration and search.
� Joseph Oat Holdings, Inc. v. RCM Digesters, Inc., 2009 WL 3334868 (D.N.J. Oct. 14, 2009). In
this business dispute, the defendants alleged the plaintiffs copied the defendants’ computer files in
violation of the Computer Data Access and Fraud Act (CDAFA). Prior to the joint venture
termination, the plaintiffs’ computers were connected to the defendants’ server via a virtual private
network. After the joint venture ceased, the plaintiffs copied approximately 152,000 documents,
including proprietary business information, contained on the defendants’ server in an act the court
labeled "brazen and surreptitious." The plaintiffs claimed the defendants knew access to the joint
system existed, were concerned the defendants would destroy relevant information on the network
and that the defendants’ litigation hold letter required them to preserve all documents within their
possession or control. Finding the plaintiffs’ "clandestine copying of computer files" was not
performed purely for e-discovery purposes, the court determined the copying of files created after
the joint venture dissolved was a clear violation of the CDAFA. Accordingly, the court granted the
defendants’ motion for partial summary judgment.
� United States v. Haymond, 2009 WL 3029592 (N.D. Okla. Sept. 16, 2009). In this criminal case,
the defendant renewed his request for access to unlawful images allegedly contained on his
computer that were seized by the government. The defendant argued the hard drive was "stripped"
of metadata prior to the mirror image creation, which prevented him from preparing a forensic
defense. The defendant also requested redacted copies of the images to support subpoenas to the
Web sites where the images originated. Relying upon the defendant’s expert’s testimony that he
was "99.99-percent sure" no metadata would be located, the court found no basis for the
defendant’s claim that metadata had been "stripped." The court further ordered the defendant to
identify the images with embedded Web site information in advance of trial, at which point the
government is to prepare redacted images for the defendant’s use in conjunction with the
subpoenas.
281