Opinion
No. C 11-2248 WHA (BZ)
11-03-2011
HENRY KLYCE and CAROLE KLYCE, Plaintiff(s), v. JOHN WHEELER, et al., Defendant(s).
ORDER RE FORENSIC INSPECTION PROTOCOL
This matter is currently scheduled for a settlement conference before me on November 17, 2011. Plaintiffs filed a motion to continue the settlement conference based in part on their representation that they needed more time to permit a forensic examination of Defendants' computers. (Docket No. 32.) I denied that request on the grounds that there was no reason given for why the forensic inspection could not take place prior to the scheduled settlement conference, particularly in light of the fact that Defendants appeared to be willing to permit the inspection to take place. (Docket No. 41.)
Plaintiffs have now filed a status report informing the court that the parties have not been able to reach agreement on an inspection protocol. (Docket No. 43.) In response, Defendants filed a brief stating that they have never agreed to a forensic examination, and that my finding that they had consented to a forensic examination was in error. (Docket No. 44 p. 2.) In fact, the basis for my statement that Defendants are not objecting to a forensic inspection is contained in the declaration of Chris Ridder, counsel for Defendants, filed in support of Defendants' opposition to Plaintiff's motion to continue the settlement conference (Docket No. 3 9.). There, Mr. Ridder states: "... Defendants have made substantial efforts to ensure that evidence is preserved ... at least counsel for Defendant Ellen Klyce secured Ms. Klyce's computers ... and is holding them, sequestered and unused, in counsel's office to prevent any spoliation or alteration of evidence until such time as they can be forensically imaged according to a protocol that Plaintiffs' counsel will agree to." (Docket No. 39 ¶ 13 (emphasis added).) I read this to mean that Defendants are prepared to permit forensic imaging of their computers.
Accordingly, I hereby ORDER that Defendants permit Plaintiffs to forensically image the hard drives of their respective computers according to the following protocol:
1. Defendants' counsel forthwith will produce the hard drives at its office to enable Winston Krone and Kivu Consulting, Inc. ("Kivu Consulting"), a forensic expert retained by Plaintiffs, to create an image of the hard drives.
2. Kivu Consulting shall make forensic mirror images of the hard drives and be permitted to verify the absence of duplication error by use of an MD5 Hash ("preliminary examination"). The imaging and preliminary examination shall not invade the contents of Defendants' private material on the hard drive, including personal correspondence and financial data.
3. The imaging and preliminary examination shall be conducted at the offices of defense counsel, unless Kivu Consulting concludes that it must be done at its offices. Defendants' counsel, or a representative of Defendants' counsel, and Defendants may be present for the entire imagining and preliminary examination of the hard drives.
4. After the images of the respective hard drives are created and the preliminary examination is complete, the original computers shall be promptly returned to Defendants and the imaged hard drives shall be sealed by Kivu and retained under seal by counsel for Defendants until by stipulation or by way of motion the parties arrange for further examination of the imaged hard drives for the purposes of this litigation or any appeal.
5. Kivu Consulting shall make no alterations to Defendants' computers and will conduct its preliminary examination upon the mirrored drives only.
6. Kivu Consulting's preliminary analysis shall be limited as follows:
a. Identifying deletions which may be indicative
of evidence destruction;
b. Determining when the computers were first and last used by each Defendant;
c. Determining when the subject computers were last formatted;
d. Determining whether any destructive programs, such as wiping or file erasure programs or utilities, were used on the subject computers or media;
e. Determining whether log-ins to Carole and Henry Klyce's email accounts originated from the subject computers.
7. Kivu Consulting's analysis shall be limited to ascertaining whether such evidence exists and shall not comprehensively identify all instances regarding the above-listed information. Should Plaintiffs desire to perform a more comprehensive analysis of the imaged hard drives, it shall do so only by way of stipulation or by further order of the court.
8. Kivu Consulting personnel will make no disclosures to Plaintiffs' counsel of any information or data found on the aforementioned computers other than the information listed above.
9. Defendants shall be entitled to learn of the results of the preliminary examination and whether Kivu Consulting found any information or data listed above on the imaged hard drives.
10. Kivu Consulting shall execute a formal confidentiality agreement memorializing its duties, rights and obligations consistent with the terms set forth in this order.
This protocol is modeled after the forensic inspection protocol issued by Judge Alsup in Case No. 07-1802, Docket No. 46.
Bernard Zimmerman
United States Magistrate Judge