Opinion
Civil Action No.: 06-cv-02206-JLK.
July 18, 2008
ORDER
The Joint Motion to Amend the Scheduling and Discovery Order (doc. #72), filed July 16, 2008, is GRANTED, and the Stipulated Scheduling and Discovery Order is amended as follows:
1. Plaintiffs' expert (anticipated to be David Penrod) shall appear at Defendants' counsel's office on July 31 and August 1, 2008 and may bring a computer and external hard drive for a forensic examination of certain media specified below.
2. The exam may be attended by Plaintiffs' counsel and Defendants' counsel and experts.
3. The forensic images of the four drives created by GC Partners and identified in the November 7, 2007 report by Raphael Gorgal will be copied to the Plaintiffs' expert's computer and/or an external hard drive. At least 48 hours prior to the exam, the Defendants will cause GC Partners or its representative to verify under oath that these forensic images contain and are a complete physical-level forensic bit-stream image of every bit of data from each of the four drives identified in the November 7, 2007 Gorgal report, namely SSF-1-1, SSF-1-2, SSF-1-4 and SSF-1-5. Within 48 hours after the exam, Defendants' counsel or GC Partners' representative will verify under oath that the forensic images produced at the exam were in fact those images identified in the November 7, 2007 Gorgal report.
4. At the exam, Plaintiffs' expert may examine the copied forensic images on or through his computer. He may search for and examine files from secure deletion software. He may examine the registry, event logs, internet history, link files, index buffer of folders and unallocated space, and he may examine any and all system generated files from the images. He may not examine user generated data from the images except as required to examine these aforementioned items.
5. At the conclusion of the exam, Plaintiffs' expert will leave the computer and/or hard drive (whichever contains the copies of the forensic images) with Defendants' counsel, who will keep the computer and/or hard drive in a safe, secure and fireproof environment, until such time as the parties agree that the computer and/or hard drive shall be returned to Plaintiffs. The computer and/or hard drive will not be returned to Plaintiffs until the copied images are wiped therefrom. Wiping shall be conducted by Plaintiffs' expert at an agreed upon date and may be observed by Defendants' counsel and experts. The parties will accommodate a process that allows verification of wiping by Defendants' expert without requiring such person to be physically present in Denver for such verification.
6. After the exam is complete, the computer and/or hard drive shall be retained by Defendants' counsel but neither shall be password accessible by anyone other than Plaintiffs' expert and neither shall be physically accessible by any person other than Defendants' counsel.
7. If as part of the exam certain user generated files are identified or recovered other than those which are part of the exam as stated above, which files are requested to be examined by Plaintiffs, those files shall be turned over to Defendants' counsel by Plaintiffs' expert (or, if necessary, by Defendants' own expert), and those files shall be reviewed for privilege and then promptly turned over to Plaintiffs. If any files are withheld, contemporaneously with such withholding the Defendants shall produce a privilege log to Plaintiffs. If there is further production or disclosure to be made of such user generated files, and thus which may require privilege analysis by Defendants' counsel, and which affect the deadlines set forth herein, the parties shall cooperate and consult the Court for further direction or amendment of the scheduling deadlines.
8. Plaintiffs' expert shall be allowed to remove from the exam all of his exam results, which are anticipated to be generated through programs called Forensic Toolkit and Encase. Prior to leaving the exam, he shall provide an exact digital copy of the exam results to Defendants' expert on media provided by Defendants' expert.
9. No later than August 11, 2008, Plaintiffs shall be allowed to supplement their expert disclosures solely relating to the computer forensic examination. No later than August 21, 2008, Defendants may provide any rebuttal disclosures. Expert depositions and depositions of Mr. Seibert and his adult family members, as set forth below, shall be completed no later than September 5, 2008.
10. Defendant Siebert shall appear for deposition no later than September 5, 2008. Defendants shall use their best efforts to present Mrs. Seibert and her now adult children who lived in the Seibert home at any time during 2005, 2006 or 2007 for deposition in Denver (Mrs. Seibert may appear telephonically) no later than September 5, 2008. For any witnesses who will not cooperate in scheduling, the parties will use their best efforts and cooperate to cause such witness to appear for deposition. Such deposition examination shall be limited to questions relating to Seibert home computers and usage, including installation and deletion of wiping software on such computers and deletion of files on such computers, including the deletion of files referenced in Mr. Gorgal's June 26, 2008 report. The parties intend to complete such depositions in a single day.
11. Plaintiffs' response to Defendants' motion for summary judgment shall be due September 12, 2008.
12. No later than August 6, 2008, Defendants (i) shall produce a privilege log to Plaintiffs for any files in the case which have been withheld from production, and (ii) shall identify, by category or type, the sources of ESI containing potentially responsive information that have not been searched or produced by Defendants.
13. The pending motions by Plaintiffs, Plaintiffs' Motion to Compel Production and Inspection of Certain Electronically Stored Information (doc #66), Plaintiffs' Twelfth Motion to Amend the Scheduling and Discovery Order (doc. #69), and Plaintiffs' Motion to Continue Response to Defendants' Motion for Summary Judgment (doc. #67) are denied as moot.