Forensic Inspection of Computer Hard Drives Under New York Law

Mark Berman and Aaron Zerykier

New York Law Journal
09-01-2005


A computer's hard drive can reveal a wealth of information concerning the "hard copy" of materials printed out from a computer.

In addition to seeking an answer to the obvious question, i.e., "What responsive documents may have been deleted from a computer?," an examination of a hard drive, for example, may:

(i) reveal when materials were created, modified, accessed and/or deleted, who may have reviewed them, and to whom they were sent;

(ii) identify Internet sites viewed and materials downloaded, as well as when that occurred; and

(iii) provide information on whether the computer connected to an outside network, when such connection occurred, and what the computer user may have viewed and/or downloaded.

Discovery of Materials

The above information may lead to the discovery of materials evidencing, inter alia:

(i) a party or its counsel's failure to properly review the computer for relevant information,

(ii) "spoliation" or the deletion of responsive materials,

(iii) violation of a court order,

(iv) the "origin" and/or "history" of a document, which may evidence whether it was created contemporaneously with the underlying events and if, and when, it may have been modified,

(v) alleged "fabrication" of relevant documents,

(vi) compliance or lack of compliance with a document-retention policy,

(vii) the existence of a "contact" — perhaps significant in a litigation — between the computer user and particular individuals,

(viii) information contained on a computer, or sent to or accessed by a computer user, possibly illustrative of "notice" of a legally significant fact or event,

(ix) access to and/or copying of materials that may not have been authorized, or

(x) improper attempts to access a former employer's computer network.

A litigator should be precise in crafting a request for the inspection or the production of electronic documents or responses thereto, and should make use of all information his or her client may have about the location(s) or type(s) of computers, and the computer usage of the person that used the computer.

In the event of motion practice, it is virtually required to utilize a forensic computer expert to:

(i) provide a detailed explanation to the court of what information may be found on the hard drive,

(ii) advise of potential problems there may be with the actual production of the electronic materials,

(iii) develop procedures for retrieving and/or analyzing the information, including ensuring the integrity of the "mirroring" or hard drive copying process and appropriately addressing possible access to confidential, irrelevant or privileged materials,

(iv) rebut arguments by the requesting party's expert, and

(v) determine the cost of retrieving and analyzing such information.1

In fact, while there is often little doubt that some relevant material may be found on a computer's hard drive, it is incumbent on the requesting party, because of the intrusiveness, burden and the expense associated with a hard-drive review, to convince the court that such a review is truly necessary.

As the decisions below suggest, a litigator may need to make a significant proffer of what such a review would uncover, and the likelihood of success on such a motion would increase when supported by an expert or client affidavit. Similarly, the cases suggest that it is detrimental not to contest such a motion without appropriate reply affidavits.

'Mirroring' a Computer's Hard Drive

Once a court is convinced that a hard drive should be reviewed, in a simple case, the court may order that the moving party's expert "mirror" the computer's hard drive or, alternatively, that the parties jointly agree on an expert to perform this task, and then have the expert identify and segregate the materials the court determined should be produced and provided to the parties. In a more complex matter, in addition to having an expert makes copies of the hard drive, the judge or referee may require that it be provided with a report, as well as physical print outs of specified materials. Depending on the case, each side may need to hire their own expert to contest the "independent" expert's analysis or to analyze the hard drive to develop the evidence derived therefrom for use during the litigation.

When an agreed-upon or court-appointed expert is used to examine a hard drive, if not already directed by the court, the party requesting the inspection should endeavor to have the court require the expert to provide the parties with a written report. This is because, inter alia, the court's review of the "hard copy" of materials produced may not provide it with the information needed to make its determinations, as the nuances of the computer issues may not all be self-evident. The report may also provide the requesting party with a basis to have the court revisit the inspection.

New York Precedent

The limited New York precedent addressing an inspection or review of information contained on a computer hard drive is summarized below. What can be gleaned from these decisions is that courts are concerned about burden and will not order a wholesale turnover of a computer hard drive. They will impose limitations to address potential "fishing" expeditions, privacy concerns as they relate to irrelevant materials, disclosure of competitive materials to ensure that such materials will not be misused, materials protected by the attorney-client privilege, work product immunity doctrine or other privileges, and inconvenience to a non-party owner of a computer. In addition, a court may require a representation that the party requesting the inspection, consistent with New York law, will pay for the costs of the production or review of the hard drive.

In Gross v. New York Law School, Index No. 600064/03 (N.Y. Sup. Ct. April 6, 2005), plaintiff, in an alleged unlawful employment termination case, sought to search a defendant's hard drive for deleted e-mails. The court found that the documents requested were relevant, but denied the motion without prejudice, subject to renewal upon presentation with, inter alia, a "detailed showing by a computer specialist as to the procedures for and costs of recovering the e-mails" and a "statement as to whether plaintiff is willing to bear such costs." Id. at 2.

In Etzion v. Etzion, 7 Misc3d 940, 796 NYS2d 844 (Nassau Sup. Ct. 2005), a matrimonial action, where certain discovery sought information from a husband relating to alleged familial assets, plaintiff wife sought an order permitting plaintiff to "'impound, clone and inspect [defendant's] computer servers, hard drives, individual workstation PC, laptops and other items containing digital data,' . . . directing that [p]laintiff and her computer forensic experts 'gain access' to certain computer equipment, . . . [and] directing that [d]efendant 'cease the rotation, alteration and/or destruction of electronic media that would result in the inability to recover the sought [after] computer data regarding all actual and potential business interests involving the Defendant.'" Id., at *1.

Defendant objected to the request contending that, inter alia, it was overbroad, intrusive, burdensome and that it would result in the disclosure of irrelevant, proprietary and privileged materials.

The court in Etzion granted plaintiff's motion, in part, with certain limitations imposed to protect defendant's privileged and nonrelevant materials. The court ordered that defendant was to disclose the location of his computer hard drives. The court directed that plaintiff's appointed expert, accompanied by defendant's expert and the court referee, go to such locations and that "[p]laintiff's expert shall clone or copy the hard drives of such computers. The resultant hard drive shall be immediately turned over to the Referee." Id., at *4. In addition, the court ordered that "[a]t a location jointly selected by the computer experts of each of the parties, the hard drives shall be examined" and that "hard copies" be made of any materials that the court permitted production of and copies distributed to counsel. Id. The court did not permit copying or transmission of personal records, e-mails or other correspondence between defendant and third parties and defendant and counsel.

'News America v. Fine'

In News America Marketing FSI, Inc. v. Fine, Index No. 602443/02 (N.Y. Sup. Ct. Jan. 27, 2005), a former employee, who allegedly established a competing business while he worked for his former employer, was sued by such employer for, inter alia, breach of fiduciary duty, unfair competition, tortious interference and breach of contract. Defendant sought a protective order on privilege grounds with respect to plaintiff's request for an "'inspection of data, records and files' stored on any computer system maintained by defendant." Id. at 5. Plaintiff contended that the documents sought constituted or referred to communications between defendant and named businesses that were all clients of plaintiff, and that defendant, when employed by plaintiff, had been assigned and responsible to serve some of them. Plaintiff sought permission to have an expert "mirror image" the hard drives "for the purpose of recovering deleted computer files or for an in camera inspection by the court." Id. at 6-7.

The court denied defendant's motion for a protective order, and directed that "hard drives of [defendant's] computer laptop computer [be submitted] to a forensic expert, mutually agreed upon by the parties, for duplication and submitted to the court for an in camera inspection." Id. at 7. The court also directed that the allegedly privileged materials be submitted for an in camera review and that the "data contained in the hard-drives must be submitted [to the court] in 'hard-copy' or paper form." Id. at 7 n. 5.

'Goldman . . . v. Maloney'

In Goldman & Goldman v. Maloney, Index No. 115929/03 (N.Y. Sup. Ct. April 21, 2004), an action between law firms alleging breach of alleged fee-sharing agreements, the court found that defendants had not set forth sufficient cause to grant them access to plaintiffs' hard drive. Defendant had claimed that a certain document had been fabricated, and therefore sought access "to verify the accuracy and/or veracity of the contents" of the hard drives and other storage medium. Id. at 7. The court, noting the lack of New York precedent, relied on a 1996 circuit court decision requiring a proffer of "evidence in support of the alleged fabrication sufficient to survive rigorous judicial scrutiny." Id. at 8. The court found that defendants' access "would merely foster a fishing expedition." Id. at 9.

In Samide v. Roman Catholic Diocese of Brooklyn, 5 AD3d 463, 773 NYS2d 116 (2nd Dept. 2004), the Appellate Division modified the trial court's order requiring defendants "to produce the contents of the hard drives of their computers for an in camera review" with an order directing "defendants to produce hard copies of all their e-mails relating to allegations against [a certain individual] including any e-mails that have been deleted but may be recoverable by a qualified expert appointed by the referee supervising disclosure for in camera inspection by the referee and a determination of which e-mails relate to allegations against [such individual]." Id. at 465. The court further ruled that relevant e-mails should be provided to plaintiff as "they may be relevant to the question of defendant's awareness of such individual's malfeasance." Id. at 465-66.

The 'Repalone' Case

In Repalone v. St John's Episcopal Hosp., Index No. 15338/99 (Suffolk Sup. Ct. Nov. 12, 2003), the court permitted plaintiff's expert to conduct a forensic inspection of the home computer of a nonparty for the limited purpose of ascertaining the dates on which any documents or files pertaining to plaintiff were created on behalf of or at the direction of one of the defendant doctors, including a certain particular "progress note." Id. at 2. The court directed that the inspection take place at the home of the nonparty. Counsel for all parties and the nonparty were permitted to attend and the inspection was to be conducted by plaintiff's expert. The court stated that the inspection was to be "limited to such acts as are enumerated" in the expert's affidavit and that "no other files or folders contained on the computer's hard drive [were to] be accessed." Id.

Mark A. Berman is a partner of Ganfer & Shore. Aaron Zerykier is an associate at the firm.

Endnotes:

1. The allocation of e-discovery costs was the subject of our article entitled "E-Discovery in New York State" published in The New York Law Journal on June 22, 2005.