Rummaging Through the Electronic File Cabinet: Ohio Courts Consider Forensic Imaging of Computers.

By Attorney Gregory R. Farkas, Frantz Ward LLP

The expense and potential pitfalls of electronic discovery have now been well documented. Courts and legislatures have struggled to balance the general policy in favor of broad discovery of factual information against the burden electronic discovery can impose. One aspect of electronic discovery where these competing concerns are especially challenging is requests to forensically examine an opposing party’s computer. Two recent Ohio appellate opinions, Bennett v. Martin (10th App. Dist. Nov. 24, 2009), 2009-Ohio-6195 (“Bennett”), and Cornwell v. Northern Ohio Surgical Ctr., Ltd. (6th App. Dist. Dec. 31, 2009), 2009-Ohio-6975 (“Cornwell”), provide the first detailed Ohio appellate guidance on when such examinations are proper and how they should be conducted.
What is Forensic Imaging?

Forensic imaging or “mirror imaging” has been defined as “a forensic duplicate, which replicates bit for bit, sector by sector, all allocated and unallocated space, including slack space on a computer hard drive." Balboa Threadworks, Inc. v. Stucky, 2006 U.S. Dist. LEXIS 29265 at *3 (D. Kan. March 24, 2006). In other words, it makes an identical copy of all electronic information stored on the computer. This allows the party making the image to review all information contained on the computer, potentially including deleted files and messages. Because of the amount of information contained on a forensic image, a request for such an image has been compared to a request to rummage through your client’s file cabinets. See Steve Puiszis, An “Old School” Approach to Requests for Electronic Imaging of Computers (October 5, 2009), available at http://forthedefense.org/post/An-e2809cold-schoole2809d-approach-to-requests-for-forensic-imaging-of-computers.aspx.

When is Forensic Imaging Appropriate?

The intrusive nature of forensic imaging is recognized in the Advisory Committee Note to Fed. R. Civ. P. 34(a), which cautions that "[c]ourts should guard against undue intrusiveness resulting from inspecting or testing [electronic information] systems." Consistent with this caution, federal courts have generally allowed forensic imaging of computer systems only where there is evidence that a party’s production of electronic information was incomplete or that electronic information may have been lost or destroyed. See, e.g., Carrie v. Goetz, 531 F.3d 448, 460 (6th Cir. 2008) (explaining forensic examination should not be permitted automatically but must be allowed only based on facts and circumstances of individual case); McCurdy Grp., LLC v. Am. Biomedical Grp., Inc., 9 F. App’x 822, 831 (10th Cir. 2001); Scotts Co. v. Liberty Mut. Ins. Co., 2007 U.S. Dist. LEXIS 43005 (S.D. Ohio June 12, 2007); Henderson v. U.S. Bank, N.A., 2009 U.S. Dist. LEXIS 40968 (E.D. Wis. Apr. 29, 2009); Diepenhurst v. City of Battle Creek, 2006 U.S. Dist. LEXIS 48551 (W.D. Mich. June 30, 2006). State court decisions considering such requests have generally followed suit. See, e.g., In re Weekley Homes, L.P., 295 S.W. 3d 309, 319 (Tex. 2009) (discussing production of forensic images under Texas Rules of Civil Procedure and applying federal case law in determining search was not appropriate).

While the Staff Notes to Ohio Civil Rule 34 do not contain the same caution language as the Federal Advisory Committee Note, the Bennett and Cromwell decisions applied federal precedent in determining whether forensic imaging was appropriate. In Bennett, the Tenth District held that the trial court’s finding that the party from whom discovery was sought had “repeatedly represented that they had disclosed all responsive documents when they had not” and the party’s “lackadaisical and dilatory approach to providing discovery” justified ordering forensic imaging. 2009-Ohio-6195 at ¶47-48.

Similarly, in Cornwell there were allegations that specific language appearing in a letter, but not in a medical note, may have been deleted from the electronic copy of the note. 2009-Ohio-6975 at ¶35. There were also questions about whether the computer at issue had been infected with viruses and was operating properly and the plaintiffs had pled a claim for spoliation of evidence claim. Id. at ¶35-36. The Sixth District agreed with the trial court that, taken together, these circumstances warranted review of a forensic image of the computer in question. Id.

While Cromwell appears to be correctly decided on its facts, the reference to spoliation should not be read overly broadly to allow unsupported allegations of spoliation to trigger an obligation to produce forensic images. Cf. State v. Rivas, 121 Ohio St. 3d 469, 2009-Ohio-861 at ¶15-16 (explaining the need to provide some evidence of spoliation before forensic examination of computers is appropriate in criminal cases); Covad Communications Co. v. Revonet, Inc., 258 F.R.D. 5, 13-14 (D.D.C. 2009) (explaining that most electronic productions will contain apparent gaps due to the nature of electronic documents and that more than allegation or suspicion of improper conduct is required before forensic examination will be required); Superior Prod. Partnership v. Gordon Auto Body Parts Co., Ltd., No. 06-CV-916, 2009 U.S. Dist. LEXIS 25890 at *2-3 (S.D. Ohio Mar. 12, 2009) (refusing to allow forensic search as a sanction for discovery misconduct where party seeking exam had not provided any evidence that relevant e-mails had been lost or destroyed by inadequate litigation hold); Balfour Beatty Rail Inc., 2007 U.S. Dist. LEXIS 43005 at *6 (M.D. Fla. Jan. 18, 2007); Powers v. Thomas M. Cooley Law Sch., 2006 U.S. Dist. LEXIS 67706 at *14 (W.D. Mich. Sept. 21, 2006).

What Do You Do About Privileged or Confidential Information?

In addition to the threshold issue of whether forensic imaging was appropriate, both the Bennett and Cornwell decisions also addressed the protocol for the forensic imaging process. Given the nature and amount of information that can be disclosed through the review of a forensic image, courts have held that a detailed protocol explaining how the review will be conducted is required See, e.g., In re Weekley Homes, 295 S.W.3d at 318 (explaining that only qualified expert, rather than parties themselves, should be allowed access to image, that search terms or other limitations on review should be agreed to beforehand, and that “privilege, privacy and confidentiality” concerns must be addressed).

In Bennett, the Tenth District found that while forensic imaging was appropriate, the trial court abused its discretion in ordering production of the forensic image without entering a detailed protocol that explained how the image would be used and searched. 2009-Ohio-6195 at ¶48. The Tenth District found that the trial court’s order was inadequate despite containing a provision for redaction of privileged information by the producing party. Id. The appellate court remanded the case and urged the trial court to adopt a protocol that would limit review of the forensic image to relevant information and protect personal information from disclosure. Id.

In Cornwell, crafting an appropriate protocol was complicated by the fact the computer at issue contained privileged medical records of patients who were not parties to the case. 2009-Ohio-6975 at ¶24. Because the computer contained privileged record, the parties resisting production claimed that any review of the forensic image could subject them to liability under Biddle v. Warren Gen Hosp. (1999), 86 Ohio St. 3d 395, 1999-Ohio-115. Id. at ¶27. The Sixth District recognized the validity of these concerns, but held that the proposed protocol adequately addressed them.

Specifically, the court noted that the expert retained to make the image would not be reviewing the actual content of the files, but rather would be searching for key words approved by the court and looking at file log and registry information that would not contain the substance of patients’ medical information. Id. at ¶25-26. The court also recognized that the proposed protocol allowed the producing party to review the list of files identified through the searches and submit a privilege log to the court before the substance of any of the files was disclosed. Id. at ¶29. Despite the sensitivity of the information at issue, the Sixth District found that these safeguards were sufficient to allow the forensic imaging.

Bennett and Cornwell are clear that development of a detailed protocol explaining how the forensic image will be made and searched is an essential component of any request for such information. The protocol must take into account the likelihood that privileged, confidential or irrelevant personal information may be uncovered during the search process and explain in detail how such information will be protected. Also, as in many other areas of electronic discovery, cooperation between the parties in developing such a protocol may lower costs and reduce the risks and burdens for everyone. See, e.g., The Sedona Conference Cooperation Proclamation (2008), available at http://www.thesedonaconference.org/dltForm?did=proclamation.pdf.


Conclusion

Bennett and Cornwell are the first Ohio appellate opinions that contain detailed guidance on when forensic imaging of computers may be appropriate. Consistent with the old saying that “pigs get fed and hogs get slaughtered,” the decisions make clear that automatic and broad requests for forensic imaging are not the best way to obtain such data. Rather, a party should lay the necessary groundwork for such a request either through pre-suit investigation or other discovery and narrowly tailor the request to avoid “fishing expedition” and privilege objections. Parties faced with broad and unsupported claims for forensic imaging can rely on Bennett and Cornwell as persuasive authority that such requests are improper.

For more information, contact Gregory R. Farkas, Frantz Ward LLP, 2500 Key Center, 127 Public Square, Cleveland, OH 44114, 216-515-1635 gfarkas@frantzward.com

Editor's Note: This article is provided for the professional education of attorney and judges in Ohio. It does not necessarily reflect the opinions of Judge James L. Kimbler.