Forensic Imaging of Computer

Forensic Imaging of Computer Hard Drive Ordered by the Court: eDiscovery Case Law

It’s eDiscovery case law day! In Goodloe Marine, Inc. v. B.C. Towing, Inc., No. 8:20-cv-679-JLB-AAS (M.D. Fla. March 7, 2022), Florida Magistrate Judge Amanda Arnold Sansone, due to the inaccessibility of towing logs and other data on the computer hard drive of plaintiff Caillou Island Towing Company, ordered Caillou to allow forensic imaging of that computer hard drive.

Case Discussion

In this dispute over tugboat towing services where the tow sank and there were claims and counterclaims related to the accident, the court granted in part a motion to compel in September 2021 and ordered Caillou to produce documents related to the tug’s towing logs and limiting the production to the past three years. The order noted Caillou agreed to allow Third-Party Defendant RJA Limited ‘s IT expert onboard the tug to extract the electronic charts for the voyage in question from the Rose Point Compass system.

OpenText

The inspection of the Rose Point system, the logbooks, and the tug was scheduled for November 11, 2021. After Caillou advised they would confirm the size of the hard drive on the computer but failed to do so, the inspection was rescheduled for November 29-30, 2021. During exchanges between opposing counsel, RJA discovered certain data on the Rose Point system was no longer readily accessible. According to RJA’s expert, to uncover the data, the computer hard drive must be “mirror imaged.” But Caillou cancelled the inspection, stating it could not allow the tug’s hard drive to be mirror imaged without consulting its IT expert to determine if there were other ways to obtain the information. According to RJA, Caillou failed to provide an alternative date for the inspection or alternative procedures for obtaining the deleted data, leading to a motion to compel by RJA.

Judge’s Ruling

Judge Sansone, in considering the motion, stated: “Electronically stored information is discoverable under Fed. R. Civ. P. 34(a). Courts have also held that deleted or not readily accessible computer files are still discoverable… When files are deleted or overwritten, a forensic image, otherwise known as a ‘mirror image’ will “replicate bit for bit sector for sector, all allocated and unallocated space, including slack space, on a computer hard drive… A mirror image ‘contains all the information in the computer, including embedded, residual, and deleted data.’… Before compelling such imaging the court must weigh inherent privacy concerns against its utility…The court should consider ‘whether the responding party has withheld requested information, whether the responding party is unable or unwilling to search for the requested information, and the extent to which the responding party has complied with discovery requests.’”

In this case, Judge Sansone stated: “As noted in the court’s September 2021 order, Caillou agreed to allow RJA’s expert on board the tug to extract the Rose Point electronic chart for the subject voyage…The court then ordered production of the tug’s original tow logs and the parties scheduled the inspection…Caillou failed to allow RJA access to the tug and its computer to review the original logbooks and the Rose Point system data. Now that it was discovered that information on the Rose Point system is no longer readily accessible, Caillou objects to RJA obtaining that information by creating a mirror image of the computer hard drive. Although Caillou’s response suggests there may be other ways of obtaining this information, it appears no effort has been made by Caillou to do so. Given the failure by Caillou to provide RJA access to the electronic chart and tow logs, an order compelling the disclosure and allowing the parties access to the tug is necessary.” As a result, Judge Sansone granted the motion and ordered Caillou to allow forensic imaging of the computer hard drive.

OpenText

So, what do you think? Should the court have permitted forensic imaging of the computer hard drive or was that premature?  Please share any comments you might have or if you’d like to know more about a particular topic.

Case opinion link courtesy of eDiscovery Assistant, an Affinity partner of eDiscovery Today.

Disclaimer: The views represented herein are exclusively the views of the author, and do not necessarily represent the views held by my employer, my partners or my clients. eDiscovery Today is made available solely for educational purposes to provide general information about general eDiscovery principles and not to provide specific legal advice applicable to any particular circumstance. eDiscovery Today should not be used as a substitute for competent legal advice from a lawyer you have retained and who has agreed to represent you.

Leave a Reply