“Forensic examinations of computers and cell phones are generally considered a drastic discovery measure” because they are intrusive in nature. Stewart v First Transit Inc., Civ No. 18-3768, (ED PA Sept 3, 2019). Indeed, the inspecting or testing of electronic information systems implicate issues of confidentiality and privacy (see, e.g., Rule 34(a) Advisory Committee Note to 2006 Amendment [“[t]he addition of testing …to rule 34(a) with regard to … [ESI] is not meant to create a routine right of direct access to a parties electronic information system, although such access might be justified in some circumstances. Courts should guard again undue intrusiveness resulting from inspecting…such systems.”]). And so, before a motion for forensic testing is granted, a Court must be convinced there has been some “improper conduct” on the part of the responding party or other “good cause to order computer imaging … or similar forensic examinations.” Case law has shown that “improper conduct” or “good cause” justifying forensic imaging includes, for example when there are “discrepancies or inconsistencies in the responding party’s discovery responses” (Schreiber v Friedman, No. 15-cv-6861 [EDNY August 15, 2017]) or here a “litigant has tampered with the computer or hidden relevant materials that are the subject of Court orders” (id. [collecting cases]).
Against this backdrop, it comes as no surprise that the Magistrate Judge for the Eastern District of New York denied Defendant AmGuard Insurance Company’s motion to compel plaintiff to produce – for forensic examination – the cell phone that recorded videos plaintiff already produced in discovery (Aminov v. Berkshire Hathaway Guard Insurance Cos., et. al., [21-cv-479 [DG][SJB]). Indeed, Magistrate Judge Bulsara concluded the motion was based upon layers of “a series of speculation upon a series of flawed assumptions and misguided understandings” and lacked any justification to support a forensic examination. Am Guard’s sole basis for demanding a forensic examination was its own counsel’s analysis, using a free web-based metadata tool, Metadata2Go, wherein counsel believed the metadata for the produced videos had been altered. Curiously, Defendant did not assert anything about the tool’s reliability; rather, Defendant’s assumptions on predicated upon “the less-than-unequivocal statement produced by the website” when used to analyze the Plaintiff’s video: “Metadata could have been changed or deleted in the past.” According to the Court, “this is hardly the kind of analysis or support that provides a reasonable basis either to conclude that there was an alteration of metadata or to warrant forensic examinations.”
In addition to the “uncertainty” in the Metadata2Go statement, which is a disclaimer generated for every file uploaded to the website as a means of liability protection for the company, the Court concluded, “the tool itself is not one designed to show alteration of metadata, but instead one that determines whether metadata exists.” Meaning, the tool allows one to understand or access metadata stored in one’s files; it does not allow one to infer metadata has been altered or deleted. Finally, the Court determined the experts with whom Defendant consulted failed to offer any opinion that plaintiff’s files have missing or altered data. And so, “there is no evidence of spoliation or alteration,” and therefore “no cause to require forensic examination of the cell phone or the speculation that additional metadata may exist or …was altered.”
The Aminov opinion is a good reminder that unlimited examination of phones or other electronic information systems is not often granted. Indeed, parties seeking such access must provide sufficient justification to overcome the consideration confidentiality and privacy issues attendant to those devices especially where, as here, the underlying data has been produced already. And, as the decisional law makes plain, the “sufficient justification” needed to secure such assess is substantially more than conclusory assertions, assumptions or speculation. Rather, to prevail on a motion for a forensic examination, one must demonstrate “specific, concrete evidence of concealment, destruction of evidence, or failure to preserve documents and information.” (Sophia & Chloe, Inc., v. Brighton Collectibles Inc., No. 12cv2472 [SD Cal September 13, 2013])