ML/~

STATE OF ILLINOIS IN THE CIRCUIT COURT OF THE TWENTY-1HIRD JUDICIAL CIRCUIT

DEKALB COUNTY, ILLINOIS

VANTAGE ELECTRIC GROUP, INC., d/b/a) VANTAGE GROUP, an Illinois Corporation,)

) Plaintiff, )

) v. )

) NICOLE M. HUMMER, an individual )

) Defendant, )

) & )

) SUPPLYFORCE.COM, LLC, )

) Respondent in Discovery. )

RE-NOTICE OF MOTION

Case No.: 14 L 79

Jvt.aureen .JI.. ]osfi Electronically Filed

DeKalb County. Illinois

Transaction JD : 170373520

14L79

11/03/2015

YOU ARE HEREBY NOTIFIED that that on the 9th day of November, 2015, at the hour of 9:00 a.m., or as soon then~after as counsel may be heard, I shall appear before the Honorable Judge Presiding, or any Judge sitting in his stead, in the courtroom usually occupied by him in the in the DeKalb County Courthouse and there present Plaintiffs attached Motion and Memorandum to Compel Forensic Examination.

Respectfully Submitted,

/s/ C. Nicholas Cronauer

C. Nicholas Cronauer BURNS, CRONAUER & BROWN, LLP 1101 DeKalb Ave Suite 2 Sycamore, IL 60178 (815)895-8585/(815)895-4070 Fax

l4L/~

STATE OF ILLINOIS IN THE CIRCUIT COURT OF THE TWE NTY-THIRD JUDICIAL CIRCUIT

DE KALB COUNTY, ILLINOIS

VANTAGE ELECT RIC GROUP, INC., d/b/a) VANTAGE GROUP, an Illinois Corporation,)

) Plaintiff, )

) v. )

) NICOLE M. HUMMER, an individual )

) Defendant, )

) & )

) SUPPLYFORCE.COM, LLC, )

) Respondent in Discovery. )

Case No.: 14L 79

Jvt.aureen Jt. ]osfi Electronically Filed

DeKalb County. Illinois

Transaction ID : 170373520

14L79

11/03/2015

MOTION & MEMORANDUM TO COMPEL PRODUCTION OF RELEVANT ELECTRONICALLY STORED

INFORMATION (ESI) AND OTHER RELATED MATERIALS

Plaintiff submits this Brief in support of its Motion to Compel Production of Relevant ESI

and other Related Materials, pursuant to Illinois Supreme Court Rules 214 & 219, for an Order

compelling Defendant Hummer to produce all relevant data stored on relevant computer hard

drives by permitting Plaintiffs electronic discovery expert to exatnine the hard drive images the

Defendant has in her possession (through counsel), extract relevant data therefrom, and produce a

Report of Relevant Data colloquially known as a "hash list" from the hard drives referenced in

Defendant Hummer's sworn testimony and identified by her in interrogatories, in accordance with

established protocols. See, i.e., Simon Properry G1'ot1p v. vrySimo11, Inc. 194 F.R.D. 639, 2000

U.S.Dist.LEXIS 8950 (S.D.lnd. 2000).

l'+L/~

.BACKGROUND

This court is intimately aware with the factual procedural background in this case given the

multi-day hearing that occurred. Vlaintiff has been attempting to examine Defendant Hummer's

electronically stored information, but so far has not been saccessful. To date, Plaintiff and

Defendant have been conferring about the issue, but no agreement has been reached. Defendant

proffered a potential expert, however, Plaintiff was not comfortable using Defendants tendered

expert Jim Fatz, a Northern Illinois University employee. Mr. f<'atz' personal company, CT-Security,

would be using Northern Illinois University's software/licensing agreement for this pt:ivate

engagement. Included herein and attached as Exhibit J\ is a proposed protective order to be entered

for the examination of relevant ESL

LEGAL ST AND ARD

Jllinois Supreme Court Rule 214 aUows a party to "direct any other party to produce for

inspection, copying, reproduction photographing, testing or sampling, including electronically

stored information ... , objects or tangible things." Further, the State of Illinois has a broad

discovery standard, allowing requests which demand "full disclosure regarding any mailer relevant

Lo the subject matter invohrcd in the pending action." Ill. Sup. Ct. Rule 201Q))O). This rule has been

interpreted to permit liberal pretrial discovery. IPil!/i~y v. Chicago Park Dist., 274 Ill. App. 3d 939, 949

(1st Dist. 1995). "Computer records, including records that have been 'deleted,' arc discoverable"

documents. See Citing Civ11111 Lffe 1"s111'(111cc Co. v. Craig, 995 F.2d 1376 (7th Cir. 1993; flli11ois Tool

Wo1k.1~ Im: v. Metro lvfark P1vd11cts LI-fl., 43 F.Supp.2d 951 (N.D. Ill. 1999) (discussing the Federal

Discovery Rules to produce)

ANALYSIS

I. GIVEN THE TESTIMONY HEARD IN THIS CASE, A FORENSIC EXAMINATION FOR ESI IS REASONABLY CALCULATED TO LEAD TO DISCOVERABLE INFORMATION BECAUSE DEFENDANT HUMMER DELETED DATA, EMAILS, AND DESTROYED HARD DRIVES AFTER

HL/~

SWAPPING IDENTICAL HARD DRIVES AND ELECTRONICALLY STORED INFORMATION MUST ALSO BE PRESERVED TO PREVENT THE DATA FROM BEIN G OVERWRITTEN OR LOST.

While e-discovery in Illinois state courts is permitted, there is a dearth of case law discussing the

concept. Courts in other jurisdictions, mainly federa l court, have repeatedly allowed such examinations where

the party's discovet}' responses contain "discrepancies or inconsistencies;' including a failure to produce

responsive documents, and/ or evidence that 1:elcvant data has been deleted. See e.g., Ge11J})orth Fi11. Wealth

Mgmt.,. 267 F.R.D. 443, 447-448 (D. Conn. 2010) (forensic examination allowed based, in part, upon

defendant's admission to evidence spoliation by discarding cotr1puter); Koos!tm-em Co,p. v. Spec Pen, LLC 2008

WL 4458864 at *2 (D.S.C. Sept. 29, 2008) (forensic examination allowed where defendant failed to produce

documents); ./1111enivood l11d11s. If It: u. Uhm11t111, 2006 WL 3825291 at *3 (E.D. Mo. Dec. 27, 2006) (forensic

examination allowed where forensic evidence showed defendant failed to produce all responsive email); Si1J1011

Prop. G,p. LP. 11. 111)'Si1110111 194 F.R.D. 639, 641 (S.D. Incl. 2000) (forensic examination allowed to recover

"deleted files" based, in part, on defendant's failure to produce documents). Herc, Plaintiff has admitted

to having backed up, transferred, and emailed Plaintiffs data, and then destroyed a hard drive T>laintiff requested

be retutned. Thus, Plaintiff must be allowed to conduct a forensic examination of Defendant Hummer's

electronic devices in order to determine whether additional relevant evidence has been withheld, transferred,

and/ or destroyed.

Plaintiff's electronic discovery expert, Andrew Garrett, identified a u:easure trove of Plaintiff's

data being transferred vie, a hard drive that was subsequently destroyed and by the Defendant's

personal email address. Accordingly, under Rule 214, Defendants cannot in good faith argue that

Plaintiff cannot maintain a Motion to Compel access to Defendant's computers in order to create a

forensic analysis. Defendant has admittedly engaged in some actjvity that resulted in the deletion,

hiding, or other destruction of relevant data.

ML/Y

In addition to data being overwritten by the normal functioning of the computers' operating

system, data on defendants' computers is at risk of loss from system crashes, malfunctions, viruses,

and physical shock. Only by ci:eating a forensic, bit stream, n~tror image copy of the relevant

computers can all evidence be preserved for this litigation

II. PRODUCING COMPUTERS DISCOVERY.

DEFENDANT HUMMER'S PERSONAL IN ORDER TO MATCH FILES IS PROPER

Defendirnt has admitted to transferring and destroying ESI evidence pertaining to the allegations

Pktintiffs lawsuit against Defendant, despite Plaintiffs request that the hard drive be returned to it. These facts,

alone nccessitntes a forensic examination. See Ge11J1Jortb Fin lfeal!h l'vJgmt., J,u: :ind Si111011 P,vp. G,p. 267 F.R.D.

443 , 447-448 (D. Conn. 2010). In Ge111vot1h, the plaintiff requested a forensic examination of the defendant's

computers after the defendant exhibited considerable bad faith in discover)', including admitting to throwing

away a computer containing relevant evidence. In ruling that n forensic examination was justified, the court

explained that "the timing of the computer's disposal [coming nfter accusations of unlawful conduct had been

levied against the defendant) evidences n consciousness of wrongdoing." 267 F.R.D. at 447-48. Here, just like

in Ge111vo11b, Defendant nclmitted to backing up and destroying relevant evidence and acknowledged that she did

so qjier receiving a letter from the Plaintiff requesting that the proprietary u1formation be returned. As in Si111011,

Defendant Hummer's destruction of the lrnrd drive she admittedly backed darn up to- only nfter returning to

Plnintiff no identical new, blnnk hard drive-is evidence of her consciousness wrongdoing. Thus, Defendant is

entitled to a forensic exmnination just like in Gemvo11h.

Plaintiff is entitled to discover all relevant data, including deleted data from Defendants'

cotnputers. See Antioch Co. v. Scmphook JJorders, 111c., 210 F.R.D. 645, 652 (D. Mfon. 2002) ("lllt is a

well accepted proposition d1at deleted computer files , whether they be emails or otherwise, are

discoverable") ; Ro1JJ11 E 11!JJ1't, Inc. v. The Willia111 Monis / Ige119,, Ille., 205 F.R.D. 421, 427-431 (S.D.N.Y.

2002) (stating that "[e]lcctronic documents are no less subject to disclosure than paper records," and

only questioning which patty should bear the cost of such discovery, especially for backup tapes or

deleted e-mail.s); McPeek 11. Ashcrqfi, 202 fo.R.D. 31, 34 (D.D.C. 2001) (stating that, "[djuring

discovery, the producing party has an obligation to search available electronic systems for

.information demanded," and ordering a limited backup restoration of e-mails); Kleiner v. B11ms, 48

Fed. R. Serv. 3d 644, 2000 \XIL 1909470 (D. Kan. Dec. 15, 2000) (noting that Rule 26(a)(l)(B)

requires description and categorization of computerized data, .including deleted e-mails, and stating

that "[t]he disclosing party shall take reasonable steps to cns1..1te that it discloses any backup copies

of ftlcs or archival tapes that will provide information about any 'deleted' electronic data"); S1111011

Prope,j,y Gro11p LP. v. "()'Simon, file., 194 F.R.D. 639, 640 (S.D. Ind. 2000) ("F.i.rst, computer records,

including t:ecords that have been 'deleted,' are documents discoverable under Fed. R. Civ. P. 34."

Citing CroJ/111 I--!/c fos11m11,-e Co. 11. Craig, 995 F.2d 1376 (7th C.i.r. 1993; Illi11ois Tool !Porks, Inc. u. Metro

Mark Pro1h1ds Lid., 43 F.Supp.2d 951 (N.D. Ill. 1999)); Pk!Jbq)' E11te1: v. IIVe/leJ; 60 r. Supp. 2d 1050,

1053 (S.D. Cal. 1999) ("Plaintiff needs to access the hard dcive of Defendants' computer only

becaus~ Defendants' actions in deleting those e-mails made it crnrently impossible to produce tJ1e

information as a 'document."'). Anli-Mo11opofy, Im~ v. Hasbro, I11c. WL 649934 (S.D.N.Y., Nov. 3,

1995); Seattle Al!d11bo11 Socie(y v. 1=,yons, 871 F. Supp. 1291 (W.D. Wash. 1994); Li11ne11 u. A.H.Rohi11J; Co.

WL 462015 (.tvfass. Super., June 16, 1999); Cro1JJ11 Life lns11m11ce Co., v. Cmig 995 F.2d 1376 (7th Cir.

1993)

It is a legal maxim beyond reasonable debate that deleting data on a hard drive docs not

remove the data from the scope of discovery. Dodge, IVam11 & Peter.,· Ins. SerN. 11. Ri.efy \XIL 245586

(Cal. Ct. App. Feb. 5, 2003); Si.111011 Proper(} G,v11p 11. 11rySi111011, l11c. 194 P.R.D. 639, 2000

U.S.Dist.LEXIS 8950 (S.D.Tnd. 2000). This is because data that has been "deleted" from a computer

is still resident on the computer's hard drive-the data has simply been rendered "invisible" to the

14L/~

computer's operating system.' While deleted data is certainly the most common form of "invisible"

data, it is not the only type of data that is invisible to the operating system 'Invisible" data .includes

back-up copies of work in progress, data related to tasks being done by the processor, log data, and

various other forms of information needed by the compntet to work.

When data is "deleted", the location at which this data is written on the hard drive is

"tagged" by the operating system and identified as a location available to the operating system to use

to store new data as needed. Thus, as the Defendants in the matter at bar continue to use their

computers, the operating system overwrites all forms of data, including data relevant to the

Plaintiffs claims or the Defendants' defenses. /111/ioch v. Scmphook Bordm, l,11:, 210 F.R.D. 645

(D.Mion. 2002).

Although the compute.r's operating system cannot v1c,v the "invisible" data on the

computer's hard dtives, forensic software can read, extract, and process i1l1 data on hard drives,

including "invisible" data in l\ non-disruptive, economical manner. The procedure used by computer

forensic experts to identify and extract all relevant data from a computer hard drive begins with the

creation of a mirror-image oi: copy of the relevant hard drives. P!qybqy Ente,plim~ Inc. 1J. Welles, 60 F.

Supp.2cl 1050 (S.D. Cal. 1999). State v. Cook, 149 Ohio App.3d 422 (2nd Dist. Mont. County, 2002)

Creating an image of a relevant hard drive recruires that Plaintiffs eDiscovery expert,

Andrew Garrett, have access to the Defendants' hard drives contained therein for an average of two

to five hours.2 Dming this period of time, Plaintiffs expert will attach a write-blocking device to the

Defendants hard drive (to prevent any change to any of the data on any of the relevant hard drives),

Computers store two major categories of data: data that is viewable by the operating system (such as documents, spreadsheets, memos, etc.) and data that is not vicwnble by the operating system. In the normal opcrntion of a computer, data is written onto the computer's hard drive and this data is not intended to be viewed br, and is invisible to, the operating si1stem.

2 This is an avcrnge time. l\·lany cases can be completed in less than two hours. Sometimes, the imaging process takes longer depending on 1·he condition of the relevant hard drives, the speed at which they operate, and other factors.

1£1-L/~

and create a copy of each relevant hard drive. Each image will be copied to a hard drive supplied by

Plaintiffs expert and will use the standard prnctices of the Department of Justice. The imaged hard

drive will then be left in the Defendant's possession and control for safe-keeping.

In this matter, Defendants Hummer's personal computct has finally been identified. To

minimize any i.nconveni.cnce to Defendants, Plaintiff has offered to match hash list fites during times

convenient for Defendant, including evenings, after business hours, Saturday or Sunday. The

forensic process is not disruptive to Defendant Hummer. In fact, this process is very efficient,

allowing the identification and exertion of relevant data to be accomplished electxonically. The

Plaintiff's expert has already created the list of files known as a hash list and the Plaintiff is only

requesting an opportunity to compare Defendant Hununer's hash list of files form her personal

computer and access opernting system files and logs to determine no intellectual property is being

hiu:bo1:ed or was loaded but then wiped. This is proper and permitted under the civi.1 discovery rules.

III. IDENTIFICATION OF RELEVANT DATA IS COMPLETED ELECTRONICALLY, AND ONLY RELEVANT DATA IS EXTRACTED; ENSURING THAT NO "FISHING EXPEDITION" CAN OCCUR.

After Plaintiffs expert created copies of the images from the Defendant's Vantage-issued

computer, he electronically searched and analyzed the images for related ESL Keywot:d searches,

combined with analysis of metadata and system. ai:tifacts, comprised the usual tools used to complete

an analysis. Plaintiff's expert already has a hash list of files he located as being transfened from

Plaintiffs work-issued laptop and can easily identify th tough hash Jist matching whether those files

appear on Defendant Hum1ner's personal laptop or were destroyed.

Electronic searching for Plaintiffs telated E SI on the Defc.ndant's personal computer is the

only practical means of identifying relevant data on a hard drive. An average size hard drive can have

millions of pieces of data thereon, and it is imp.tactical to search for relevant data by randomly

viewing folders or files. All searching for Defendant's related E S! will be conducted electronically.

14L/~

As a result, through hash list matching, unrelated ESI data wilJ not be identified, extracted, or

viewed by Plaintiff's expert. Plaintiff's expert will not view any data that does not have references to

Plaintiffs files b)1 systematically exempting any £ile that does not meet the hash list file registry.

Defendants may argue that they should be given the right to approve of the search and

analysis strategy used by Plaintiffs expert, including the right to veto the use of search terms or

analysis of system artifacts. Defendants should have no right to limit Plaintiffs discovery or t·he

discretion of Plaintiffs expert. This procedure absolutely protects Defendants' interests and vitiates

any concern related to random searching of Defendants' hard drives. Plaintiff's Motion to Compel

will allow Plaintiff access to data that Plaintifrs expert has acknowledged exists and was not refuted

at the multi-day hearing.

a. THE PROTOCOL BELOW IS NECESSARY TO ENSURE RELEVANT ESI IS DISCOVERED.

The Plaintiff suggest the following protocol to ensure that information is reasonably

calculated to lead to discoverable information:

1. Answer the following questions for each co1npute1::

a. \'v'hat operating system is installed and what date was it installed (MFT File Date, Registry);

b. What USB Devices have been connected to the computer (Serial Number, Last Date Connected); and

c. Review Event Logs and PreFetch for evidence of anti forensic tool use.

2. Determine if spoliation of data has occurred;

a. Compute the amount of drive space that is written with a pattern such as all O's 01: l's or pattern of chamcters/ numbers;

b. Search for the following keywords and if found exu:act the file containing the string of data or bookmark and export the 100 words before and after in the unallocated:

BCWipe 131eachBit

CCleaner Darik1s Boot and Nuke (DTIAN) Data Shreddct: Disk Utility HDDerasc hdparm shred Shredit srm Zeero

14L/~

3. Complete file carving for files with extensions:

doc-Legacy Word document; Microsoft Office refers to tl1em as "Microsoft Word 97-2003 Document" dot- Legacy Word templates; officially designated "Microsoft Word 97 - 2003 Template11

docx-Word document docm-Word macro-enabled document; same as .docx dotx- Word template dotm- Word macro-enabled template; same as dotx, but may contain macros and scripts docb- Word binary document introduced in Microsoft Office 2007 pptx-PowerPofr1t presentation pptm-Power1)oint macro-enabled presentation potx-PowerPoint template poan-PowerPoint macro-enabled template ppsx- PowerPoin t slides bow ppsm- PowerPoiot macro-enabled slideshow sldx-PowerPoint slide sldm- PowerPoint macro-enabled slide xis-Legacy Excel worksheets xlm - Excel macro xlsx - Excel workbook xlsm - E xcel macro-enabled workbook; same as xlsx but may contain macros an<l scripts xlw - Excel workspace; previously known as uworkbook11

ACCDB - The file extension for the new Office Access 2007 file format. This takes the place of the MDB file extension. ACCDE - The frle extension for Office Access 2007 files that are in 11execute only" mode.

4. .After file recovery, attach a hash list to the case and process again to find files that match the hashes provided and then bookmark any files matching. Create a report of the artifacts matching and export those files noting the tvfDS hash v!llucs in the report with the file times.

CONCLUSION

14LN

Granting Plaintiff's Motion to Compel would finally allow Plaintiff to accomplish the inquiry

permitted by Supreme Court Rules of civil discovery applicable u1 this case. Using special software,

an expert such as Plaintiff's expert, Andrew Garrett, or Defendants expert, can easily match hash

lists of files from all the relevant hard drives in this case. The matching can occur at a time and

location of the Defendants choosing, and the process does not cause any disruption in her personal

affairs or business. Using computer forensic softwate, an c-discovery expert like Andrew Garrett

can make easily match a list of files al.i:cady known to have been backed up to a hard ddve that is

now allegedly destroyed but not returned, and ensute all televant hard drives in this case are not

repositories for Plaintiff's pi:opcietary property.

WHEREfi'ORE, the foregoing reasons, Plaintiff request their Motion to Compel Production

of Relevar\t Electronic Stored Information (ESI) and other related materials be granted.

Respectfully Submitted,

VANTAGE ELECTRIC GROUP, !NC.

By: ?.i1'c,~ One of its Attorneys

C.. Nicholas Cto11auer (6305683) TI URNS, CRON.-\UER, & BROWN, LLP A ttomey for Plaintiff 1101 DeKalb Ave., Suite 2 Sycamore, IL 60178 (815) 895-8585/(815) 895-4070 Fax

November 3, 2015

CERTIFICATE OF SERVICE-ATTORNEY

I hereby certify that on November l-, 2015, l mailed by United States Postal Service, with proper postage affixed and prepaid, the foregoing documents to the following participants:

HARRIS & ASSOCIATES

c/o Regina Harris 513 West State Street

Sycamorfi IL 60178 ~

By ~- ~A._.-: ~ C. Nicholas. Cronauer

THE COLLINSL·\\v' FIR~!

Britt M. Anderson 1770 Park Street, Suite 200 Naperville, Illinois 60563

ML/~

STATE OF ILLINOIS IN THE CIRCUIT COURT OF THE TWENTY-THIRD JUDICIAL CIRCUIT

DEKALB COUNTY, ILLINOIS

VANTAGE ELECTRIC GROUP, INC. , d/b/a) VANTAGE GROUP, an Illinois Corporation,)

) ~~~ )

) v. )

) NICOLE M. HUMMER, an individual )

) Defendant, )

) & )

) SUPPLYFORC12.COM, LLC, )

) Respondent in Discovery. )

Case No.: 14 L 79

MUTUAL ELECTRONIC DISCOVERY AND PROTECTIVE ORDER

T he parties agree that Electronically Stored Information (EST) that may be relevant to

this matter may be found on computcr(s) located at the defendant's place of business. In order

to locate and search for relevant ESI, an expert is needed to examine computer(s) at the

Respondent in Discovery's place o f business. Purportedly, the computers containing ESI that

are relevant to th is matter, may contain confidential information such as "attorney work

product" (A WP), "Attorney-Client Communication" (ACC) and "HIP J\J\" protected (HIP AA)

patient medical records. The following protocol and protective order is entered by mutual

agreement of the parties.

1) Expert Identification. The requesting party has solicited the services of Garrett

Discovery Inc., an Illinois cDiscovery and Computer Forensic Fittn. Garrett Discovery has

£;. A-

ML/':J

assigned Andrew Ganett eDiscovery/Computer Forensic expert to this matter. Expert Garrett's

CV and cast history is attached and marked as 'Attachment IV. Expert Garrett has performed

eDiscovery and Computer Forensic Services for the Department of Defense, Department of

Justice, redetal and State courts and has collected ESI from government facilities, jails, hospitals,

governmental units and healthcare facilities using similar protocol to what listed below.

2) . Identification. The Respondent in Discovery shall identify computer(s) used by

Defendant Hummer in the normal course of business. This includes the server used to store

records ot: backup Defendant Hummei:'s software and files.

3) Scope. Documents and materials collected by the 'expert' in the course of

discovery of this case, including initial disclosures, responses to discovery requests, all deposition

testimony and exhibits, and information derived directly therefrom (hereinafter collectively

"documents"), are subject to th.is Order concerning Confidential Information as set fotth below.

Expert shall not share or disclose the contents of hard drives or setvers examine to Plaintiff, his

agents, attorneys, or any other person not approved, in writiJ1g, by the Defendant or Respondent

in Discovery. His role will simply be to perform identification of users, operating system, file

metadata, keyword searching, file matching, if any, among devices mid review for any evidence of

spoliation.

4) Defini tion of Confidential Information. As used in this Order, "Confidential

Information" is defmed as information that the producing party designates in good faith has been

previously maintained in a confidential manner and should be protected from disclosure and use

outside the litjgatiou because its disclosure and use is restricted by statute or could potentially

cause harm to the interests of disclosiJ1g party or nonparties. for purposes of this Order, the

parties will limit their designation of "Confidential Information" to the following categories of

2

14L /~

information or documents:

[The parties sho11ld ide11tf(y the Jpecijic cmd 11a,ro1p categoties of i11Jor111t1tio11 thry seek lo p,vtec/ s11ch as medit,,I records, diCJII lists, peno1111el flies, tax ret11ms,fi11c111cia/ state111e11/s a11d recorcb~ p,vprietatJ b11Ji11ess records (prici11g sheets), tmde secrets, ncords 1vhose disdosm-e is res/tided or prohibited~ stat11te, etc.]

5) Collection of ESI. T he 'expert' will make forensic images (copies) of the hard

drives and servers in the possession and control of the prodncing party. It is necessary to ask

questions of the custodians of such records and that they fully comply with the inquiry. It is

agreed that in order for the expert to col.lect evidence in a timely manner, that the producing

patty agrees to answer all questions ful.ly. None of the answers will be considered

interrogatories. The process of making a forensic image allows for the business to remain

operational with little to no down time, ensures that the original hard drive is not changed or

altered in anyway by use of write blocking software and allows for the examination to be

completed off site in a laboratory enviroiunent which reduces.

6) Discovery Protoco l. The following steps will be strictly folJowed by the expert:

a) Plaintiff's shall bear the cost of an <expert';

b) Expert will interview the producing party custodians;

c) Expert will make forensic images (copies) of hard drives in the possession

and control of the p roducing party;

d) Expert will search for and locate ESI relevant to the matter including ESI

regarding the creation, deletion, modification or h.istory of the ESJ, suggested

search parameters submitted by the requesting and producing party, and hash

list matching;

e) Expert will bundle all ESI collected from the searches and produce that EST 3

14L/~

in a 'review package' to the producing party for privilege review;

f) J\ review package is a software package that allows for the producing party

to view and mark files are either 'Confidential - Attorney Work Product',

'Confidential- Attorney Client Communication', 'Confidential- HIPAA' or

'For Release to Requesting Party' 'Confidential- IP." Additionally, the review

package allows the producing party to export from the review package a

privilege log in Microsoft Excel format.

g) The time period for fu1ishing the review will be thirty (30) days. Producing

party will send the log file expert creates by the review package of the expert

h) Expert, within 3 business days, will create a second review package with

only the ESI designated as 'Por Release to Requesting Party' and submit to

Producing patty for review and subsequent submission to the requesting party.

i) Witl1in 14 days of receipt of the second review package (g) the producing

party will submit the second review package and privilege log to the requesting

party and copy the expert for validation

k) Expert w.i ll validate that all ESI is accounted for and that if any files are

deemed privileged that may be marked inadvertentl)' the cxpc1:t will notify the

producing party and the producing party can either rectify the inadvertent

privilege designation or the expert can submit directly to the court for in

camera inspection under seal.

7) Search. All parties will submit to each other suggestions for

searching the ESI, that the parties believes in good faith will retnrn a reasonably

high proportion of responsive documents within 14 days of the signing of this

4

14L/~

agreement.

8) Inadvertent Failure to Designate. Inadvertent failure to designate any

document or material as containing Confidential Information will not constitute a waiver of an

otherwise valid claim of confidentiality pursuant to this Order, so long as a claim of

confidentiality is asse.rted within 30 days after discovery of the inadvertent failure.

9) Depositions. Deposition testimony o f expert will. be deemed confidential

only if designated as such when the deposition is taken or within a reasonable time period after

receipt of the deposition transcript. Such designation must be specific as to the portions of the

transcript and/ or any exhibits to be protected.

10) Protection of Confidential Material.

a) General Protections. Designated Confidential Information must be used or

disclosed solely for purposes of this lawsuit, including any appeals, [or any other

related legal proceeding brought by one of the parties to this litigation].

b) Who May View Designated Confidential Information. Except with the

prior written consent of the designating party or prior order of the cou1:t,

designated Confidential Information may not be disclosed to the following persons:

(1) The parties to tbis litigation, including any employees, agents,and

representatives of the parties;

(2) Counsel for the parties and employees and agents of counsel

(3) The court and court personnel, and members of the ju.ry;

(4) Cou.rt reporters, videographers engaged for depositions;

(5) Any mediator appointed by the court or jointly selected by the

parties;

5

14L/~

(6) Any expert witness, outside consultant, or investigator retained

specifically in connection with this litigation, but only after such

persons have completed the certification contained 111

Attachment A, Acknowledgment and Agreement to be Bound;

(7) Any potential, anticipated, or actual fact witness and his or her

counsel, but only to the extent such confidential documents or

information will assist the witness in recalling, relating, or

explaining facts or in testifying, and only after such persons have

completed the certification contained in Attachment A;

(8) The author or recipient of the document (not including a person

,vho received the document in the course of the litigation);

(9) lndependent providers of document reproduction, electronic

discovery, or other litigation services retained or employed

specifically in connection with this litigation; and

(10) Other persons only upon consent of the producing party and on

such conditions as the parties may agree.

( c) Control of Documents. The parties must take reasonable efforts to

prevent unauthorized or inadvertent disclosure of documents designated as

containing Confidential Information pursuant to the terms of this Order. Counsel

for the parties nrnst maintain a record of those persons, including employees of

counsel, who have reviewed or been given access to tlte documents along with the

originals of the forms signed by those persons acknowledging their obligations

under this Order.

6

ML/';I

11) Filing of Confidential Information. In the ev-cnt a party seeks to file any

document containing Confidential Information subject 10 protection under this Order

with the court, that party must take appropriate action to itlsure that the document receives

proper protection from public disclosure including: (a) filing a redacted document with the

consent of the party who designated the document as confidential; (b) where appropriate

(e.g., in relation to discovery and cvidentiary motions), submitting the document solely for in

camera review; or (c) when the preceding measures arc inadec1uate, seeking permission to

file the document under seal by filing a motion for leave to file under seal

[The mere designation of information as co,!fidential p111wn11t to the prolccli11e order provisions 111q;1 110/ be s1rffed1mt lo satt~/j, the comt's req11ircme11ts forjili11g ii 1111der seal i11 light of the p11hlic '.r q11aliji,ed right lo access to co11rt dockets. Beforejili11g 11 111otio11for lct1ve to.file 1mder sett/, the p(lrties sho11lrl consider other steps to pn!vent the 111meccssc1ry disclos11re co1!fide11tial i1!fom1alio11 i11 co111tflli11gs .mch as.flied redt1cted doc11111e11ts or other 1)1tam short offlh.11g 1111der serdJ

Nothing in this Order will be constrned as a prior directive to allow any document to be

filed under seal. The parties understand that the requested documents may be filed under seal only

with the permission of the court after proper motion. If the motion is granted and the requesting

party permitted to file the requested documents under seal, only counsel of record and

unrepresented parties will have access to the sealed documents. P,v hac vice attorneys [f m!Y, must

obtain scaled documents from local counsel.

12) Challenges to a Confidential Designation. The designation of any material or

document as Confidential Information is subject to challenge by any party. Before filing any

motion or objection to a confidential designation, the objecting part}' must meet and confer in

good faith to resolve the objection informally without judicial i11tctvention. A party that elects to

challenge a confidentiality designation may file and serve a motion that identifies the

challenged material and sets forth in detail the basis for the challenge. The burden of proving

7

lll-L /~

the necessity of a confidentiality designation remains with the party asserting confidentiality.

Until the court rules on the challenge, all parties n:rnst continue to treat the materials as

Confidential Information under the terms of this Order.

13) Use of Confidential Documents or Information at Trial or Hearing.

Nothing in this O rder will be consttucd to affect the use of any document, material, or

information at any trial or hearing. A party that intends to present or that anticipates that

another patty may present Confidential Information at a hearing or trial must bring that issue to the

attention of the court and the other parties without disclosing the Confidential Information.

The comt may thereafter make such ordets as are necessary to govern the use of such documents

or information at the bearing 01: trial.

14) Obligations on Conclusion ofLitigation.

(a) Order Remains in Effect. Unless othc1wise agreed or ordered, all

provisioi1s of this Order will remain in effect and continue to be binding after conclusion of

the litigation.

(b) Return of Confidential Documents. Within 90 days after this litigation

concludes by settlement, final judgment, or final order, includlng all appeals, all docnments

designated as containing Confidential Information, including copies as defined above,

must be returned to the party who previously produced the document unless: (1) the

document has been offered into evidence or filed without restriction as to disclosure; (2) the

parties agree to destruction of the document to the extent practicable in lieu of return? or (3)

as to documents bearing the notations, summations, or other mental impressions of the

receiving party, that party elects to destroy the documents and cc.1:tifies to the producing party

that it has done so.

8

14L/~

(c) Retention of Work Product. Notwithstanding the above requirements to

return or destroy documents, counsel may retain attorney work product, including a11

index which refers or relates to designated Confidential Information, so long as that work

product does not duplicate verbatim substantial portions of the text or images of

designated documents. This work product will continue to be confidential under this Order.

1\n attorney may use his or her own work product in subsequent litigation provided that its

use docs not disclose Confidcntiallnformation.

15) Order Subject to Modification. T his Order is subject to modification by the court

on its own motion or on motion of any party or any other person with standing concerning

the subject matter. The Order must not, however, be modified until the parties have been given

notice and an opportunity to be heard on the proposed modification.

16) Persons Bound by Protective Order. This Order will take effect when

entered and is binding upon all counsel of record and their law firms, the parties, and persons made

subject to this Order by its terms.

17) Jurisdiction. The court's jurisdiction to enforce the provisions of this Orcle.r will

terminate on the final disposition of this case. But a party may file a motion to seek leave to re­

open the case to enforce the provisions of this Order.

18) Applicability to Parties Later Joined. ff additional persons or entities

become parties to th.is lawsuit, they must not be given access to any Confidential Information until

they execute and file with the court their written agreement to be bound by the provisions of

this Order.

19) Protections Extended to Third-Party's Confidet1tial Information. The

parties agree to extend the provisions of this Protective Order to Confidential Information

9

14LN

produced in this case by thit:d parties, if timely requested by the third party.

20) Confidential Information Subpoenaed or Ordered Produced in Other

Litigation. If a receiving party is served with a subpoena or an order issued in other litigation

that would compel disclosure of any material or document designated in this action as

Confidential Information, the receiving party must so notify the designating patty, in writing,

immedia tely and i11 no event more than three business days after receiving the subpoena or

order. Such notification must include a copy of the subpoena or court order.

The receiving party also must immediately inform in writing the party who caused the

subpoena or order to issue in the other litigation that some or all of the material covered by the

subpoena or order is the subject of this Order. In addition, the receiving party must deliver a

copy of this Order promptly to the patt)' in die other action that caused the subpoena to issue.

The purpose of imposing these duties is to alert the interested persons to the existence of

this O rder and to afford the designa ting party in this case an opportunity to try to protect its

Confidential Information in the court from which the subpoena or order issued. The designating

party bears the burden and the expense of seeking protection in tliat court of its Confidential

Information, and nothing in these provisions should be construed as authorizing or encouraging

a receiving party in this action to disobey a lawful directive from another court. T he obligations

set forth in this paragraph remain in effect while the party has i11 its possession, custody, or

control Confidential Information by the other party to this case.

21) Inadvertent Disclosure of Confidential Information Covered by Attomey­

CHent Privilege or Work Product. T he inadvertent disclosure or production of any

information or docnmcnt that is subject to an objection on the basis of attorney-client

privilege ot: work-product protection, including, but not limited, to information or documents that

10

ML/~

may be considered Confidential Information under the Protective Order, will not be deemed to

waive a party's claim to its privileged or protected nature or estop that party or the privilege

holder from designating the information or document as attorney-client privileged or subject to

the work product doctrine at a later date. Any party receiving any such information or document

must return it upon request to the producing party. Upon receiving such a request as to specific

information or doctunents, the receiving party must return the information or documents to the

producing party within 30 days, regardless of whether the receiving party agrees with the claim of

pri,rilege and/ 01: work-p.coduct protection. Disclosure of the information or document by the

other party prior to such later designation will not be deemed a violation of the provisions of this

Order.

22) Protocol The fo llowing is the agreed upon protocol to determine if any of

Plaintiff's proprietary data has been transferred to other devices:

.A. The following questions are to be answered for each device:

1. What operating system is installed and what date was it installed (MFT File Date, Registry);

2. What USB Devices have been connected to the computer (Serial Number, Last Date Connected); and

3. Review Event Logs and PreFetch for evidence of anti forensic tool use.

n. Determi11c if spoliation of data has occurred;

1. Compute the amount of drive space that is written with a pattern such as all O's

or 1 's or pattern of characters/ numbers;

2. Search for keywords and if found extract the file containing the string of data

or bookmark and export the 100 words before and after keywords:

3. Search for evidence of anti-forensic tool use:

1 L

HL/~

C. Complete file carving for files for Microsoft Office and Portable Document Format (PDF) files:

D. After file recovery, attach a hash list to the case and then process drive again to fmd files that match the hashes provided and then bookmark any files matching. Create a report of the artifacts matching and export those files noting the MDS hash values in the report with metadata ..

IT IS SO ORDERED.

Dated:

Judge

WE SO MOVE AND AGREE TO THE TERMS OF THIS AGREEMENT

Signature Signature

Printed Name Printed Name

Counsel for: Counsel for:-------- --

Dated: Dated:

12

lLtL/'7

ATTACHMENT A

ACKNOWLEDGMENT AND

AGREEMENTTOBEBOUND

The undersigned hereby acknowledges that he/ she has read the Protective Order dated

_______ in the case captioned, , and

attached hereto, understands the terms thereof, and agrees to be bound by its terms. The

undersigned submits to the jurisdiction of the m

matters relating to this Protective Order and understands that the terms of the Protective Order

obligate him/her to use materials designated as Confidential Information in accordance with the

order solely for the purposes of the above-captioned action, and not to disclose any such Confidential

Information to any other person, firm, or concern, except in accordance with the provisions of the

Protective Order.

The undersigned acknowledges that violation of the Protective Order may result in penalties

for contempt of court.

Name:

Job Title:

Employer:

Business Address:

Date:

Signature