Court orders forensic imaging of select devices to ensure ESI preservation

Finkelstein v. San Mateo Cnty. Dist. Attorney’s Office, No. 18-cv-00009-EMC (N.D. Cal. May 17, 2018).

In this 42 U.S.C. § 1983 case, the court allowed forensic imaging of the plaintiffs’ devices to preserve electronically stored information (ESI) and prevent spoliation.

Before this case began, the government obtained a search warrant for John and Jennifer Finkelstein’s residence and cars. That warrant sought evidence related to child pornography. During the resulting search, the government seized the Finkelsteins’ computers, hard drives, and cell phones. They found no evidence of child pornography and never criminally charged the Finkelsteins.

The Finkelsteins then brought this action against the San Mateo District Attorney’s Office and others (“the San Mateo defendants”), alleging that they unlawfully obtained the search warrant.

The court had previously permitted forensic imaging of some of the Finkelsteins’ electronic devices. It ordered the parties to meet and confer about preserving ESI on those devices.

The Finkelsteins filed a letter objecting to the court’s initial ruling on forensic imaging. The San Mateo defendants responded, advising the court that the parties had not had a complete meet and confer.

The court treated the Finkelsteins’ letter as a request for reconsideration. In a one-two punch, the court first found that the Finkelsteins failed to demonstrate that they met the standard for reconsideration. Second, their argument failed on the merits.

Earlier in the proceedings, the Finkelsteins had admitted that using their electronic devices would overwrite existing information. They also conceded that they had a duty to preserve evidence on those devices. Despite this duty, the Finkelsteins “did not want to stop using” those devices. Therefore, the court had ordered forensic imaging of “at least some devices” at no cost to the Finkelsteins.

The Finkelsteins relied on John B. v. Goetz, 531 F.3d 448 (6th Cir. 2008), to object to any forensic imaging. Unpersuaded, the court drew three distinctions between Goetz and the Finkelsteins’ situation.

First, the court acknowledged that “litigants are generally responsible for preserving relevant information” themselves. Here, though, the Finkelsteins wanted to continue using their devices. Their request therefore fell within the “very limited set of circumstances” necessitating forensic imaging.

Next, imaging requests should not be “extremely broad” or based on an “unsubstantiated” connection between the request and the claims. However, the court limited its order by only permitting imaging of a sample of the Finkelsteins’ devices. It also did not yet allow inspection or production of that information.

Finally, in Goetz, the Sixth Circuit considered unique “federalism and comity considerations” that were not present in the Finkelsteins’ case.

The court again ordered forensic imaging of some of the Finkelsteins’ electronic devices to prevent potential spoliation. To “minimize the intrusiveness,” the Finkelsteins’ expert should conduct the imaging. Finding that the parties had not fully met and conferred, the court again ordered that they do so.

The court explicitly warned that any party taking “an unreasonable or unwarranted position” risked sanctions.

Takeaways on Using Technology in Ediscovery

Court-ordered forensic imaging is a relatively rare remedy. Here, the court had to balance unusual facts, allowing these plaintiffs to keep using their devices without improperly spoliating evidence. If you’re faced with difficult facts like these, consider whether technology is available to help you meet multiple, apparently conflicting goals.

Questions about legal document review? Questions about preserving ESI? We’re here to help you master ediscovery, starting with preservation.

Contact Us