Forensic examinations of cellular phones and other electronic devices are needed when a party willfully withholds relevant information during discovery or where a party is unwilling or unable to search their electronic devices on their own accord. Federal courts can order a party to submit their electronic devices for a forensic examination in business litigation cases under certain circumstances. A forensic examination creates a “mirror image” of an electronic device that “contains all the information in the computer, including embedded, residual, and deleted data.” Wynmoor Cmty. Council, Inc. v. QBE Ins. Corp., 280 F.R.D. 681, 686-87 (S.D. Fla. 2012). The forensic examination is typically performed by an independent third-party who is appointed by the court and agreed upon by the parties. Peter Mavrick is a Fort Lauderdale business litigation lawyer, and also represents clients in business litigation in Miami, Boca Raton, and Palm Beach. The Mavrick Law Firm represents clients in breach of contract litigation, non-compete agreement litigation, trade secret litigation, trademark infringement litigation, employment litigation, and other legal disputes in federal and state courts and in arbitration.
Forensic examinations of cellular phones are routine in Florida courts, so long as the forensic image will reveal relevant, discoverable information. Procaps S.A. v. Patheon Inc., 2014 WL 11878435, at *2-3 (S.D. Fla. 2014) (granting forensic examination of mobile phones). “During discovery, the producing party has an obligation to search available systems for the information demanded.” Wynmoor, 280 F.R.D. at 685. In business litigation, electronically stored information is discoverable under Federal Rule of Civil Procedure 34(a). Deleted computer files, whether e-mails or otherwise, are likewise discoverable. Bank of Mongolia v. M&P Global Fin. Servs., 258 F.R.D. 514 (S.D. Fla. 2009). While a responding party usually may comply by “translat[ing] the data into a usable form,” a “requesting party itself may need to check the data compilation.” In re Ford Motor Co., 345 F.3d 1315, 1316-17 (11th Cir. 2003).
In determining whether a forensic examination is necessary, courts generally consider “whether the responding party has withheld requested information, whether the responding party is unable or unwilling to search for the requested information, and the extent to which the responding party has complied with discovery requests.” Wynmoor, 280 F.R.D. at 687. “When a requesting party demonstrates . . . the responding party’s failure to produce requested information, the scales tip in favor of compelling forensic imaging.” Id.
In Health Management Associates, Inc. v. Salyer, the United States District Court for the Southern District of Florida ordered a forensic examination in a lawsuit involving a non-compete covenant and employment law because the requesting party made “a persuasive showing that the [subject] devices (both old and new) and the email account [were] likely to contain information relevant to [the] litigation—beyond speculation.” 2015 WL 12778793, at *3-4 (S.D. Fla. Aug. 19, 2015). The Salyer plaintiff sought information relevant to the non-compete agreement and employment-related claims at issue, and then he moved to compel a forensic examination of the individual defendant’s personal electronic devices. Id. at *1. In support of his motion, the Salyer plaintiff submitted deposition excerpts showing the individual defendant could not testify about: (a) where his electronic items were located; (b) how to retrieve information on his devices; and (c) whether he transferred any information from his old devices to his newer devices after his employment with plaintiff terminated. Id. Accordingly, Salyer held there was a “persuasive showing of non-cooperation” because the responding party failed to search his old laptop before his deposition and then later denied transferring any data to his new devices. Id. Salyer further concluded that “[s]everal personal devices that might have stored data relevant to this lawsuit were lost or otherwise rendered inaccessible soon after the Defendant left his employment with the Plaintiff.” Id. at *2. Salyer granted plaintiff’s motion to compel and ordered a forensic examination of the individual defendants’ laptops, cellular phone, thumb drive device, and personal email account. Id. at *4.
After ordering a forensic examination, business litigation courts usually require all parties to implement safeguards and protocols before, during, and after the examination to alleviate any privacy concerns and protect confidential information. Wynmoor, 280 F.R.D. at 687-88 (ordering the independent examination protocol when the responding party was either “unwilling or unable to conduct a search of their computer systems for documents responsive to [the discovery request]”); see also Bank of Mongolia, 258 F.R.D. at 521 (compelling independent examination and setting procedure for an independent forensic review). These privacy protocols usually require the parties to agree on search terms before the examination takes place and permit the producing party to review responsive items for privilege before production.
Peter Mavrick is a Fort Lauderdale business litigation attorney who also practices business litigation in Miami, Boca Raton, and Palm Beach. This article does not serve as a substitute for legal advice tailored to a particular situation.