February 28, 2017 Practice Points

A Road Map to Seeking an Order for a Forensic Search of an Opposing Party’s Computer

The U.S. District Court for the District of Maine recently resolved an interesting question at the fore of ESI disputes.

By Eric B. Levasseur

Discovery of electronically stored information (ESI) is a routine facet of modern civil litigation. ESI often affords the parties the opportunity to recreate a minute-by-minute, day-by-day account of the parties’ dispute: a historical record etched in data. But as the recent amendments to the Federal Rules of Civil Procedure reflect, the benefits of ESI discovery must be balanced against its burdens—principally, its potentially significant costs—to strike the appropriate, proportional balance between a complete record and costly, time-consuming ESI discovery that is unlikely to bear fruit. Not surprisingly, differing views on the benefit/burden analysis frequently arise.

In a recent decision that provides a concise road map for practitioners, the U.S. District Court for the District of Maine recently resolved an interesting question at the fore of ESI disputes: Under what circumstances is it appropriate and/or justified for a court to order a forensic examination of a party’s computer, particularly where the request for examination is grounded on suspicion that a producing party’s ESI production is incomplete? See Coast to Coast Eng’g Servs., Inc. v. Roop, No. 2:16cv54 (D. Me. Nov. 8, 2016).

In Roop, one of the discovery issues the court sought to resolve was a request by the plaintiff that the court order a forensic examination of that defendant’s personal and company computers.

The plaintiff argued that proportionality favored an examination, as the plaintiff had no other means of obtaining and/or confirming the requested information; the defendant’s discovery responses were inconsistent; the discovery was crucial to the plaintiff’s allegations; that defendant had not raised the burden or expense of the requested examination; and any cost burden could be mitigated by establishing court-ordered protocols for the examination. The plaintiff also urged that an examination was warranted as a result of the defendant’s refusal to execute an affidavit that he was no longer in possession of certain requested materials.

The defendant responded that where a plaintiff is not seeking monetary damages, a forensic computer examination would be fundamentally unfair and not proportional to the needs of the case. The defendant also argued that the forensic examination was “wholly inconsistent” with the parties’ earlier agreement to limit discovery activities and expense; and that the alleged inconsistencies in the record did not exist.

In denying the request for examination, the district court began by noting that “[a] court should not allow a forensic examination of a party’s computers in order to help the party seeking the examination to confirm a ‘highly speculative conjecture’ that materials responsive to duly served requests for production have not been produced and are present on those computers,” (internal citations omitted). To succeed on a request for examination, a requesting party must present (i) “credible evidence that the opposing party is unwilling to produce computer-generated documents or that it has withheld relevant information[,]” or (ii) “at least some reliable information that the opposing party’s representations [regarding its own ESI search] are misleading or substantially inaccurate.” Indeed, without expressly stating so, the district court effectively acknowledged a presumption of good faith by those conducting their own ESI searches. As the court noted, “[c]ourts should be particularly reluctant to allow such searches where the opposing party has undertaken its own search and forensic analysis and has sworn to its accuracy.”

Moreover, the court found, “[i]t does not automatically follow that every time a litigant alleges that the other party’s electronic production is deficient in some regard that the appropriate next step is to conduct a forensic examination.” Rather, “[w]hile inconsistencies or improprieties in a party’s discovery responses may justify forensic examination of related computers . . . there must be a ‘history of incomplete and inconsistent responses to [the inquiring party’s] production requests’ . . . before a forensic examination will be allowed.”

In short, “[t]he inquiring party’s skepticism that the opposing party has produced all of the documents sought is not sufficient to warrant a forensic examination.”

The lesson of Roop? Mere allegations or suspicions that a party responding to requests for ESI is less than forthcoming are unlikely to succeed; a solid record of non-compliance or misleading, inaccurate representations should be built prior to requesting that a court order a forensic computer examination.


Eric B. Levasseur is a partner with Hahn Loeser & Parks, LLP in Cleveland, Ohio.


Copyright © 2017, American Bar Association. All rights reserved. This information or any portion thereof may not be copied or disseminated in any form or by any means or downloaded or stored in an electronic database or retrieval system without the express written consent of the American Bar Association. The views expressed in this article are those of the author(s) and do not necessarily reflect the positions or policies of the American Bar Association, the Section of Litigation, this committee, or the employer(s) of the author(s).