Is Forensic Imaging Warranted if Defendant Metadata Appears Inconsistent?

11 Nov 2013

Metadata, or data about data, is becoming a real hot topic in the area of plaintiff electronic discovery law. In an eDiscovery order in the case Teledyne Instruments, Inc. v. Cairns, et al., Case No. 6:12-cv-854-Orl-28TBS (M.D.Fl. October 25, 2013), plaintiff sued defendant for breach of contract and other business torts arising from a former employee applying for a patent that plaintiff claimed was its proprietary property.

The parties agreed to an ESI Protocol Order, and defendants initially produced 13,800 native files, each file containing a “load file,” called a “DAT file” with metadata. However, the initial DAT files did not have individual Bates stamping. The defendants then produced a “Replacement DAT” with updated files, and these files reflected electronic data from 18 separate electronic storage devices in defendants’ control.

So what was the problem? Plaintiff’s forensic computer expert noticed discrepancies and inconsistencies in the metadata from the original DAT files and the Replacement DAT files. Plaintiff therefore requested forensic imaging of all 18 devices, and even offered to bear the cost of such additional production. Defendants objected to the forensic examination of the devices and averred they had produced everything in accordance with the ESI Protocol Order, and that additional production would be unduly burdensome. Defendants also noted that the discrepancies in metadata were legitimate and expected: the initial production in native file format reflected the “application metadata,” while the Replacement DAT was from the file system and reflected the “system metadata.”

The court sided agreed that comparing dates and other information from “application metadata” vs. “system metadata” was NOT an apples to apples comparison. Plaintiff had not shown that this additional discovery would uncover relevant evidence. Finally, the court also noted that even if plaintiff bore the expense of the forensic imaging, it would still unfairly prejudicial to defendants to have 18 devices containing personal and irrelevant data collected.

So what is the difference between “application metadata” and “system metadata,” and why did the court agree that discrepancies between the two are normal and expected? More on this in our next blog!

ILS – Plaintiff eDiscovery Experts