In Teledyne Technologies, Inc. v. Raj Shekar, Case No. 15-cv-1392 (June 17, 2015), the Northern District of Illinois recently considered whether an image of a hard drive, if properly authenticated, could provide a forensics expert with enough information to draw conclusions.
Defendant, a former employee of Plaintiff technology company, worked for Plaintiff in marketing and signed a nondisclosure agreement, which prevented him from disclosing nonpublic information about Plaintiff. Plaintiff determined that Defendant did not comply with the agreement and terminated him, cutting off his access to Plaintiff’s network the same day. Plaintiff then filed suit for violating the agreement and obtained a temporary restraining order against Defendant and then a preliminary injunction. The court ordered Defendant to produce to Plaintiff “for imaging and inspection” all computers and other devices in his possession. Defendant produced a printer, an iPhone, a VPN token, and the image of an external hard drive (the FBI had possession of the physical laptop and hard drive as part of its criminal investigation into Defendant’s activities). The FBI provided Plaintiff’s expert with an image of Defendant’s hard drive.
The forensic computer expert determined that someone had accessed the laptop hard drive a number of times on the day of and after Defendant’s termination and that information had been moved from the hard drive to other hard drives. Defendant argued, among other things, that the expert could not have reliably analyzed the hard drive because he did not know what the FBI had done to it before imaging it. The court disagreed with Defendant, instead relying on the expert’s testimony that his lab frequently works from hard drive images, and that the expert’s lab had conducted several tests confirming that the imaged hard drive was from Defendant’s computer. The court concluded that the image file accurately represented the laptop on the date Defendant turned it over to the government, and found that the image provided sufficient information for the forensics expert to reliably draw conclusions.