this month’s installment from Cybercontrols

Cybercontrols, LLC




Court Approved Forensic Computer Examination

Inevitably, most commercial litigators have or will be facing an electronic discovery dispute that develops in such a way that a computer examination order is necessary to satisfy the reasonable demands of a requesting party. Of course, if your client is on the producing side, a computer examination request may not seem so reasonable.Nevertheless, a court order to allow the requesting party to conduct the forensic imaging and subsequent search and examination for relevant electronically stored information (ESI) is a process that most state and federal courts will exercise their prerogative to implement a suitable protocol should the counsel for both parties fail to submit such a protocol.

Our firm strongly recommends that every effort be made in anticipation of a court ruling which would permit a forensic computer examination, to develop a fair and reasonable protocol that would cover the complete process and methodology to be followed by the forensic technician. Some considerations for the protocol might be:

1. Provisions for opposing partys computer expert to be present in order to observe the assigned forensic technicians practices in acquiring the bit-stream copies of the subject computers and/or media storage devices.

2. Provisions for two copies of each forensic bit-stream image to be produced-one for the examiner and the other for the producing party.

3. Instructions for the forensic examiner to conduct the search and recovery of ESI within the agreed upon search parameters:

a. List of search terms e.g., specific words, terms, sentences, names, specific dates, e-mail addresses, distinct descriptions etc. developed by both parties.

b. Search and recovery of computer users Internet history if applicable.

c. Examination and review of computer users software/hardware installation and de-installation history.

d. Search and review of all relevant computer system artifacts pertaining to the relevant actions of the user in timeline of interest.

4. Instruct the forensic examiner to generate a search hit summary report to both parties which is a numeric tally of hit results associated with each search term used to conduct the word search phase of the forensic examination. This provides full disclosure to both parties and the Court of the initial results.

5. Provisions to have the forensic examiner copy all search results onto a CD or DVD and have delivered to the producing party for their pre-production review process.

6. Upon completion of the pre-production review, the producing party will submit a privilege log along with their production less any identified privileged ESI.

You can call Cybercontrols at 847-756-4890 or find them online at

Leave a Reply

Please log in using one of these methods to post your comment: Logo

You are commenting using your account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s