Dialing It In: E.D.N.Y. Denies Motion to Compel Production of Cell Phone for Forensic Examination Upon Mere “Speculation” That Metadata Was Deleted or Altered

This blog has previously noted the recent uptick of district courts authorizing forensic experts to conduct examinations and forensic imaging of cell phones to ensure the preservation and production of relevant electronic data. While we have discussed recent cases that have ordered such forensic imaging, such examination is not appropriate in every case and courts must continue to keep such “drastic” and “intrusive” discovery measures in check. In this regard, the District Court for the Eastern District of New York recently denied a defendant’s motion to compel the plaintiff to produce, for forensic examination, a cell phone that recorded videos already produced by the plaintiff in native format.

In Aminov v. Bershire Hathaway Guard Insurance Co., the District Court began its analysis by noting that “[f]orensic examinations of computers and cell phones are generally considered a drastic discovery measure because of their intrusive nature.” Quoting the advisory committee’s note to the 2006 amendment to Federal Rule of Civil Procedure 34(a), the court stated that “[i]nspection or testing of certain types of electronically stored information or of a responding party’s electronic information system may raise issues of confidentiality or privacy.” But, the court acknowledged that, in certain circumstances, such forensic testing may be appropriate, including “in situations where a party can show improper conduct on the part of the responding party.” Thus, the court reasoned that “there must be good cause to order computer imaging … or similar forensic examinations, when a party has already produced the electronic information sought and in native format.”

Against this backdrop, the District Court determined that there was “no such justification” to order the forensic examination of the plaintiff’s cell phone based on the facts presented. The court explained that the motion was “based on misplaced and unsupported speculation.” Based on the defendant’s counsel’s “own analysis using a free online metadata tool,” the defendant alleged that there was “reason to believe that the metadata for the [produced] video was altered.” The defendant’s counsel did not assert anything about the free online tool used, or its reliability, but rather his own “set of assumptions on the less-than-unequivocal statement” provided by the online website when the plaintiff’s video was analyzed: “Metadata could have been changed or deleted in the past.” This “disclaimer” appeared for every file analyzed by the website.

In addition to the “uncertainty” of the online tool used, the court further noted that “the tool itself is not one designed to show alteration of metadata, but instead one that determines whether metadata exists.” That is, the website could potentially reveal that a video was produced without metadata, but the website did not suggest that it could be used to “infer metadata alteration or deletion.” Accordingly, the court found that the “disclaimer” that was the basis for the defendant’s motion was “hardly the thing on which one should base a motion to compel.” The court added, “[c]ounsel has layered a series of speculations upon a series of flawed assumptions and misguided understandings of the program.” Critically, the court noted that the plaintiff had already provided native versions of the video with “some metadata associated therewith.” Thus, with “no evidence of spoliation or alteration,” the court concluded that there was “no cause to require forensic examination of the cell phone on the speculation that additional metadata may exist or that the original metadata was altered.”

The Aminov opinion demonstrates that while there has been an increase in courts ordering the forensic examination of cell phones, parties seeking such relief still must provide sufficient justification. Bare assertions and assumptions based upon speculation will not suffice. Instead, a party seeking forensic examination must be able to show that there are “discrepancies or inconsistencies in the responding party’s discovery responses” or that there is “reason to believe that a litigant has tampered with the computer or hidden relevant materials that are the subject of court orders.” But the use of a free online tool that provides a “disclaimer” that metadata “could have been changed or deleted in the past” — especially when such a message is provided for every file reviewed on the website — will not do the trick.