WPCI +o X M݊/Vo,Y|hzjXtYPAoT` kUjhO[-"jwΞ9m4w kSK~jQJ?Q^CH>x"7CC^J ~<՛WSyK9E9C3'ķeӹԸof Q7MgYM$S8PLqFЎlr%sj[)TjqZ$"pԌ`k[MLGkOEui"AoG]s|a߃@A`&~rɮ= ' yB٧X) 0< U6" X 0h # UN %M(NC^ EwQ4Ui mk 0 0| 0s 0j 0^ 0R 0C 04 0" 1u 72 1ebH$ 0Nl 0 0D} 0c$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ B,<6X9`(Courier' TREACY A crebbert0crebbert .   <SC:Default ParaS\  `&Times New RomanSC<6X9`(CourierC\  `&Times New Roman<:Footnote Ref<6X9`(Courier New#|x(rc]$..       ?2X XG ?2hp color LaserJet 35000(9 Z6Times New Roman Regular X˩3 =3:i+00 U2P+M 0_level1  , 8.4 <DL!823  ..  5+ 4 <DL!5  2M+M 0_level2  X 5+4 44 <DL!523  ..  5+ 4 <DL!5  2M+M 0_level3   5+` ` ` <DL!523  ..  5+ 4 <DL!5  2J+M 0_level4   2( <DL!223  ..  5+ 4 <DL!5  2J+M 0_level5   2( <DL!223  ..  5+ 4 <DL!5  2G+M 0_level6   /% <DL!/23  ..  5+ 4 <DL!5  2G+M 0_level7  4 /% <DL!/23  ..  5+ 4 <DL!5  2D+M 0_level8  ` ,"< <<DL!,23  ..  5+ 4 <DL!5  2D+M 0_level9   ,"h hhDL!,23  ..  5+ 4 <DL!5  3#37=CIQYag1.a.i.(1)(a)(i)1)a)i) 35;AGMSY_11.a.i.1.a.i.1.a.- -http://www.thesedonaconference.org.(O$  $.$..       ;X X ;    1    _ԀU.S.DepartmentofJustice,OfficeofJusticePrograms.National  InstituteofJustice,SpecialReport: ForensicExaminationofDigital l Evidence:AGuideforLawEnforcement,April2004_NCJ_Ԁ#199408.((3.$ c]!..       6X X 6      1  (%$  1  (;3$2#  0  .3  0    d c]!..       ;X X ;  _         XXXXXX 8 ; dd8QUOTIENT,INC.*   p INTHE  Ѐ   X XB.` hp x (#XBPlaintiff   h   *   p CIRCUITCOURT v  X XE.` hp x (#X(#Evs.    h   *   p FOR < Ѐ  o BRIAN_TOON_0 0 (# (# h   *   p HOWARDCOUNTY R(#(#  E.` ` hp x (#X(#EDefendant   h   *   p CaseNo.13C0564087    E.` hp x (#` X(#E*********    3p x (#X(#3Q<< MEMORANDUMANDORDER T  <" ` p x (#X(#<  OnDecember20,2005,Quotient,Inc.( Quotient),acomputer j  consultingcompany,filedacomplaintagainstBrian_Toon_ 0 ( _Toon_),whowasQuotient,Inc.svicepresidentoftechnology  solutionsuntilOctober31,2005.TheComplaintallegesclaims l against_Toon_Ԁofbreachofcontract,conversion,_tortious_ 2 interferencewithcontractualrelations,_tortious_Ԁinterference H withprospectiveeconomicadvantage,andinvasionofprivacy.  QuotientallegesthatwhilestillaQuotientemployee,_Toon_  intentionallyandsurreptitiouslyprovidedaformerQuotient J employeeaccesstoQuotientscomputersystemsothattheformer !`  employeecouldobtainQuotientstradesecretsandconfidential "&" informationandusesuchinformationtocompetewithQuotient. $$   OnDecember21,2005,QuotientfiledanEmergencyMotionfor b&!& ExpeditedDiscoveryofDocumentsandPropertyPursuantto ((x#( MarylandRules2404,2422and15504( EmergencyMotion), )>%* seekinganordertopermitQuotientsretainedcomputerexpert +', _accessto Toonspersonalcomputersystem,harddrivesandback  upharddrives,disks,C.D.sand/orotherdata,backupdevices v orvehiclesinordertocaptureanimageoftheseitems. <   AtthehearingheldontheEmergencyMotiononDecember22,  R 2005,counselforQuotientfurtherlimitedtherequesttonow   haveaforensiccomputerexpertcopyToonspersonalcomputer    systemwithoutanyexaminationofthecontentsbyanyone, T  includingtheexpert,andhaveitheldinasealedfashionuntil j  thereisafurtherorderoftheCourt. 0   Insupportofthemotion,Quotientallegesthatitsearched  itsownbusinesscomputersanddiscoveredvariousemailsand l instantmessages( IMs)exchangedbetweenToonandtheformer 2 employeethatsubstantiatestheallegationsoftheComplaint. H QuotientallegesthattheseIMsandemailsshowthatToon  engagedinunlawfulandtortiousconducttothedetrimentof  Quotient.Byexample,QuotientpointstoanIMdatedJuly6, J 2005,inwhichToonandtheformeremployeediscusstheformer !`  employeesplanstobidagainstQuotientonupcomingworkwithan "&" existingQuotientclient.QuotientalsoreferstootherIMs $$ whichitbelievesindicatethatToonandtheotherexemployee b&!& discussedcompetingagainstQuotientfortheworksubmittedby ((x#( variousotherQuotientclients.Quotientalsosubmittedtothe )>%* CourtvariousotheremailsandIMswhichitclaimsindicatethat +', ToonwasusingnotonlyQuotientscomputersforsuch  communicationsbutwasalsousinghispersonalcomputerandhis v  homeemailaddresstodiscusstheformeremployeesnew < businessventureandthecomputersystembeingestablishedby  R thatemployee.Quotientalsosubmittedemailsthatshowthat   afterToonleftQuotient,heusedhishomecomputerto    communicatewithQuotientemployeesandtheformeremployee T  previouslyreferredtoaboutthemattersthatarenowthesubject j  ofthislitigation. 0   TherequestofQuotientistohaveacomputerexpertnot  employedbyQuotientto copythehomecomputerharddriveas l soonaspossibleinordertopreservewhateverrelevant 2 informationmaybeonit.AnaffidavitsubmittedfromQuotients H retainedexpert,PhillipA.Rodokanakis,indicatesthatdigital  evidenceisfragileandcanbeeasilylostthroughthecontinued  useofacomputersystem.Theexpertassertsthatthe J destructionofpotentialevidencecanbecompletely !`  unintentional: "&" 8  8`   Bythemerefactthatacomputeristurnedon $$ oroff,theOperatingSystem(OS)writesdata % % totheharddisk,whichcouldbeoverwriting b&!& dataofpossibleevidentiaryvaluethatmay E'"' existinunallocatedclusters.Unallocated ((x#( clustersmaycontaindatathatwaswrittento  )[$) thediskatanearliertime;thisdataorits )>%* fragmentscontinuetoresideonthesystems *!&+ harddisksevenaftertheoriginalfileswere +', deletedfromthesystem.Thedatafromthe  originalfilescontinueresidinginthese  unallocatedclustersuntiltheyareover v writtenbyanewfile.TheOSroutinely Y writestemporaryfilestotheharddiskthat < mayalsocontaindataofpossiblerelevance.  o GiventhattheOSonlyintendstocachethis  R datatotheharddiskonatemporarybasis,  5 anyfragmentaryinformationleftbehindcould   beoverwrittenatalatertime,whilea    computersystemcontinuestobeinuse.  ` x` x RodokanakisAffidavit,paragraphs9to11. T    Mr.Rodokanakisfurtherstatesinhisaffidavitthat j  acquiringaharddiskimageistheleastinvasivewaytoexamine 0 thetypeofcomputersystematissue.Heassertsthat a  forensicallysoundimageisacquiredinamatterofhoursthat l canbepreservedandexaminedatalatertime.Rodokanakis 2 Affidavit,Paragraph18.Healsoassertsthat theimage H acquisitionprocessispurelyamechanicalprocess.Atnotime,  doestheforensicexaminerviewtheunderlyingdatawhile  acquiringaforensicallysoundimageofthesuspectdisk. J RodokanakisAffidavit,Paragraph19. !`    Quotienthasmadetherepresentationthattheywillpaythe "&" fullandcompletecostofthecopyingprocessandwillabideby $$ anyrestrictiononaccessanduseimposedbythisCourt. b&!&   Toonraisesseveralobjectionstothisemergencyrequest. ((x#( First,hearguesthatthereisnoneedshownforsuchemergency )>%* reliefmeredaysafterthefilingofthelawsuit,andthatthe +', normaldiscoveryandbriefingprocessshouldbeallowedto  operate.Secondly,Toonarguesthattherehasbeenno v demonstrationthathehasintentionallydestroyeddocumentsof < anytypeorsoughttohidethem.Indeed,itappearsthatToon  R wascooperatingwithQuotientandtheircounselintheir   investigationoftheotheremployeesconductuntilrecently.      Finally,Toonalsoraisesthesubstantialconcernthatthe T  reliefrequestedherecouldleadtoaninvasionofthepersonal j  privacyofnotonlyMr.Toonbutalsoofhisspousewho, 0 accordingtocounselsrepresentations,usesthecomputerforher  ownpurposes.Whilethereisnowaytoquantifythepercentages l atthisjuncture,itcertainlyseemsfromwhatisbeforethe 2 CourtthatthepercentageofdatainToonspersonalcomputer H thatwouldberelevanttothislitigationwouldbesmallin  comparisontowhatwouldbecompletelyirrelevant.    Therearelegitimateconcernspresentedbybothparties. J ThereisnoevidenceatthisjuncturethatToonhasconcealedor !`  destroyedevidence,andQuotientsargumentonthispointseems "&" tobethathemayhavemotiveandopportunitytodosohavingnow $$ beensuedformillionsofdollars.Whilethismaybetrueasa b&!& generaltheory,thattheorywouldapplyineverycase.Thisis ((x#( notaconvincingrationaleforthespecialextraordinaryrelief )>%* soughtbyQuotient. +',   Morepersuasiveistheargumentthatthe unintentional   destructionofrelevantevidenceshouldbehaltedwhenitcanbe v donesoinafashionthatisminimallyintrusiveandwhere < Quotientiswillingtobearthefullcostoftheprocess.This  R Courtispersuadedfromtheevidencebeforeitthatthereisa   substantialprobabilitythatevidenceintheformofdeletedor    undeletedemails,IMs,and/orotherfilesthatarerelevantto T  thiscasecouldbemadelessaccessibletothepartiesmerelyby j  Toonsnormalcourseofcomputeruse,regardlessofhis 0 intentionsandmotive.    ItdoesappearfromtheevidencecurrentlybeforetheCourt l byattachments,affidavitsandtherepresentationsofcounsel 2 thatcommunicationsrelatingtothislitigationwereinfact H presentinToonscomputer,andthoseitemsortheremnants  thereofmaystillbethereinapresentlyretrievableformat.  WhiletheCourtissympathetictoToonscounselsconcernabout J beingrushedintoconfrontingthisissue,itshouldbenotedthat !`  allpartiesandtheinterestofjusticewillbelikelyadvanced "&" ifthenatureoftheallegedcommunicationscanbedetermined $$ withoutseveralmoremonthsof overwritingontheharddrive b&!& occurring. ((x#(   InlightoftheallegationsintheComplaint,Toondoesnot )>%* disputethathehasadutytopreserverelevantevidenceinhis +', possession.However,Toonhasnotarticulatedhowhewillmeet  thepreservationobligationbyameansotherthantheone v advocatedbyQuotient,i.e.,thecopyingoftheharddriveof < Toonspersonalcomputer.  R   Oneoftheleadingauthoritiesonelectronicdocument   productionrecognizesthatpreservationordersshouldonlybe    enteredwhennecessityhasbeenshown.TheSedonaPrinciples: T  BestPractices,Recommendations&PrinciplesforAddressing j  ElectronicDocumentProduction,27(July2005),availableat 0 4! "O  5  http://www.thesedonaconference.org.65"O5tem  7it5ԀHowever,thatreport  recognizesthevalueofsuchordersinpromotingefficient l litigation: 2 8  8`   Preservationordersmayincertain H circumstancesaidthediscoveryprocessby + definingthespecificcontoursofthe  partiespreservationobligations...  Preservationordersshouldbetailoredto  requirepreservationofdocumentsanddata g thatarepotentiallyrelevanttothecase, J andshouldnotundulyinterferewiththe - } normalfunctioningoftheaffectedcomputer !`  systems.!C!` x` x   ThepersonalprivacyconcernsofToonandhisfamilyare # # importantones.QuotienthasassuredtheCourtthatacopyof % % theharddrivecanbemadewithoutviewinganyoftheactualdata E'"' withindocumentsorcommunicationsthemselves.Thisissupported  )[$) bytheexpertsaffidavitbeforetheCourt.Quotienthasalso *!&+ indicatedthattheprimaryconcernscanbesatisfiedbyhaving  Toonscounselscreentheavailabledataforprivilege,privacy v andrelevanceconcernspriortoanydisclosuretoQuotient.This < wouldlessen,ifnotaltogetherobviate,thelegitimateconcerns  R ofToonandhisfamily.     Thisbeingthecase,theCourtwillpermitthecopying    processtoproceedbutunderrestrictions: T    H(4 4 <DL!` X(#H1.0 ` Asufficientlyqualifiedforensiccomputerexpertshall j  beallowedaccesstoToonscomputersystemtomakea 0 copyoftheharddrive.` (#` (# ?(4 4 <DL!44X!?  2.0 ` Inmakingthecopy,theexpertshallnotinspector l reviewanydocumentorcommunicationthatmayexiston 2 theharddrive.H` (#` (#   ?(4 4 <DL!44X!?3.0 ` Oncemade,thecopyoftheharddriveshallbekept  securebytheexpertandnotusedbytheexpertor  anyoneelseexceptbyfurtherorderofthisCourt.J` (#` (#   4.0 ` Toon,hiscounsel,andanyexpertoftheirchoosingmay !`  observethecopyingprocess."&"` (#` (#   ?(4 4 <DL!44X!?5.0 ` Thecopyingprocessshallproceedataplaceandtime $$ agreedtobycounselbutasquicklyaspossibleto b&!& minimizethefurtherlossofpotentiallyrelevantdata.((x#(` (#` (#   ?(4 4 <DL!44X!?6.0 ` Copiesmadeshallbelimitedtothosedeviceswherethe )>%* unintentionaldestructionofevidenceistakingplace +', bytheroutinecontinuinguseofthedevice.For  example,CDsnotincurrentuseandstoredwouldnotbe v unintentionallyerasedandwillbesubjecttotheusual < discoveryprocess. R` (#` (#   ?(4 4 <DL!44X!?7.0 ` Theexpertdesignatedtoperformthisfunctionshallbe   consideredtobetheCourtsexpertforthispurpose    andshalloperateunderthedirectionoftheCourts T  order.j ` (#` (#   ?(4 4 <DL!44X!?8.0 ` Theexpert,priortobeginningtheexpertswork,shall 0 agreeinwritingtoabidebythetermsofthis  MemorandumandOrder.l` (#` (#   ?(4 4 <DL!44X!?9.0 ` Quotientshallberesponsibleforanyharmordamageto 2 Toonscomputersystemthatmayresultfromthe H applicationoftheprocessrequestedbyQuotientand  orderedbythisCourt.` (#` (#   ?(4 4 <DL!44X!?10.0 ` Theexpertshouldfollowastandardforensicprotocol J suchasthatoftheNationalInstituteofJustice# %%  1      ׀and !`  shallfile,uponcompletionoftheprocess,a "&" certificationwiththecourtthattheprocessis $$ completeandtheprecautionstakentosecurethedata b&!& obtained.((x#(` (#` (#   TheexpertproposedbyQuotient,PhillipA.Rodokanakis,  appearstobewellqualifiedforthetask,andToonhasnot v raisedanyobjectiontohisqualifications.Quotientmayproceed < tohaveMr.Rodokanakisperformthisfunction,butmust  R understandandagreethatatthisjuncturethathewillbeacting   asanexpertunderthedirectionoftheCourt.Ifgiventhis    restriction,QuotientchoosesnottoproceedwithMr. T  Rodokanakis,itshallproposetotheCourt,afterconsultation j  withToonscounsel,anothersimilarlyqualifiedforensic 0 computerexperttoperformthetask.    Forthesereasons,itis,this23rddayofDecember, l 2005, 2   ORDERED,thattheEmergencyMotionforExpeditedDiscovery H ofDocumentsandPropertyisgrantedtotheextentthatthe  partiesareorderedanddirectedtoproceedasspecifiedinthis  MemorandumandOrder. J E.` hp x (#44X!E h !`  Ѐ(#(#K(# !C!    `     h     DennisM.Sweeney "&" ЀJUDGE # #  hCopiesMailed򀀀to: % % ChristopherJ.Heffernan,Esq.0  E.JamesThompson,Esq.E'"'(#(# PaulM.Finamore,Esq.0 h 0h(#h(#0(#(#523BenfieldRoad((x#((#(# Niles,Barton&Wilmer,LLP0  0(#(#SevernaPark,MD21146 )[$)(#(# 111SouthCalvertStreet )>%* Suite1400 *!&+ Baltimore,MD21202