Malibu Media, LLC v. John Doe subscriber assigned IP address 71.237.22.86

Filing 74

Stipulated PROTECTIVE ORDER for Production of Defendant's Computer Hard Drives for Imaging by Magistrate Judge Michael E. Hegarty on 1/26/2015. (evana, )

IN THE UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF COLORADO
Civil Action No. 1:13-cv-02385-WYD-MEH
MALIBU MEDIA, LLC,
Plaintiff,
v.
MIKE CUDDY,
Defendant.
_________________________________/
STIPULATED PROTECTIVE ORDER FOR PRODUCTION
OF DEFENDANT’S COMPUTER HARD DRIVES FOR IMAGING
Plaintiff has propounded requests to Defendant to produce for inspection all of
Defendant’s computer device hard drives at his residence. Defendant objected alleging that the
request calls for production of personal information, including financial information, that is
irrelevant, confidential, attorney-client privileged, work product protected, and not reasonably
calculated to lead to the discovery of admissible evidence.
The parties stipulate to the terms set forth below in order to protect privileged and nonrelevant information on the Defendant’s hard drives while allowing Plaintiff access to
Defendant’s hard drives.
1.

Plaintiff, Defendant, and their respective counsel are automatically bound by this

Protective Order. Prior to receiving any of Defendant’s hard drives, or an “image” of same, each
qualified persons defined in sections 1(a) - 1(d) below shall be provided with a copy of this Order
and shall execute and be bound by this Order by signing the agreement attached hereto as
Exhibit A, an original of which shall be maintained by counsel receiving the Defendant’s hard

1

drives. As soon as signed, the signed copy will be provided to Defendant’s counsel. “Qualified
persons” are defined as:
a. experts or consultants (together with their clerical staff) retained by such counsel
to assist in the prosecution, defense, or settlement of this action;
b. employees of attorney services or professional copy services retained by a counsel
of one of the parties;
c. court reporter(s) employed in this action; and
d. any other person as to whom the parties in writing agree.
2.

Plaintiff must obtain Defendant’s permission prior to allowing anyone besides

Martin Siefert and Patrick Paige from receiving Defendant’s hard drives or imaged hard drives.
3.

Plaintiff will engage the services of a local computer professional (“Computer

Professional”) to perform the imaging of the hard drives identified in Defendant’s response to
prior document requests. Plaintiff will be solely responsible for the cost and fee associated with
retention of this Computer Professional. Plaintiff has identified its Computer Professional as
Martin Siefert, of Proactive Discovery, LLC, 16890 East Alameda Pkwy #470129 in Aurora,
Colorado.
4.

Defendant may independently retain another computer professional, whose

presence is permitted during the imaging of the hard drives. Defendant has identified his
Computer Professional as Robert Kelso, Forensic Pursuit, 1432 Blake Street, Denver, Colorado.
5.

Prior to receiving any of Defendant’s hard drives, Mr. Siefert shall be provided

with a copy of this Order and shall execute and be bound by this Order by signing the agreement
attached hereto as Exhibit A, an original of which shall be maintained by counsel receiving the
Defendant’s hard drives.

2

6.

Imaging of Defendant’s hard drives will occur at Mr. Siefert’s office. Mr. Siefert

will travel to Defendant’s residence, take time-stamped photographs of each of the hard drives,
log a chain of custody regarding each of the hard drives, and transport them back to his office,
located as identified in paragraph 3.

Mr. Siefert will not make any attempt to engage in

conversations with Defendant other than as specifically related to the chain of custody of the
hard drives. Mr. Siefert will transport the hard drives to Forensic Pursuit, 1432 Blake Street,
Denver, Colorado 80202, as soon as possible after completion of the imaging. The imaging is
not to exceed 48 hours after receipt of the hard drives. To the extent Mr. Siefert is unable to
complete the imaging in 48 hours, he will immediately notify counsel for both Plaintiff and
Defendant by electronic mail. Mr. Siefert will log a chain of custody related to any transport and
transfer of the hard drives, including to Forensic Pursuit.
7.

Other than one copy of the imaged hard drives to be provided to Plaintiff’s

forensic expert, no additional duplicates or copies may be made or provided to anyone without
Defendant’s written consent. Mr. Siefert will provide verification in writing that he has only
made one copy of Defendant’s hard drives.
8.

Defendant represents and warrants that all computer device hard drives used or

which may have been used by Defendant during the Period of Recorded Infringement (7/19/2013
through 8/3/2013) are being produced for imaging.
9.

In order to obtain the requested information, Mr. Siefert will produce, in E01

Encase format, a forensically sound image of each hard drive using industry-standard software
and procedures.
10.

Mr. Siefert will use Tableau TD1 / TD2 Forensic Duplicator or CRU Ditto

Forensic FieldStation hardware. These are physical write-block devices that allow the
3

forensically sound acquisition of computer hard drives. In case the Tableau or CRU devices are
not suitable to perform an acquisition of computer hard drives, Mr. Siefert may choose to use one
or more of the following forensic boot CDs to create a forensic image: SANS SIFT Workstation,
RAPTOR or PALADIN. The use of forensic boot CDs requires that the Defendant provide the
username and password of a user with administrative level access to the devices. Defense
counsel will provide these credentials to Mr. Siefert after Mr. Siefert confirms that he is unable
to use the Tableau TD1 / TD2 Forensic Duplicator or CRU Ditto Forensic FieldStation hardware.
For any Mobile Devices to be imaged (Phones/Tablets), Mr. Siefert will use Oxygen Forensic
Analyst 2014 Edition software. If particular Mobile Devices are not supported by Oxygen
Forensic Analyst 2014, Mr. Siefert may utilize the Mobile Device manufacturer endorsed backup
solutions to capture data stored on the Mobile Devices.
11.

The parties agree that Mr. Siefert’s access to Defendant’s hard drives shall be

limited as set forth in this Order. Mr. Siefert is specifically permitted to view the directory
structure on the image of each hard drive only to verify that the imaging process was successful.
He is not permitted to view, preview, or search the contents of the hard drives or the images of
the hard drives. No further review or analysis shall be performed by Mr. Siefert without the
agreement of the parties or Court Order.
12.

After completion of the imaging described herein, the imaged hard drives will be

delivered to Defendant’s expert, Forensic Pursuit. Mr. Siefert will package and address the
imaged hard drives for eventual delivery to Plaintiff’s forensic expert, Patrick Paige. They will
be delivered to and held by Forensic Pursuit until such time as the Court enters the PO related to
searching, and Mr. Paige signs the PO.

4

13.

The parties expressly agree that neither Mr. Siefert’s, nor any other person’s,

review of privileged information, nor any inadvertent disclosure thereof, will constitute a waiver
of any privilege by Defendant.
14.

No further review or analysis shall be performed by Mr. Siefert without the

agreement of the parties or Court Order.
IT IS SO ORDERED January 26, 2015 in Denver, Colorado.

____/s Michael E. Hegarty________
UNITED STATES MAGISTRATE JUDGE

5

Exhibit A
I, ________________, residing at __________________, have read the foregoing Protective
Order and agree to be bound by the terms thereof, and I further stipulate and agree that the
United States District Court for the District of Colorado shall have personal jurisdiction over me
for the purposes of enforcing the terms of the Protective Order.
Per the specific terms of the foregoing Protective Order, I, __________________, understand
that I am only permitted access to Defendant’s hard drives as specified in the Protective Order.
I understand that there is a penalty for exceeding the authority granted by the Protective Order. I
will be held in contempt of Court with both civil and criminal penalties for violating the
authority granted by the Protective Order. Defendant will be permitted to publish to any person,
organization, or entity the fact that I am in contempt of this Court’s Order due to my violation of
the terms of this Order. I understand other penalties may be imposed should I exceed the
authority granted by the Protective Order.

By:

Printed:
Date:

6