Paragon Insurance Holdings, LLC v. Phillips

Filing 33

FORENSIC EXAMINATION ORDER as to Defendant Christian Phillips. See Order for details. Signed by Magistrate Judge Kyle C. Dudek on 3/10/2025. (CGW)

UNITED STATES DISTRICT COURT
MIDDLE DISTRICT OF FLORIDA
FORT MYERS DIVISION

PARAGON INSURANCE
HOLDINGS, LLC,
Plaintiff,
v.

Case No. 2:25-CV-54-SPC-KCD

CHRISTIAN PHILLIPS,
Defendant.

FORENSIC EXAMINATION ORDER AS TO DEFENDANT CHRISTIAN
PHILLIPS
WHEREAS Plaintiff Paragon Insurance Holdings, LLC (“Paragon”) and
Defendant Christian Phillips (“Phillips”) desire to have an expedited independent
forensic examination of electronically stored information (“ESI”) in the possession,
custody, or control of Phillips, hereby stipulate to and petition the Court to enter
the following Stipulated Forensic Examination Order (“Forensic Order”):

1.

Definitions. For purposes of this Forensic Order:
1.1

“Electronic Media” means any electronic or digital device or

account that is or was at any time after June 1, 2024, in Phillips’ possession,
custody, or control that contains or contained Potentially Relevant ESI, such as:
computers; laptops; tablets; smartphones; burner phones; dumb phones;
networks; servers; email accounts; cloud storage accounts (e.g. iCloud, Google
Drive, DropBox); text and short messaging applications (e.g. SMS, MMS,
iMessage, Signal, WhatsApp, Telegram, SnapChat, Slack, Discord); social media

accounts (e.g. Twitter, Facebook, Linkedin); hard drives; backup drives; flash
drives; and CD/DVDs. “Electronic Media” does not include devices or accounts
within Paragon’s possession, custody, or control.
1.2

“Potentially Relevant ESI” means ESI within the scope of

permissible discovery as provided within Federal Rule of Civil Procedure 26 that
Paragon contends to be trade secrets or “Confidential Information” (as defined in
Phillips’ Employment Agreement).
1.3

A “Forensic Collection” or to “Forensically Collect” means to

copy ESI from Electronic Media in a manner that captures and preserves, to the
extent technologically feasible, all original data and associated metadata of the
Electronic Media. Forensic Collection may take the form of mirror imaging (i.e. a
bit-for-bit copy of all ESI including any unallocated space or embedded, residual,
or deleted ESI) or logical extraction if mirror imaging is impracticable.
1.4

“Remediation,” “remediate” and “remediated,” as used

herein, means the targeted segregation, deletion, destruction, or other form of
irrevocable and irremediable removal of ESI, such that the ESI is not accessible for
use, copying, or disclosure.
2.

Appointment of Independent Expert. An independent expert (or

vendor) qualified in digital forensics and electronic discovery shall be appointed
to conduct the forensic examination as follows:
2.1

Counsel for Paragon and Phillips met to confer on the selection

on the selection of the expert. The parties agreed on the appointment of Jim Watt
of Beam Computer Forensics, LLC, as the Court’s expert.
2.2

At all times, the expert shall remain neutral and independent

of the parties, and shall avoid conflicts of interest. Thus, to the extent that the
expert has direct or indirect access to information protected by attorney-client
privilege, the work product doctrine, or other privilege or legally-recognized
2

protection from discovery, such disclosure will not result in any waiver of
privilege or protection. Furthermore, the expert shall be prohibited from engaging
in ex parte communications, except with the written approval of any party not
present or party to such communication.
2.3

The expert shall acknowledge that they will be bound by the

Confidentiality Agreement and Protective Order (the “Protective Order”)
executed between the parties, and be bound to the Protective Order as modified
herein. The expert shall be allowed to engage or hire other outside support as
necessary to comply with this Forensic Order, so long as the outside support also
signs and agrees to be bound by the Protective Order as modified herein.
2.4

Neither party may subpoena the expert in connection with this

action without the agreement of all parties.
3.

Identification of Electronic Media. Within three (3) business days

after the expert’s appointment, as provided in Section 2, Phillips shall provide the
expert and Paragon a list or lists identifying all his Electronic Media. Phillips’ list
shall identify each Electronic Media by type, and whether a forensic image of each
Electronic Media has been previously collected at the direction of his counsel, and
if so, identify the name of the company which collected the forensic image. For
any forensic images of Electronic Media that have or are in the process of being
collected at the direction of Phillips’ counsel as of the date of this Order, counsel
for Phillips shall provide to counsel for Paragon documentation sufficient to
identify evidence sufficient to lay an evidentiary foundation for the identification
and chain of custody of each device and forensic image collected, unless stipulated
otherwise between the parties. For any physical Electronic Media (e.g. computers,
smartphones, etc.), Phillips’ list shall provide the current or last known location
and, to the extent available, its manufacturer, model, and serial number. For
account-based Electronic Media (e.g. email accounts, cloud accounts, texting or
3

social media accounts, etc.), Phillips’ list shall include the account name and
service provider. If any Electronic Media that contained Potentially Relevant ESI
is no longer within Phillips’ possession, custody, or control, Phillips’ list shall state
so, describe the timing and circumstances of its disposition, and identify all backup or alternative sources from which the same Potentially Relevant ESI may be
recovered.
4.

Collection of Electronic Media. Phillips’ Electronic Media shall be

subject to Forensic Collection as follows:
4.1

The parties or the expert may request the Forensic Collection of

any Electronic Media that is identified pursuant to Section 3 above unless the
Electronic Media has already been Forensically Collected. Any Electronic Media
that has already been Forensically Collected by Phillips or Phillips’ counsel or
agent shall be submitted to the expert. The parties also may request by motion the
Forensic Collection of any Electronic Media that Phillips does not identify upon a
showing of good cause to the Court that such Electronic Media contains
Potentially Relevant ESI.
4.2

Phillips shall promptly make the Electronic Media requested

pursuant to Section 4.1 available to the expert, and the expert shall Forensically
Collect the Electronic Media. Phillips shall provide the expert with any passwords,
access credentials, release authorizations, or other information necessary to
complete the Forensic Collection or to process the ESI for search and potential
production or remediation as provided herein, but the expert shall not disclose
such passwords or access credentials to any other entity or person.
4.3

The expert shall promptly return any physical Electronic Media

to the producing party after completing its Forensic Collection and/or its
remediation as provided in Section 6 below.
4

4.4

The expert shall maintain the Forensically Collected ESI in a

secure location and shall not produce copies of the Forensically Collected ESI, or
any subset of such ESI, to anyone else except as required to comply with this
Forensic Order. All ESI that has been Forensically Collected and/or produced
pursuant to this Forensic Order shall be treated by the expert and any receiving
parties as if Phillips had designated them CONFIDENTIAL and subject to the
Confidentiality Agreement and Protective Order or, upon specific designation by
Phillips, as HIGHLY CONFIDENTIAL.
5.

Search for ESI. Any ESI that was Forensically Collected by the expert

or provided to the expert pursuant to Section 4.1 shall be subject to a search for
Potentially Relevant ESI as follows:
5.1

Paragon shall provide to Phillips a list of proposed search

criteria (e.g. searches by keywords, phrases, custodians, date ranges, metadata
fields, file types, or any combination thereof) reasonably tailored to return
Potentially Relevant ESI. The parties will endeavor to design search criteria to not
unduly infringe into privileged information, including work product, attorneyclient privileged information, and information protected by the common interest
privilege.
5.2

Within three (3) business days of receiving Paragon’s proposed

search criteria, Phillips shall state with specificity any objections he has to the
proposed search criteria and promptly meet and confer with counsel for the
requesting party to attempt to resolve the objection(s). If the parties cannot reach
an agreement regarding the disputed search criteria, the parties may submit the
disputed search criteria and objections to the Court and the Court will render a
decision consistent with the applicable Rules and Court orders.
5.3

Any search criteria to which Phillips did not timely and

specifically object, to which the Parties mutually agreed, or that this Court ordered
5

to be used shall be submitted to the expert. The expert shall apply the search
criteria on the collected ESI and, at Phillips’ request, either: (A) provide counsel
for all parties with a search report that identifies the number of documents or hits
returned by each search criteria and unique hit counts (“Hit Report”); (B) submit
the search results to potential production as provided in Section 7 below; or (C)
both.
5.4

If Phillips provides Paragon with only a Hit Report pursuant to

Section 5.3, the parties shall confer in good faith regarding whether any search
term in the Hit Report generates an overly broad, unduly burdensome, or
disproportionate number of hits. For purposes of this Forensic Order, any single
search term that returns more than 250 results shall be presumed to be overly
broad, unduly burdensome, or disproportionate. After reaching a mutual
agreement regarding the Hit Report results, or upon Court order if the parties are
unable to resolve any disputes after a good-faith conferral, the parties shall then
submit the Hit Report to the expert for potential production.
5.5

After receiving the initial production contemplated by this

order, Paragon may submit to Phillips one additional set of search criteria that
directly relate to the content or a file attribute of information Paragon contends to
be Confidential Information or a trade secret located within the Electronic Media,
subject to Phillips right to object to the new, modified, or amended search criteria
as provided in Section 5.2. The parties will work cooperatively to resolve any
unforeseen problems that may arise during the course of the search for ESI and, in
the event a discovery dispute arises for which the parties cannot resolve on their
own, they may submit the discovery dispute to the Court.
6.

Investigation and Remediation. The expert shall investigate and

prepare a report addressing: (1) whether any evidence exists suggesting that
Potentially Relevant ESI was destroyed, manipulated, obfuscated, concealed, or
6

removed from Phillips’ Electronic Media and, if so, whether the expert can recover
or restore such Potentially Relevant ESI; (2) whether the Potentially Relevant ESI
contains evidence that Phillips disclosed or transferred any files or information
related to Paragon or Reel Media to SPG or a third party; (3) whether any
information Paragon contends to be Confidential Information or a trade secret
related to Paragon or Reel Media was accessed, printed, or modified, or used and
the basis for that conclusion.

The expert also shall remediate any files or

information related to Paragon or Reel Media from Electronic Media if Paragon
requests it and either: (A) Phillips to whom the Electronic Media belongs consents
to the remediation; or (B) the Court orders it.
7.

Review and Production. If Phillips requests the expert to produce

ESI returned by searches as provided in Section 5.3 after modification as provided
in Section 5.4, then Phillips may review the search results for relevance and
privilege before production. Phillips must complete this pre-production review
within no more than ten (10) business days if the production file count is less than
1,500 and within no more than fifteen (15) business days if the production file
count is greater than 1,500 after Phillips authorizes the production or the Court
rules on a discovery dispute submitted to the Court pursuant to Section 5.4.

The

expert shall promptly produce to the requesting party all documents or ESI
resulting from a search that the producing party elected not to subject to preproduction review or, after the responding party’s pre-production review is
completed, the remaining search results subject to any appropriate redactions or
withholding by the producing party.
8.

Form of Production. Unless otherwise stipulated to by the parties,

requested by a party-retained digital forensics expert, or as ordered by the Court,
Phillips shall cause to be produced or authorize the expert to produce to Paragon
the production set in Relativity-compatible load-ready form, specifically:
7
SGR/72377691.1

8.1

All documents and ESI except for the file types specified in

Section 8.2 shall be produced in single page, Bates-label endorsed, Group IV, 300+
DPI tagged image file format (.tif) or, if color is material to the document or ESI, in
.jpg image file format, with any hidden comments and redlining visible.
8.2

All

electronically

stored

spreadsheets,

video,

audio,

multimedia, presentations (e.g. PowerPoint), and other electronic file types not
amenable to imaging and that do not require redaction shall be produced in native
file format with the metadata fields in Section 8.3 included if available for that file.
8.3

Each production should include corresponding extracted text

files (to preserve searchability), image cross-reference files in OPT format (to
identify the first and last pages of the original document), and a DAT load file (to
preserve metadata). The DAT load file should include the following fields and
metadata, or their nearest functional equivalents, to the extent such metadata is
available: Begin_Bates, End_Bates, Begin_Attach_Bates, End_Attach_Bates,
Custodian, All_Custodians, DateTime_Sent, DateTime_Received, Email_From,
Email_To,

Email_CC,

Email_BCC,

Email_Subject,

Title,

Author,

DateTime_Created, DateTime_Modified, DateTime_Accessed, DateTime_Printed,
File_Name,

File_Extension, File_Type,

Message_ID,

Conversation,

File_Size, File_Paths;

Participants,

Hash_Value,

Page_Count,

Time_Zone_Field,

Production_Volume, Native_Path_Link, OCRPath, Confidential_Designation,
and Has_Redactions.
8.4

All ESI should be processed in Coordinated Universal Time

8.5

Text messages and similar short message ESI (e.g. Slack, Teams,

(UTC).
etc.) shall be processed before search, review, and imaging into Relativity Short
Messaging Format (“RSMF”).
8

8.6

Document families (e.g. a parent email and any attachments)

shall be kept together in a production, such that each parent document is produced
with and immediately followed in the production by its child attachments.
Privileged members of a document family may, however, be replaced in the
production with a placeholder image slipsheet stating the reason for its
withholding (e.g. “Placeholder: Privileged Document Withheld”).
8.7

Phillips may redact privileged or otherwise legally protected

information (e.g. personal identifiable information protected by Fed. R. Civ. P. 5.2)
from documents and ESI before production; however, Phillips shall not redact
relevant or responsive documents or ESI on the basis that portions of that
document or ESI are not relevant or non-responsive.
8.8

ESI files produced from Phillips’ Electronic Media pursuant to

this Forensic Order shall be assigned and identifiable by unique, sequential
production Bates numbers, with the starting Bates number in the produced
filename and, for imaged documents and placeholders, Bates numbers branded in
the right footer of each imaged page. The production should begin with a unique
prefix specific to the Electronic Media from which the ESI was produced and be
followed by 6 placeholder digits. Where appropriate (e.g. for privilege logging),
unproduced ESI files lacking Bates numbers may be identified instead by unique
control numbers, DocIDs, or hash values that do not reveal the substantive content
of the file.
9.

Documentation by Expert. The expert shall document and maintain

an inventory of the Electronic Media that was identified, requested, and either
Forensically Collected or collected by another forensic examiner and transmitted
to the expert, as well as ESI that was Forensically Collected from such Electronic
Media. The expert may provide such inventories to counsel for the parties upon
request or as otherwise needed to comply with this Forensic Order. The expert
9

also shall document the steps he or she took and any findings he or she made
during either the Forensic Collection of any of Phillips’ Electronic Devices, the
search for Potentially Responsive ESI, and the investigation and attempted
recovery or remediation of ESI. Pursuant to Fed. R. Evid. 706, the expert must
advise the parties of any findings he or she makes, may be deposed by any party,
and may be called to testify or be cross-examined by the Court or any party.
10.

No Privilege Waiver. Nothing in this Forensic Order shall require

disclosure of information which is protected by the attorney-client privilege, work
product doctrine, or other privilege or immunity from discovery. The disclosure
of any privileged or work-product protected documents or ESI, whether
inadvertent or otherwise, is not a waiver of the privilege or protection from
discovery in this case or in any federal or state proceeding. This Forensic Order
shall be interpreted to provide the maximum protection allowed by Federal Rule
of Evidence 502(d), shall supersede the tripartite non-waiver elements of Federal
Rule of Evidence 502(b), and shall be enforceable and granted full faith and credit
in all other state and federal proceedings by 28 U.S.C. § 1738. In the event of any
conflict of law, the law that is most protective of privilege shall apply.
11.

Privilege Logging. To reduce the costs and burdens associated with

privilege logging, in lieu of providing a narrative privilege log, Phillips may
submit or authorize the expert to submit to Paragon a simple metadata log of ESI
redacted or withheld from production. The metadata log should contain the same
DAT metadata fields described in Section 8.3 of this Forensic Order to the extent
the metadata is available, plus a field identifying the applicable privilege or work
product claim (e.g. “Attorney Client Communication Privilege” or “Attorney
Work Product”), except the log may be redacted to the extent that such
information would reveal information protected by work product protection or
10

any applicable privilege. Such a metadata log will be deemed sufficient to comply
with Fed. R. Civ. P. 26(b)(5)(A).
12.

Allocation of Costs. Paragon shall pay the expert’s fees and costs,

subject to its right to seek recoupment of such fees as a taxable cost pursuant to 28
U.S.C. § 1920 if the expert determines that Phillips used or disclosed any
Potentially Relevant ESI other than the initial transmission of the email from his
Paragon email account to his personal gmail account.
13.

Miscellaneous.
13.1. Nothing in this Forensic Order shall serve to limit a party from

retaining or using its own experts.
13.2. Nothing in this Forensic Order shall serve to waive any party’s
rights to object to the admissibility of any evidence at a hearing or trial in this
matter.
13.3. Nothing in this Forensic Order shall be construed or presented
as a judicial determination that documents or information assigned a
Confidentiality Designation are in fact confidential or subject to protection under
Rule 26(c) of the Federal Rules of Civil Procedure or otherwise until such time as
the Court may rule on a specific document or issue.
13.4. The parties may extend or modify any deadline set by this
order by written mutual agreement.
ENTERED in Fort Myers, Florida on March 10, 2025

11