Univar USA, Inc. v. Thanos

Filing 68

ORDER REGARDING FORENSIC EXAMINATION re 67 Order on Motion for Protective Order. Signed by Magistrate Judge David S. Cayer on 10/6/17. (tob)

IN THE UNITED STATES DISTRICT COURT
FOR THE WESTERN DISTRICT OF NORTH CAROLINA
CHARLOTTE DIVISION
3:17-cv-00338-MOC-DSC
UNIVAR, INC., a Delaware corporation,
Plaintiff,
v.

ORDER REGARDING FORENSIC
EXAMINATION

TAYLOR THANOS, a North Carolina resident,
Defendant.

THIS MATTER is before the Court after granting in part and denying in part Chem-Solv’s
“Motion for Protective Order” (document #33). See “Order” (document #67)

The Court now

enters this Protective Order. IT IS ORDERED as follows:
1.

A neutral forensic expert, Applied Solutions Group, shall create a forensic image

of each device described in Paragraph two of the Expedited Discovery Order. The devices
produced by Defendant shall be referred to collectively herein as "Defendant's Electronic
Devices".
2.

Spectrum Computer Forensics and Risk Management, LLC ("Plaintiff's Forensic

Expert") shall conduct the following analysis on each forensic image of Defendant's Electronic
Devices to the fullest possible extent:
a.

create an index of user files (including non-searchable image files)
containing one or more search terms, including name of file, file type, all
four New Technology File System ("NTFS") dates/times and full file paths;

b.

create an index of all emails in any .pst and .ost files, including the "To"
field, "From" field, "CC" field, "BC" field, date, time, subject and
attachment(s), if any;

c.

create an index of all .pst and .ost files, including all four NTFS dates/times,
and full file paths;

d.

create an index of all text messages, including the "To" field, "From" field
and dates/times.

e.

index identifying use of external storage devices, including dates/times of
use and files accessed, copied or deleted;

f.

index of all webmail accounts;

g.

index of cloud service(s) activity;

h.

any existence of shadow copies on computers running Windows Vista or
higher; and

i.

index of any system files that contain indications of files being accessed,
transferred, deleted or copied (collectively, the indexes in (a)-(i) are referred
to herein as the "Indexes")

3.

Plaintiff's Forensic Expert shall deliver the indexes to the parties' counsel. Plaintiff

will then identify on each of the indexes the files and/or emails it requests to be produced to it (the
"Requested Files"). If Defendant objects to the production to Plaintiff of any of the Requested
Files, Defendant's counsel may serve Plaintiff's counsel via email with written objections within
one (1) week after Plaintiff serves Defendant with the list of Requested Files. If Defendant does
not timely object to the production of any one or more file(s) and/or email(s) contained in the
Requested Files, Plaintiff's Forensic Expert shall produce the Requested Files to Plaintiff. If

2

Defendant timely objects to the production of one or more file(s) and/or email(s) contained in the
Requested Files, the file(s) and/or email(s) shall not be produced without a written agreement
between the parties or an Order of this Court, except that all file(s) and/or email(s) contained in
the Requested Files to which Defendant did not object shall be produced to Plaintiff.
4.

All information produced by Plaintiff's Forensic Expert pursuant to this Order,

including without limitation, all Indexes, files and emails, shall be deemed CONFIDENTIAL
pursuant to the Consent Protective Order [Doc. 12].
SO ORDERED.
Signed: October 6, 2017

3