Armour et al v. Wilson et al

Filing 81

STIPULATED ORDER by Judge Richard A Jones. The court GRANTS the parties' 80 stipulated motion for an order governing the examination of certain electronic evidence. (CL)

The Honorable Richard A. Jones

1
2
3
4
5

UNITED STATES DISTRICT COURT
WESTERN DISTRICT OF WASHINGTON
AT SEATTLE

6
7
8

PAUL ARMOUR, et al.,

9
10
11

Case No. 2:12-cv-00851 RAJ

Plaintiffs,
ORDER ON STIPULATED MOTION
OUTLINING COMPUTER AND EMAIL
EXAMINATION PROTOCOLS AND
PROTECTIONS

v.
REBECCA WILSON, et al.,
Defendants.

12
13

The court GRANTS the parties’ stipulated motion (Dkt. # 80) for an order governing the

14
15

examination of certain electronic evidence. The remainder of this order reproduces the parties’
proposed order.

16

COMES NOW, the Parties, by and through undersigned counsel, and stipulate to the
17

below protocols and protections as applied to the examination of the parties computers and
18

emails, and respectfully requests that the Court enter the following order.
19

ORDER
20
21
22
23
24
25

THIS MATTER having come before the above captioned Court on the stipulation of the
parties, hereby orders the following protocols and protections for the examination of the parties’
computers and emails:
I.

Data Necessary for Evaluating Forensic Images
The parties require copies of all images and emails created by their respective experts to

conduct a forensic examination according to the below protocols. The parties will also require
ORDER OUTLINING COMPUTER AND EMAIL
EXAMINATION PROTOCOLS AND PROTECTIONS
-1

LAW OFFICES OF

COSTELLO & ASSOCIATES, PLLC
1000 SECOND AVENUE, SUITE 1780
SEATTLE, WA 98104-2203
[phone]

1

copies of the acquisition forms, prepared contemporaneously with imaging the hard drives,

2

which should include: (1) Make, model, serial number and service tag (if available) of computer

3

as well as the Windows COA including the operating system and product key; and (2) Make,

4

model, serial number and size of the hard drives. If this information is not contained in the

5
6
7
8

acquisition forms, identification of the image file names should be matched up with the hard
drives and computers.
II.

Method of Searching Data

A. Computer Images
All searches are restricted to the time period from November 1, 2011 through May 23,

9

2012. The images will be loaded into a computer forensic program called EnCase and may also
10
11
12

be loaded into computer forensic programs called X-Ways Forensics and/or AccessData’s
Forensic Toolkit. Any hard drives that contain an Apple operating system may also be loaded
into a program called MacForensics Lab. The downloaded emails may be loaded into one of the

13

above programs or into another program called Proof Finder. For the hard drives, the parties will

14

identify the user profiles, the type and installation of the operating system, all software installed

15

on the computer and all hardware and networking devices.

16
17

B. Internet Activity
The experts may run a program called Internet Evidence Finder against all of the hard

18

drives. This program is designed to extract fragments of web-based email communications and

19

other internet activity. The parties will also review the computers to determine if any of them

20

were used to access the Armour and Chase Comcast email accounts, or the lindaflagery email

21

account. This search will also include IP address history for each computer, any logs

22
23
24

demonstrating text messages synchronized with the computer, internet logs, wireless logs for
computer, logs demonstrating the receipt of eBlaster reports, and logs of any backups or
alterations of the computers during the relevant time frame.

25
ORDER OUTLINING COMPUTER AND EMAIL
EXAMINATION PROTOCOLS AND PROTECTIONS
-2

LAW OFFICES OF

COSTELLO & ASSOCIATES, PLLC
1000 SECOND AVENUE, SUITE 1780
SEATTLE, WA 98104-2203
[phone]

C. Keyword Searches
1

The experts will search the hard drives and the emails for a series of specific keywords or
2
3

keyword combinations. Depending on the results of the keyword searches, additional discussions
may need to take place between the parties to modify or enhance these keywords.

4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

General Keywords
[e-mail]
[e-mail]
[e-mail]
[e-mail]
Linda Patterson
Eblaster
Spector Pro
Equifax
Experian
ConsumerInfo.com
FreeCreditScore.com
ProtectMyID.com
Experian.com
TD Ameritrade
WHPS (case sensitive)
ABHC
MyCharts
Swedish
*2335
1-6LYIW6A
Kari (in connection with other search terms)
Chase (in connection with other search terms)
Paul (in connection with other search terms)
Armour (in connection with other search terms)
physical therapist
relapse
illegal drugs
steroids
[e-mail]
[e-mail]
[e-mail]
98.203.252.75
[e-mail]
Joshparmour
206.188.36.191

25
ORDER OUTLINING COMPUTER AND EMAIL
EXAMINATION PROTOCOLS AND PROTECTIONS
-3

LAW OFFICES OF

COSTELLO & ASSOCIATES, PLLC
1000 SECOND AVENUE, SUITE 1780
SEATTLE, WA 98104-2203
[phone]

1
2

D. Activity on Specific Dates.
All searches are restricted to the time period from November 1, 2011 through May 23,

3

2012. However, the experts will be allowed to conduct an in depth search of email and computer

4

activity logs for the dates February 16, 2012 and March 9, 2012 through April 9, 2012.

5
6
7
8

E. Examination of Preservation Process.
If the review of the forensic images gives rise to a dispute about the completeness of the
image or the process by which the technicians prepared them, the parties will meet and confer
about that dispute. If they are unable to resolve the dispute, they will contact the court’s in-court
deputy clerk to discuss either filing a motion or holding a status conference to resolve the

9

dispute. If necessary, the parties will make their expert’s available for depositions and provide all
10

additional documentation the parties are entitled to under FRCP 26.
11

F. Protocol for Expert Communications.
12

The parties have agreed to the following process for facilitating expert communication
13
14
15

and avoiding any further miscommunications: (1) All communications between our experts
needs to be in writing; (2) If communications are by email, counsel for all parties will need to be
cc’ed; (3) If oral communication is necessary and cannot be avoided, the conversations need to

16

be immediately preserved in writing, submitted to all parties, with all parties given a reasonable

17

amount of time to respond before any action is taken by the experts; and (4) Meetings between

18

the experts will need to occur with counsel for both parties present.

19

G. Protocol for the Exchange of Computer Images

20

Plaintiffs' expert will provide a copy or the original of the image for the Macbook Pro to

21

defendants' expert and defendants' expert will provide copies or the original of all the hard drive

22

images and emails it has created to plaintiffs' expert. The images should be shipped overnight

23

through a carrier that provides a tracking number or other method of verifying delivery. The

24

experts should ship the copies of the images within 24 hours of receiving authorization.

25
ORDER OUTLINING COMPUTER AND EMAIL
EXAMINATION PROTOCOLS AND PROTECTIONS
-4

LAW OFFICES OF

COSTELLO & ASSOCIATES, PLLC
1000 SECOND AVENUE, SUITE 1780
SEATTLE, WA 98104-2203
[phone]

On April 15, 2013 the parties shall return all originals and copies of the computer images

1
2

to the originating expert. Any extension of this deadline will need to be agreed to by the parties

3

or ordered by the Court in advance of this date. Once returned, the experts shall retain copies of

4

these images until 90 Days of the resolution of this matter or otherwise ordered by the Court or

5
6

agreed to by the parties.
III.

Protective Order
The computer images for the Plaintiffs’ MacBook Pro will remain in the exclusive

7

custody of the Plaintiffs’ expert at all times that it is not being reviewed by the Defendants’
8

expert. At the end of Defendants’ examination, the original and all copies shall be returned to the
9
10
11
12
13

Plaintiffs’ expert.
All other computers images will remain in the exclusive custody of the Defendant’s
expert at all times that it is not being reviewed by Plaintiffs’ expert. At the end of Plaintiffs’
examination the original and all copies shall be returned to the Defendants’ expert.
The results and fruits of any of the above examinations are deemed protected material.

14

Possession of protected material is limited to the attorneys of record in the above captioned case

15

and their experts. The counsel and their experts may not share or review the protected material in

16

any manner with any other person, including their respective clients.

17

The data resulting from the search of the computer hard drives will be forwarded to the

18

attorney for the computer owner for review. No data will be provided to opposing counsel until

19

it has been reviewed and released by the computer owner or its representative. An index of the

20
21
22

data that was forwarded to counsel for the owner will be included with the data. This index will
include the file name, the date created and the file size if available. Not all data that is produced
will necessarily be in the form of a file so in those situations the type of data available will be
identified on the index (e.g., spreadsheet of Internet activity). The computer owner or its

23

representative will identify on the index the data that should be not produced and the basis for
24

withholding the data, and the rest will be provided to counsel requesting the data, along with the
25

index showing the information that was withheld.
ORDER OUTLINING COMPUTER AND EMAIL
EXAMINATION PROTOCOLS AND PROTECTIONS
-5

LAW OFFICES OF

COSTELLO & ASSOCIATES, PLLC
1000 SECOND AVENUE, SUITE 1780
SEATTLE, WA 98104-2203
[phone]

Parties reserve the right to object to withholding of any data, and counsel for the parties

1
2

shall cooperate on procedures to resolve disputes about withheld data from the search terms

3

while preventing dissemination of the documents outside of counsel and experts. If the parties

4

cannot resolve a dispute as to the production of withheld data, then the withheld data may be

5

submitted for in camera review by the court as to its whether it must be disclosed.
This order does not prevent counsel from discussing the contents of documents

6

containing personal information with their respective clients or witnesses, as long as counsel
7

does not share the documents or any personal information (dates of birth, social security numbers
8

and other contact information) with the Defendants or their respective witnesses. Counsel and
9

their experts shall keep any protected material secured whenever the protected material is not
10
11
12

being used in furtherance of their work in the above captioned matter. The parties may aid their
counsel in the review of contents of their own email accounts only, so long as counsel takes
appropriate steps to prevent disclosure of any other data to the parties.

13
14

The results and fruits of any of the above examination may only be used in the above
captioned proceedings. They may not be used in any other State or Federal Court proceeding.

15
16

Any confidential communications between the parties and their attorneys (in this or any
other matter) or their spouses will not be disclosed to the parties or their counsel.
The parties will file all evidence obtained in their examinations with the Court under seal.

17
18
19
20
21
22

Any motion to seal evidence will be made without prejudice to either party.
IV.

Examination of Plaintiffs MacBook.
The parties may examine the Plaintiffs’ MacBook image for evidence that it was used to

access Defendants’ AOL account “[e-mail]” in April of 2012 and for reference to the
eBlaster program. Plaintiffs reserve their right to object to the evidence sought herein as
unrelated to any claims and defenses pending in this case, but agree to the search under general

23

discovery. This search will consist of the following keywords:
24
25
ORDER OUTLINING COMPUTER AND EMAIL
EXAMINATION PROTOCOLS AND PROTECTIONS
-6

LAW OFFICES OF

COSTELLO & ASSOCIATES, PLLC
1000 SECOND AVENUE, SUITE 1780
SEATTLE, WA 98104-2203
[phone]

1

MacBook Keywords
69.50.219.44
10.104.8.97
Steen
Freshstart
Eblaster
spectorsoft
AOL*
[e-mail]

2
3
4
5
6
7
8
9

This search shall be limited to the registry and other activity logs and the IP and internet
address history of the MacBook. This search shall not include the substance of communications,

10

private, privileged or otherwise. The results of these searches will be disclosed to both parties

11

with all other protections noted above in section III applying.

12
13

Any other searches and examinations of the MacBook by the parties’ experts must be
within the protocols of section II and under the full protections applied in section III, including
disclosure of all search results to Plaintiffs’ counsel for review and objections prior to disclosure

14

to Defendants’ counsel.
15
16

DATED THIS 27th day of March, 2013.

18

A

19

The Honorable Richard A. Jones
United States District Court Judge

17

20
21
22
23
24
25

STIPULATED AND AGREED TO:
COSTELLO LAW FIRM

OLYMPIC LAW GROUP, PLLP

S/ Kristine A. Costello, WSBA #20934
S/Jacob Lewis, WSBA #41856
Attorney for Rebecca Wilson & Ward Wilson
Costello Law Firm, PLLC
1000 Second Ave, Suite 1780
Seattle, WA 98104
Telephone: [phone]
Fax: [phone]

/s/ Anthony David Gipe
Anthony David Gipe, WSBA No. 30491
Dennis J. McGlothin, WSBA No. 28177

ORDER OUTLINING COMPUTER AND EMAIL
EXAMINATION PROTOCOLS AND PROTECTIONS
-7

LAW OFFICES OF

COSTELLO & ASSOCIATES, PLLC
1000 SECOND AVENUE, SUITE 1780
SEATTLE, WA 98104-2203
[phone]