UUnniivveerrssiittyy ooff SStt.. TThhoommaass LLaaww JJoouurrnnaall Volume 7 Article 12 Issue 3 Spring 2010 January 2010 UUssiinngg CCoommppuutteerr FFoorreennssiiccss ttoo EEnnhhaannccee tthhee DDiissccoovveerryy ooff EElleeccttrroonniiccaallllyy SSttoorreedd IInnffoorrmmaattiioonn Franz J. Vancura Follow this and additional works at: https://ir.stthomas.edu/ustlj Part of the Computer Law Commons RReeccoommmmeennddeedd CCiittaattiioonn Franz J. Vancura, Using Computer Forensics to Enhance the Discovery of Electronically Stored Information, 7 U. ST. THOMAS L.J. 727 (2010). Available at: https://ir.stthomas.edu/ustlj/vol7/iss3/12 This Note is brought to you for free and open access by UST Research Online and the University of St. Thomas Law Journal. For more information, please contact [email protected]. N OTE U C F E SING OMPUTER ORENSICS TO NHANCE THE D E ISCOVERY OF LECTRONICALLY S I TORED NFORMATION FRANZ J. VANCURA* “The duty to preserve relevant evidence is fundamental to federal litigation.”1 I. INTRODUCTION2 Failing to preserve and produce electronically stored information is costly for attorneys and clients alike: incompetent or unethical attorneys risk disciplinary action and violate the rules of professional conduct, dis- covery disputes anger overburdened judges, and the offending parties often pay the price—literally and figuratively.3 The expansive and seemingly re- lentless growth of electronic discovery continues to radically alter the civil litigation landscape in terms of scope, mechanisms, cost, and complexity.4 Unfortunately, this landscape remains ridden with electronic discovery re- * Gonzaga University, BA 2005, University of Saint Thomas, JD Candidate 2011. I am grateful to Mark Kosieradzki and Joel Smith for their help and encouragement in selecting this topic, to Laura Tushaus and the University of Saint Thomas Law Journal staff for all their hard work bringing this Note to publication, and to my parents and wife for their limitless encourage- ment, guidance, and support. Correspondence: [email protected] 1. Innis Arden Golf Club v. Pitney Bowes, Inc., 257 F.R.D. 334, 339 (D. Conn. 2009). 2. At the outset of this note, it is necessary to state what it does and does not attempt to accomplish. This note is solely limited to the discovery phase of pre-trial litigation. It does not deal with the eventual admissibility of any evidence gained through forensic imaging at trial. See Lorraine v. Markel Am. Ins. Co., 241 F.R.D. 534 (D. Md. 2007), which provides a thorough discussion of the issue of the admissibility of electronically stored information (ESI) and an exhaustive analysis of how ESI may be admitted into evidence. See also The Sedona Conference Working Group on Electronic Document Retention & Production, The Sedona Conference Commentary on ESI Evidence & Admissibility, 9 SEDONA CONF. J. 217 (2008) [hereinafter ESI & Admissibility]. 3. See, e.g., Genworth Fin. Wealth Mgmt., Inc. v. McMullan, 267 F.R.D. 443, 448 (D. Conn. 2010) (“Plaintiff’s motion for sanctions is warranted by the fact that it had to seek Court orders to obtain that to which it has been entitled but which the Defendants unreasonably and dubiously refused and possibly intentionally made unavailable. . . . The Defendants have wasted the Plaintiff’s and the Court’s resources in necessitating the judicial resolution of this discovery dispute.”). 4. PSEG Power N.Y., Inc. v. Alberici Constructors, Inc., No. 1:05-CV-657, 2007 WL 2687670, at *1 (N.D.N.Y. Sept. 7, 2007). 727 728 UNIVERSITY OF ST. THOMAS LAW JOURNAL [Vol.7:3 lated casualties or failures, which are ultimately preventable.5 Knowing and abiding by the rules of civil procedure are essential to conducting electronic discovery. At a minimum, this entails identifying when the duty to preserve electronically stored information arises, as well as the types of information that a litigant or potential litigant must maintain once the duty to preserve electronically stored information arises. Traditional discovery methods and knowledge of the federal rules of civil procedure are no longer sufficient for conducting competent electronic discovery.6 Competent representation in cases involving electronic discovery now requires a familiarity with a wide variety of technologies.7 One such technology of increasing importance is forensic imaging.8 Computer forensics is “the art and science of applying computer sci- ence to aid the legal process.”9 Broadly speaking, computer forensics in- volves the location, examination, identification, collection, preservation, and analysis of computer systems and electronically stored information (ESI).10 A forensic image, then, is an exact duplicate of the entire hard drive, and includes all the scattered clusters of the active and deleted files and the slack and free space.11 The courts vary significantly in their approaches to forensic imaging in civil litigation.12 Judges are more likely to allow forensic imaging in cases where a party seeking a Rule 26(c) protective order has failed to adequately fulfill its discovery obligations13 or when relevant evidence is being de- stroyed through the normal operation of a computer.14 Conversely, requests to access an opposing party’s computer(s) without proof of wrongdoing or 5. Id. 6. SeeAlan J. Ross & Gregory J. Krabacher, ELECTRONIC DISCOVERYIN 2007: DISCOVER- ING HOW LITTLE WE KNOW 1 (2007) (“The prevalent use of technology in business . . . has unsettled the formerly well-established procedures by which parties to federal litigation prepared their case in the pre-computer era.”). 7. See Mark L. Tuft, Ethical Challenges in Emerging Technology, 24 No. 4 GPSOLO 64, 64 (June 2007) (“A lawyer’s duties of competence and diligence could take on a new meaning as the practice of law becomes increasingly paperless. Competent representation requires more than le- gal knowledge. It also requires the skill, thoroughness, and preparation reasonably necessary for the representation.”). 8. Forensic imaging is also known as mirror imaging or forensic copying. It is different from forensic examination. 9. ESI & Admissibility,supranote 2, at 228. 10. Id. 11. United States v. Triumph Capital Grp., Inc., 211 F.R.D. 31, 48 (D. Conn. 2002). 12. See, e.g.,John B. v. M.D. Goetz, Jr., 531 F.3d 448, 459 (6th Cir. 2008) (“Because liti- gants are generally responsible for preserving relevant information on their own, such procedures, if at all appropriate, should be employed in a very limited set of circumstances.”). The Goetz court, however, went on to state in dicta that forensic imaging is not uncommon in civil discovery and that parties may choose on their own to preserve information through forensic imaging. Id. 13. Playboy Enters., Inc. v. Welles, 60 F. Supp. 2d 1050, 1054–55 (S.D. Cal. 1999) (allowing plaintiffs to forensically image defendant’s hard drive where defendant had a habit of regularly deleting relevant files from her computer). 14. See Antioch Co. v. Scrapbook Borders, Inc., 210 F.R.D. 645, 652 (D. Minn. 2002) (al- lowing plaintiffs to create a mirror image of defendant’s computer after finding that “Defendants 2010] DISCOVERY OF ELECTRONICALLY STORED INFORMATION 729 other exceptional circumstances are often unsuccessful.15 Courts, commen- tators, and litigating attorneys alike cite concerns about attorney-client priv- ilege,16 confidentiality,17 relevance,18 and cost19 when arguing against granting an opposing party direct access to personal or work computers in order to obtain a mirror image. Though not lacking a rational basis, these fears are all readily dismissible if counsel cooperate and employ effective procedural methods to protect their client’s private, irrelevant, or protected information. Yet, in the oft-quoted words of a federal judge, “[t]oo often, discovery is not just about uncovering the truth, but also about how much of the truth the parties can afford to disinter.”20 Thus, the thesis of this note is that foreseeable litigants should, and will likely be required to, forensically im- age relevant digital storage devices at the onset of litigation to remedy the negligent, grossly negligent, and intentional discovery abuses that waste the court’s time, wantonly increase the cost of litigation, and prevent the merit- based adjudication of a lawsuit. This note will further argue that courts should liberally grant a party’s request to forensically image and examine an opponent’s digital storage devices when there is strong evidence of spo- liation or other discovery abuses. To this end, Part II of this note will discuss when the duty to preserve ESI arises as well as the extent of that duty. Part III will address the pri- vacy, attorney-client privilege, relevance, and cost related concerns that often arise when forensic imaging is a potential component of civil litiga- tion. In Part IV, this note will discuss how voluntary or court-ordered imag- ing at the onset of litigation can help to solve the problems of Parts II and may have relevant information, on their computer equipment, which is being lost through normal use of the computer . . . .”). 15. See, e.g., Balfour Beatty Rail, Inc. v. Vaccarello, No. 3:06-cv-551-J-20MCR, 2007 WL 169628, at *3 (M.D. Fla. Jan. 18, 2007) (“Plaintiff’s requests simply seek computer hard drives. Plaintiff does not provide any information regarding what it seeks to discover from the hard drives nor does it make any contention that Defendants have failed to provide requested information contained on these hard drives.”). 16. See Cenveo Corp. v. Slater, No. 06-CV-2632, 2007 WL 442387, at *1 (E.D. Pa. Jan. 31, 2007) (defendants opposed imaging of their hard drives on the grounds that it might result in the disclosure of privileged information). 17. See Goetz, 531 F.3d at 460 (“The district court’s compelled forensic imaging orders here fail to account properly for the significant privacy and confidentiality concerns present in this case.”). 18. Hedenburg v. Aramark Am. Food Servs., No. C06-5257, 2007 WL 162716, at *2 (W.D. Wash. Jan. 17, 2007) (denying defendant’s request to image plaintiff’s hard drive and holding that “the central claims in the case are wholly unrelated to the contents of plaintiff’s computer”). 19. Citizens for Responsibility & Ethics in Wash. v. Exec. Office, No. 07-1707, 07-1577, 2008 WL 2932173, at *3 (D.D.C. July 29, 2008) (denying plaintiff’s request to image defendant’s hard drive failed after the court subjected plaintiff’s request to a cost/benefit analysis and deter- mined that a large portion of data was already irretrievably lost). 20. PSEG Power N.Y., Inc. v. Alberici Constructors, Inc., No. 1:05-CV-657, 2007 WL 2687670, at *9 (N.D.N.Y. Sept. 7, 2007) (quoting Rowe Entm’t, Inc. v. William Morris Agency, Inc., 205 F.R.D. 421, 423 (S.D.N.Y. 2002)). 730 UNIVERSITY OF ST. THOMAS LAW JOURNAL [Vol.7:3 III. Finally, Part V will advocate for liberal judicially ordered direct access when a producing party has failed to image its relevant digital storage de- vices or is otherwise negligent in its duties to produce relevant ESI. II. DUTY TO PRESERVE The destruction, intentional or otherwise, of non-privileged ESI rele- vant to anticipated or ongoing litigation is unethical and subverts the long- standing common law principal that “[m]utual knowledge of all the relevant facts gathered by both parties is essential to proper litigation.”21 Failing to preserve relevant evidence also violates the Model Rules of Professional Conduct’s prohibition against obstructing a party’s access to evidence.22 Forensic imaging all potentially relevant digital storage devices in anticipa- tion of litigation will help ensure full compliance with the Rules of Civil Procedure and Professional Conduct. This section explains when a party’s duty to preserve relevant, non-privileged evidence arises. It also explains what kinds of evidence a party must preserve, and argues that forensic imaging can be an efficient and cost-effective way to competently manage the earliest stages of a lawsuit involving the discovery of electronically stored information. A. When the Duty to Preserve Arises Although the duty to preserve evidence is well recognized at common law,23 many electronic discovery related casualties stem from counsel’s failure to adequately administer a timely litigation hold.24 Identifying the boundaries of the duty to preserve involves two related inquiries. First, a litigant must determine when the duty to preserve arises.25 The duty to pre- serve evidence “arises when the party has notice that the evidence is rele- vant to litigation or when a party should have known that the evidence may be relevant to future litigation.”26 This means that the obligation to preserve 21. Hickman v. Taylor, 329 U.S. 495, 507 (1947). 22. The Sedona Conference, The Case for Cooperation, 10 SEDONA CONF. J. 339, 353 (2009).See also MODEL RULESOF PROF’L CONDUCTR. 3.4(a), (d) (2006). 23. See FED. R. CIV. P. 37(f) advisory committee’s note (“A preservation obligation may arise from many sources, including common law, statutes, regulations, or a court order in the case.”). 24. See, e.g.,Major Tours, Inc. v. Colorel, No. 05-3091, 2009 WL 2413631, at *4–5 (D.N.J. Aug. 4, 2009) (defendants failed to issue a litigation hold for over a year after the duty to preserve definitively arose and were required to produce documents otherwise undiscoverable under the work product doctrine as a result); Zubulake v. UBS Warburg LLC, 229 F.R.D. 422, 424 (S.D.N.Y. 2004) (Zubulake V) (explaining the importance of a client’s obligation to heed coun- sel’s preservation instructions where, notwithstanding a timely litigation hold, employees deleted relevant e-mails). 25. Zubulake v. UBS Warburg LLC, 220 F.R.D. 212, 216 (S.D.N.Y. 2003) (Zubulake IV). 26. Fujitsu Ltd. v. Fed. Express Corp., 247 F.3d 423, 436 (2d Cir. 2001); see also Zubulake, 220 F.R.D. at 218 (“Once a party reasonably anticipates litigation, it must suspend its routine 2010] DISCOVERY OF ELECTRONICALLY STORED INFORMATION 731 documents necessarily begins at the onset of a lawsuit, but may arise before the initiation of any litigation. The concept of “future litigation” in the Federal Courts is largely unde- fined.27 Courts apply a case-by-case approach to determine whether a party has satisfactorily fulfilled its preservation duties.28 Therefore, it is impossi- ble to provide a definitive list of factors that will trigger the duty to pre- serve, but litigants are not without some guidance from the courts. The mere contemplation that an employee may sue sometime in the future does not generally trigger a firm-wide duty to preserve.29 Courts will look at the level of awareness among employees that future litigation may arise to de- termine if a party should have reasonably anticipated litigation.30 Con- versely, a potential plaintiff is under a duty to preserve evidence where she anticipates or considers filing a lawsuit.31 In tax litigation with the federal government, the circuit courts are split as to whether an audit triggers the duty to preserve in anticipation of litigation.32 As a general guideline, courts use the following factors to resolve a conflict about whether a duty to preserve exists: (1) the extent to which the producing party’s conduct was intended to affect the opposing party, (2) the foreseeability of harm to the opposing party, (3) the degree of certainty that the opposing party suffered injury, (4) the closeness of the connection be- tween opposing party’s conduct and the requesting party’s injury, (5) the moral blame attached to the opposing party’s conduct, and (6) the court’s desire to prevent the conduct in the future.33 When applying these criteria, courts seem especially focused on the disposition of the litigant (whether it is the plaintiff or the defendant) and the likelihood of litigation to determine whether a party was under an obligation to preserve. document retention/destruction policy and put in place a ‘litigation hold’ to ensure the preserva- tion of relevant documents.”). 27. Ronald C. Goss, Hot Issues in Electronic Discovery: Information Retention Programs and Preservation, 42 TORT TRIAL & INS. PRAC. L.J. 797, 813 (2007). 28. United States v. Grammatikos, 633 F.2d 1013, 1019–20 (2d Cir. 1980). See also Consol. Edison Co. of N.Y., Inc. v. United States, 90 Fed. Cl. 228, 259 (2009) (“[T]he facts and circum- stances of the individual case must be assessed to decide when litigation should be deemed by a court to be anticipated . . . .”); Mohrmeyer v. Wal-Mart Stores East, L.P., No. 09-69-WOB, 2009 WL 4166996, at *3 n.1 (E.D. Ky. Nov. 20, 2009) (holding that Wal-Mart did not violate discovery rules by destroying a restroom cleaning log as part of the company’s standard document retention policy where plaintiff waited over a year after a slip and fall accident to file a lawsuit. In many cases, notice and/or knowledge of the realistic threat of litigation will evolve more slowly, making the precise trigger date more difficult to determine). 29. Zubulake, 220 F.R.D. at 216. 30. Id. 31. Aetna Life and Cas. Co. v. Imet Mason Contractors, 707 A.2d 180, 184 (N.J. Super. 1998). 32. Deseret Mgmt. Corp. v. United States, 76 Fed. Cl. 88, 93 (2007) (noting conflicting holdings in the Second, Fourth, Fifth, and Sixth Circuits). 33. Velasco v. Commercial Bldg. Maint. Co., 169 Cal. App. 3d 874, 877–78 (1985) (citing J’Aire Corp. v. Gregory, 598 P.2d 60 (1979)). 732 UNIVERSITY OF ST. THOMAS LAW JOURNAL [Vol.7:3 Attorneys should begin formulating a litigation hold plan as soon as potential litigation becomes more likely than not. With a litigation hold plan in place, attorneys can monitor events to determine if any further action is necessary. As the probability of litigation turns from a mere possibility to likely, attorneys should begin to implement a litigation hold in order to avoid sanctions and ensure that all relevant evidence is available for production. B. What Parties Must Preserve We have already seen that a litigant or potential litigant must first de- termine when the duty to preserve arises. The second relevant inquiry is what must be preserved.34 Under the Federal Rules, opposing counsel is entitled to obtain discovery regarding “any non-privileged matter that is rel- evant to any party’s claim or defense.”35 Parties must retain all relevant documents in existence at the time the duty to preserve arises in order to adequately comply with Rule 26(b)(1).36 The duties to preserve and pro- duce relevant documents are ongoing throughout discovery and do not end after the initial disclosure.37 Litigants have a continuing duty to supplant disclosure of documents throughout the discovery phase of a trial.38 Because of the vast amount of potentially discoverable ESI, civil dis- covery and its corresponding duty to preserve and produce information has become increasingly complex and expensive.39 A typical company with 20,000 employees can expect to store a total of approximately 4.5 billion e- mails in little more than a decade’s time.40 This means that a company with even a fraction of 20,000 employees is capable of producing a staggering amount of ESI. Given the massive amount of potentially discoverable infor- mation, the courts cannot and do not expect that parties will attain perfec- tion in their preservation efforts.41 The standards for sufficient discovery have been set by years of judicial decisions analyzing misconduct and de- termining what a party must do to determine and meet its obligation to participate meaningfully in the discovery phase of a proceeding.42 34. Zubulake, 220 F.R.D. at 216. 35. FED. R. CIV. P. 26(b)(1). 36. Zubulake, 220 F.R.D. at 218. 37. Zubulake v. UBS Warburg LLC, 229 F.R.D. 422, 433 (S.D.N.Y. 2004) (Zubulake V) (“[T]he notion of a ‘duty to preserve’ connotes an ongoing obligation.”). 38. Id.at 433; FED. R. CIV. P. 26(e). 39. Pension Comm. of Univ. of Montreal Pension Plan v. Banc of Am. Sec., LLC, 685 F. Supp. 2d 456, 461 (S.D.N.Y. 2010). 40. Goss, supranote 27, at 799. 41. Pension Comm., 685 F. Supp. 2d at 461. 42. Id. at 464. 2010] DISCOVERY OF ELECTRONICALLY STORED INFORMATION 733 A party or potential party to litigation is free to choose how to preserve documents,43 and is not required to preserve every document in its posses- sion.44 However, it is well established that parties have a duty to preserve what they know or reasonably should know is relevant to the action, is reasonably likely to be requested in discovery, or is subject to a pending discovery request.45 To ensure a good faith effort in preserving all relevant documents, parties need to be proactive. This requires identifying privileged documents as well as locating “key players”46 to determine the location of non-privileged relevant documents for preservation.47 Once a party has ful- filled these obligations, it must produce any and all relevant, unprivileged documents that an opposing party properly asks for in a request for production.48 C. Producing Documents Rule 34 grants a litigating party the power to inspect, copy, test, or sample documents and other tangible things, yet this power is not absolute. All discovery is governed by the “proportionality principal” of Rule 26(b)(2)(C).49 The proportionality principal provides that a party need not preserve or produce documents when the potential benefits are outweighed by the bur- den or costs.50 Determining whether the production of documents is unduly burdensome or expensive turns primarily on whether it is kept in an accessi- ble or inaccessible format.51 Active data, online data, near-line data, and off-line storage or archived data are all typically classified as accessible.52 43. Zubulake v. UBS Warburg LLC, 220 F.R.D. 212, 218 (S.D.N.Y. 2003) (Zubulake IV). However, the 2006 Amendment to the Advisory Committee Note to Rule 34(a) makes clear that FED. R. CIV. P. 34(a) requires the producing party to translate in a readily usable form any docu- ments not stored in readily accessible forms. 44. Id. at 217; see also Malletier v. Dooney & Bourke, Inc., No. 04 Civ. 5316, 2006 WL 3851151, at *2 (S.D.N.Y. Dec. 22, 2006) (holding company had no additional duty to install equipment to preserve the conversations in a chat room). 45. Zubulake, 220 F.R.D. at 217 (“Must a corporation, upon recognizing the threat of litiga- tion, preserve every shred of paper, every e-mail or electronic document, and every backup tape? The answer is clearly, ‘no’.”). 46. Id. at 218 (the duty to preserve extends to those employees likely to have relevant infor- mation—the “key players.”). 47. The Sedona Conference, The Sedona Conference Commentary on Achieving Quality in the E-Discovery Process, 10 SEDONA CONF. J. 299, 320 (2009) [hereinafter Achieving Quality]. 48. SeeFED. R. CIV. P. 34. 49. Additionally, Rule 26(b)(2)(B) limits the preservation and production of ESI. “A party need not provide discovery of electronically stored information from sources that the party identi- fies as not reasonably accessible because of undue burden or cost.” FED. R. CIV. P. 26(b)(2)(B). 50. Thomas Y. Allman, Conducting E-Discovery After the Amendments: The Second Wave, 10 SEDONA CONF. J. 215, 221 (2009). 51. Zubulake v. UBS Warburg LLC, 217 F.R.D. 309, 318 (S.D.N.Y. 2003) (Zubulake I). See id. at 318–19, for a detailed description of the five categories of data, listed in order from most accessible to least accessible. 52. Id. at 319–20. 734 UNIVERSITY OF ST. THOMAS LAW JOURNAL [Vol.7:3 Conversely, data on backup tapes and erased, fragmented, or damaged data are usually deemed inaccessible.53 The main difference between accessible and inaccessible data is the format and speed of accessing the stored data. Accessible data is simply stored in a more readily usable format.54 Federal Rule 37(e) also governs a party’s duty to preserve relevant ESI. Rule 37(e) provides a safe harbor by limiting a court’s ability to sanc- tion a party “for failing to provide electronically stored information lost as the result of the routine, good-faith operation of an electronic information system.”55 At least one court has recently applied Rule 37(e) in a traditional discovery context and held that courts should apply Rule 37(e) narrowly.56 Litigants are still required, however, to preserve all relevant non-privileged documents. Rule 37(e) only protects genuinely surprised—as opposed to unwary—parties when they fail to preserve documents in the normal course of business and they could not reasonably foresee the impending litigation. In many cases involving electronic discovery, forensic imaging rele- vant digital storage devices at the onset of a litigation is a safe, efficient, and cost effective way to guarantee that a party adequately maintains all discoverable documents. The forensically imaged drives, like their original counterparts, are subject to the same discovery restrictions as traditional discovery. Thus, wary clients and attorneys can be assured that they will not be forced to produce trade secrets or irrelevant, confidential, or work-prod- uct-protected material to an opponent absent any future discovery abuses. III. BARRIERS TO FORENSIC IMAGING: COST, PRIVILEGE, PRIVACY, AND RELEVANCE The proportionality principal has many implications for a party wish- ing to forensically image a digital storage device. Chief among these impli- cations is cost. Other considerations include the inadvertent production of work product, privileged communication, irrelevant documents, and inva- sion of a party’s privacy.57 This section will address the issues precluding a more liberal attitude toward forensic imaging and will offer proposals to deal with these issues. 53. Id. at 320. 54. Id. See Citizens for Responsibility & Ethics in Wash. v. Exec. Office of the Pres., Nos. 07-1707 (HHK/JMF), 07-1577 (HHK/JMF), 2008 WL 2932173, at *3 (D.D.C. July 29, 2008), for a good example of how a court will apply the proportionality principal to decide whether to allow a party to access certain relevant ESI. 55. FED. R. CIV. P. 37(e). 56. Mohrneyer v. Wal-Mart Stores East, L.P., No. 09-69-WOB, 2009 WL 4166996, at *3 (E.D. Ky. Nov. 20, 2009) (“A narrow reading of Goetz is strongly suggested by Rule 37(e)”); see also John B. v. M.D. Goetz, Jr., 531 F.3d 448 (6th Cir. 2008). 57. See supra notes 16–19 and accompanying text. 2010] DISCOVERY OF ELECTRONICALLY STORED INFORMATION 735 A. Cost Cost is the one factor in forensic imaging that is difficult to mitigate.58 Market forces determine the cost of imaging and searching a digital storage device. In relatively small cases, the cost of imaging a single drive may be cost prohibitive.59 In larger cases, the cost of hiring an expert to forensically examine or reconstruct files on imaged storage devices can easily exceed hundreds of thousands of dollars.60 Yet, there are steps that parties to a lawsuit can take to make forensic imaging both feasible and a best practice during the discovery phase of litigation. First, the party requesting a forensic image can agree to pay the pro- duction costs.61 This is a particularly attractive option in cases where an opposing party cannot afford an expert to image or examine its digital stor- age devices; ordinarily, the producing party is responsible for all production costs.62 Courts have ordered cost shifting when the documents sought are relevant but not readily accessible or the producing party has committed egregious discovery abuses.63 Cost shifting takes the financial burden off of the producing party and encourages the requesting party to act efficiently in order to keep costs down. If the requesting party is unable or unwilling to bear the entire cost of production, courts may order, or the parties can agree, to share the costs of production.64 Aside from cost shifting, forensically imaging relevant storage devices at the outset of discovery can help reduce costs stemming from subsequent motion practice. Many discovery related casualties occur when parties fail to produce or preserve relevant documents. Such incomplete discovery dis- closures increase the overall cost of litigation because the offended party 58. But see Zubulake, 217 F.R.D. at 318 (“Electronic evidence is frequently cheaper and easier to produce than paper evidence because it can be searched automatically, key words can be run for privilege checks, and the production can be made in electronic form obviating the need for mass photocopying.”). 59. Citizens, 2008 WL 2932173, at *3 (“[T]he ‘typical cost of forensic imaging a 100 GB hard drive is between $400 and $1,000 and it takes approximately two to three hours to complete the imaging.’”). 60. Id. 61. Playboy Enters., Inc. v. Welles, 60 F. Supp. 2d 1050, 1058 (S.D. Cal. 1999) (granting plaintiff’s request to mirror image defendant’s hard drive but requiring plaintiff to pay all costs associated with the production of the mirror image). 62. See Oppenheimer Fund, Inc. v. Sanders, 437 U.S. 340, 358 (1978) (noting that under the discovery rules, “the presumption is that the responding party must bear the expense of complying with discovery requests . . . .”). 63. See Zubulake v. UBS Warburg LLC, 216 F.R.D. 280, 284 (S.D.N.Y. 2003) (Zubulake III) (“[C]ost-shifting is potentially appropriate only when inaccessible data is sought. When a discovery request seeks accessible data—for example, active on-line or near-line data—it is typi- cally inappropriate to consider cost-shifting.”). 64. See In re Two Appeals Arising Out of San Juan Dupont Plaza Hotel Fire Litig., 994 F.2d 956, 965 (1st Cir. 1993) (“Rule 26(f) expressly authorizes trial judges, following discovery con- ferences, to enter orders for ‘the allocation of expenses as are necessary for the proper manage- ment of discovery.’”).