From White v. Graceland College Ctr. for Prof’l Dev. & Lifelong Learning, Inc., 2009 U.S. Dist. LEXIS 22068 (D. Kan. Mar. 18, 2009):

[Discrepancies Warranting Production of Metadata]

The report provided by Plaintiff's computer expert … indicates that he found discrepancies between the creation and sent dates of the emails and attachments. Specifically, the expert noted that Email # 1 had a date stamp of July 2, 2004, however, the creation time of the email was three months later on October 4, 2004. The report further indicates that the expert found the metadata report for "CC Basic Form 06092004.doc," which was attached to the July 15, 2004 Emails # 2 and # 3, showed that the original document was created a month earlier on June 9, 2004. These discrepancies noted by Plaintiff's computer expert raise an issue as to whether Defendants' production of emails from the senders' "sent" folders satisfies Defendants' obligation under the Court's August 7, 2008 Order to produce the emails and email attachments in their native format. The Court finds that Defendants have adequately satisfied their obligation. Defendants' production of Email # 1 and attachment from the sender's archived folder, Email # 2 and attachment from the recipient's inbox folder, and Email # 3 and attachment from the sender's sent folder was sufficient to comply with their obligation under the Court's August 7, 2008 Order. Plaintiff did not specify, nor did the Court order, that Defendants produce the emails and attachments from both the recipients' inbox folder, as well as the senders' sent folder. For most cases where the creation dates of the emails and attachments are not an issue, production of the emails in their electronic native format from either the senders' sent folder or the recipients' inbox folder would be sufficient.

Notwithstanding the Court's finding that Defendants have satisfied their obligation with respect to the Court's August 7, 2008 Order, the Court finds that Plaintiff has shown that extenuating circumstances exist to justify compelling Defendants to re-produce in native format these emails and attachments from both the email recipients' inbox folders and the senders' sent folders. In this case, the creation date of the emails and attachments is disputed by the parties, Plaintiff's computer expert has noted discrepancies in the metadata as to the creation dates, and Defendants have not adequately explained the discrepancies. Under these circumstances, the Court finds that further inquiry and additional information is needed to explain the noted discrepancies in the creation dates of the emails and attachments. ***

[ Grounds for Obtaining Mirror Image of Hard Drive]

Plaintiff also requests that Defendant be compelled to produce mirror images of the hard drive of the computers that created any of the documents attached to the emails. ***

[Footnote 7] A "mirror image" is generally described as "a forensic duplicate, which replicates bit for bit, sector for sector, all allocated and unallocated space, including slack space, on a computer hard drive." See Balboa Threadworks, Inc. v. Stucky, No. 05-1157-JTM-DWB, 2006 WL 763668, at *3 (D. Kan. Mar. 24, 2006). See also The Sedona Conference Glossary: E-Discovery & Digital Information Management, 2nd ed. (Dec. 2007), p. 34.

Requests for physical inspection of another party's hard drives or requests for forensic and mirror imaging of hard drives are generally governed by Fed. R. Civ. P. 34(a)[(1)(A)], which allows a party to request that another party "produce and permit the requesting party . . . to inspect, copy, test, or sample . . . electronically stored information." The advisory committee notes to the 2006 amendment to Rule 34(a) suggest that direct inspection of an opponent's hard drive is not routine, but may be justified in some circumstances:

Inspection or testing of certain types of electronically stored information or of a responding party's electronic information system may raise issues of confidentiality or privacy. The addition of testing and sampling to Rule 34(a) with regard to documents and electronically stored information is not meant to create a routine right of direct access to a party's electronic information system, although such access might be justified in some circumstances. Courts should guard against undue intrusiveness resulting from inspecting or testing such systems.

At least three decisions in the District of Kansas have considered and permitted the inspection and forensic or mirror imaging of computer hard drives in the context of civil discovery. In G.D. v. Monarch Plastic Surgery,[239 F.R.D. 641, 648 (D. Kan. 2007),] the court granted the plaintiffs' request to compel production of computer for forensic testing or mirror imaging, but denied the request as to files or records related to non-parties and the defendants' employees. In another case, Balboa Threadworks, Inc. v. Stucky, [No. 05-1157-JTM-DWB, 2006 WL 763668, at *3 (D. Kan. Mar. 24, 2006),] the court commented that "[i]t is not unusual for a court to enter an order requiring the mirror imaging of the hard drives of any computers that contain documents responsive to an opposing party's request for production of documents." In Jacobson v. Starbucks Coffee Co., [, No. 05-1338-JTM, 2006 WL 3146349, at *6-7 (D. Kan. Oct. 31, 2006)] the court, noting that production of a computer for inspection is unusual, was persuaded that the circumstances of the case, including a history of incomplete and inconsistent responses to production requests, warranted production of the computer or a mirror image of the hard drive for the plaintiff's inspection.

In McCurdy Group v. American Biomedical Group, Inc., [Fed. Appx. 822, 831 (10th Cir. 2001)] the Tenth Circuit, in an unpublished 2001 opinion, upheld the lower court's denial of a request to compel production of the opposing party's computer hard drives for copying and mirror imaging. The Tenth Circuit called the request for a physical inspection of the opposing party's computer hard drives a "drastic discovery measure" given that the moving party had never explained why it should be allowed to inspect the hard drives and the only asserted reason for the request was because the moving party was skeptical that the producing party had produced copies of all relevant and nonprivileged documents from the hard drives.

While still cautious, many courts now consider requests for inspection or requests for forensic or mirror imaging of computers to be neither routine nor extraordinary.

[Footnote 16] John B. v. Goetz, 531 F.3d 448, 459 (6th Cir. 2008) ("To be sure, forensic imaging is not uncommon in the course of civil discovery."); Clearone Commc'ns, Inc. v. Chiang, Civ. No. 2:07cv00037TC, 2007 WL 3275300, at *1 (D. Utah Nov. 5, 2007) (imaging of opposing parties' computers is neither viewed as routine, nor completely extraordinary).

Apart from compelling production and inspection of computer hard drives and forensic imaging where trade secrets and electronic evidence are involved, courts have also compelled production based upon discrepancies or inconsistencies in a response to a discovery request or the responding party's unwillingness or failure to produce relevant information.

[Footnote 17] See, e.g., Koosharem Corp. v. Spec Personnel, LLC, Civ. A. No. 6:08-583-HFF-WMC, 2008 WL 4458864, at *2 (D.S.C. Sept. 29, 2008) (allowing forensic analysis on defendants' computers based upon failure to produce documents and due to the relevance of electronic information stored on the computers); Ferron v. Search Cactus, L.L.C., No. 2:06-CV-327, 2008 WL 1902499, at *2 (S.D. Ohio April 28, 2008) (allowing plaintiff's forensic computer expert to mirror image plaintiff's computer systems' hard drives based upon plaintiff's failure to place sufficient litigation hold and failure to otherwise produce the relevant information); P.J. ex rel. Jensen v. Utah, 247 F.R.D. 664, 672 (D. Utah 2007) (allowing defendants limited access to the relevant documents on the plaintiffs' crashed hard drive and computer because the plaintiffs provided only relevant research documents that they saved or printed); Orrell v. Motorcarparts of Am., Inc., No. Civ. 3:06CV418-R, 2007 WL 4287750, at *7 (W.D.N.C., Dec. 5, 2007) (allowing the employer defendant to conduct forensic examination of the plaintiffs' home computer where plaintiffs had wiped the hard drive of her work-issued laptop computer and had testified that she forwarded email to her home computer); Ameriwood Indus., Inc. v. Liberman, No. 4:06CV524-DJS, 2006 WL 3825291 (E.D. Mo. Dec. 27, 2006), as amended, 2007 WL 685623 (E.D. Mo. Feb. 23, 2007) (allowing independent expert to obtain and search a mirror image of defendants' computer equipment upon plaintiff presenting evidence suggesting that defendants failed to produce responsive email).