NUCOR CORP., Plaintiff, v. John BELL and SeverCorr, LLC, Defendants C/A No. 2:06-CV-02972-DCN United States District Court, D. South Carolina, Charleston Division January 11, 2008 Counsel Adam C. Shearer, J.W. Nelson Chandler, James Walker Coleman, IV, Eric D. Welsh, William L. Rikard, Jr., Parker Poe Adams and Bernstein, Charlotte, NC, for Plaintiff. Greg Horton, William C. Cleveland, Buist Moore Smythe and McGee, Charleston, SC, Randall D. Lehner, Reed Smith, Chicago, IL, Jeffrey P. Macharg, Joseph F. Rodkey, Jr., Kristen R. Rydstrom, Tarek F. Abdalla, Reed Smith Shaw and McClay, Pittsburgh, PA, Wilbur O. Colom, Colom Law Firm Columbus, MS, for Defendants. Norton, David C., United States District Judge ORDER and OPINION *1 This matter is before the court on the parties' motions to exclude expert witness testimony under Federal Rule of Evidence 702 and Daubert v. Merrell Dow Pharmaceuticals, Inc., 509 U.S. 579, 113 S.Ct. 2786, 125 L.Ed.2d 469 (1993). Both parties have offered the testimony of purported computer forensics experts, and both parties now seek to exclude the testimony of the opposition's expert. For the reasons set forth below, defendants' motion is granted in part and denied in part. Plaintiff's motion is denied. I. BACKGROUND John Bell is a former employee of Nucor Corporation. In 1987, he began working for Nucor in a steel mill in Arkansas and became the melt-shop manager at Nucor's Berkeley County, South Carolina steel mill in 1995. In 2004, Nucor promoted Bell to the position of General Manger of Steelmaking Technologies, and he continued working at the Berkeley County mill. Bell worked in that position until early 2006, when he left Nucor to become SeverCorr's Executive Vice-President and General Manager of Operations. Bell is responsible for overseeing the construction and operation of SeverCorr's start-up steel mill in Columbus, Mississippi. During his time at Nucor-Berkeley, Bell directly supervised the development of processes for manufacturing Interstitial-Free/Ultra Low Carbon (IF/ULC) steel. IF/ULC steel is a high-end product commonly used in exposed and un-exposed automotive applications. Plaintiff contends that acquiring the ability to manufacture IF/ULC steel required a significant investment of resources and involved extensive trial-and-error, all overseen by Bell. Although other steelmakers manufacture IF/ULC steel, plaintiff contends that it is the only one to do so in a “mini-mill.” A “mini-mill” is a steel mill that uses scrap metal as the base material and differs from “integrated mills,” which produce steel from raw iron ore. Plaintiff contends that it acquired a competitive advantage by developing a unique method of producing IF/ULC steel in a mini-mill because it can produce the steel less expensively than steelmakers with integrated mills. Nucor asserts the process it developed for producing IF/ULC steel in a mini-mill is a trade secret as defined in the South Carolina Trade Secrets Act, S.C.Code Ann. § 39-8-20(5)(a). On October 6, 2006, plaintiff filed the instant action against defendants in the Court of Common Pleas for Charleston County, South Carolina, and defendants removed to this court. Plaintiff generally alleges that Bell and SeverCorr have misappropriated Nucor's trade secrets and plan to use that information to compete with Nucor, and that defendants have improperly solicited Nucor employees. Nucor's amended complaint thus asserted nine causes of action under South Carolina law: (1) misappropriation of trade secrets, (2) breach of contract, (3) breach of the duty of loyalty; (4) computer fraud and abuse; (5) tortious interference with contractual relations, (6) unfair trade practices, (7) civil conspiracy, (8) conversion, (9) unjust enrichment, (10) an equitable claim for imposition of a constructive trust, and (11) a request for injunctive relief. The court has issued an order dismissing the breach of contract claim to the extent it relied on a non-compete provision in the third confidentiality agreement. See Nucor Corp. v. Bell, C/A No. 2:06-CV-02972-PMD (D.S.C. filed Jan. 30, 2007). *2 Nucor has moved for a preliminary injunction, asking the court to enjoin Bell's employment at SeverCorr, to enjoin SeverCorr from manufacturing or preparing to manufacture IF/ULC steel, to enjoin Severcorr from hiring certain Nucor employees, and to enjoin defendants' use or disclosure of Nucor's trade secrets. Resolution of Nucor's motion for a preliminary injunction is partially dependent on the outcome of the instant motions and the motion for sanctions discussed below. Nucor's motion for a preliminary injunction is currently under advisement. Nucor has also moved for sanctions based on defendants alleged spoliation of electronic evidence. As the basis for its motion, Nucor contends defendants negligently and/or intentionally destroyed evidence found on John Bell's SeverCorr laptop computer (the “JR Bell laptop”) and a USB flash-drive device that Bell discarded. Nucor has requested that the court award sanctions in the form of default judgment or, in the alternative, by giving the jury an adverse inference charge. To support its claims of spoliation, Nucor offered the expert testimony of John Jorgensen, an expert in the field of computer forensics, who testified-among offering other opinions-that defendants engaged in the intentional deletion of data (known as “wiping”). Defendants countered Nucor's claims with the testimony of Dr. Sean McLinden, a purported expert in the field of computer forensics, who testified that there is no evidence to indicate that wiping occurred. The Daubert motions concern Jorgensen's and McLinden's testimony.[1] II. STANDARD OF REVIEW If scientific, technical, or other specialized knowledge will assist the trier of fact to understand the evidence or to determine a fact in issue, a witness qualified as an expert by knowledge, skill, experience, training, or education, may testify thereto in the form of an opinion or otherwise, if (1) the testimony is based upon sufficient facts or data, (2) the testimony is the product of reliable principles and methods, and (3) the witness has applied the principles and methods reliably to the facts of the case. Fed.R.Evid. 702.[2] Rule 702 imposes an obligation on the trial judge to ensure that any expert testimony grounded in scientific, technical, or other specialized knowledge “is not only relevant, but reliable.” Daubert v. Merrell Dow Pharms., Inc., 509 U.S. 579, 589, 113 S.Ct. 2786, 125 L.Ed.2d 469 (1993); Kumho Tire Co. v. Carmichael, 526 U.S. 137, 141, 119 S.Ct. 1167, 143 L.Ed.2d 238 (1999). The trial judge should first determine “whether the reasoning or methodology underlying the testimony is scientifically valid.” Daubert, 509 U.S. at 592-93. The trial judge should then consider “whether that reasoning or methodology can be applied to the facts in issue,” id. at 593, (i.e., whether the expert's testimony “fits” the facts of the case), see In re Paoli R.R. Yard PCB Litig., 35 F.3d 717, 742-43 (3d Cir.1994). Daubert provided a list of four non-exclusive factors to consider in assessing the reliability of an expert's testimony. The court may consider: (1) whether the expert's theory or technique can be, and has been, tested; (2) whether the theory or technique has been subjected to peer review and publication; (3) the known or potential rate of error when the technique or theory is applied; (4) whether the theory or technique enjoys “general acceptance” in the relevant community. See Daubert, 509 U.S. at 593-94. The Daubert factors are not exclusive, meaning the trial judge may consider any factors that speak to the overarching inquiry into the testimony's scientific reliability. See id. at 593; see also Kumho Tire, 526 U.S. at 150 (noting that the Daubert inquiry and what factors are relevant to the analysis “depends upon the particular circumstances of the particular case at issue”). To that end, courts have looked to other factors, including whether the expert's analysis leaves unexplained analytical gaps and whether the expert has reasonably accounted for alternative explanations. See Gen. Elec. Co. v. Joiner, 522 U.S. 136, 146, 118 S.Ct. 512, 139 L.Ed.2d 508 (1996); Claar v. Burlington N. R.R. Co., 29 F.3d 499, 502-03 (9th Cir.1994). Regardless of the factors considered, “the focus, of course, must be solely on the principles and methodology, not on the conclusions they generate.” Daubert, 509 U.S. at 595. *3 Federal Rule of Evidence 104(a)[3] applies to questions concerning the admissibility of an expert witness's testimony. Fed.R.Evid. 702 advisory committee notes (2000 amendment). Rule 104(a) places the burden on the proponent to prove admissibility. See Bourjaily v. United States, 483 U.S. 171, 107 S.Ct. 2775, 97 L.Ed.2d 144 (1987). Thus, the proponent of an expert witness's testimony bears the burden of proving that the witness has the necessary qualifications and that the expert's testimony is reliable. III. DISCUSSION A. Defendants' Motion to Exclude the Testimony of John Jorgensen Defendants do not dispute that John Jorgensen is qualified to testify as an expert in the field of computer forensics. They challenge only the reliability of Jorgensen's methods and conclusions pertaining to the alleged wiping of data on the JR Bell laptop. At bottom, defendants argue the unreliability of Jorgensen's testimony stems from flaws in every theory and methodology he employed to reach his opinion that wiping occurred. 1. Explaining the Large Blocks of Zeros At the heart of Jorgensen's intentional wiping theory are large blocks of zeros found on the JR Bell laptop hard drive. Jorgensen first explained this theory in his Second Report. He described the hard drive as having large, multi-gigabyte blocks of zeros surrounded by data. “Based on drive write protocols,” he opined, “there is no reason why such large areas of a drive, in these locations, should not contain data.” Second Jorgensen Report at 10. He concluded the only explanation for the zeros “involves the use of specialized software to specifically write zeros to defined locations on the hard drive with the purpose of permanently removing (‘wiping’) data from the hard drive.” Id. The Second Report did not offer an explanation for how the zeros were written to the drive. In his Third Report, Jorgensen did not offer a direct explanation for the large blocks of zeros. He concluded the programs Ultimate Cleaner and Ultimate Defender were downloaded, installed, and used on the JR Bell laptop. Third Jorgensen Report at 7-8. He also noted that “[a]lthough Ultimate Cleaner/Ultimate Defender is aggressively self-advertising software, it does perform effectively as a file and data erasing program and replaces data with zeros in its registered versions.” Id. at 8. Jorgensen did not directly link Ultimate Cleaner and Ultimate Defender to the large blocks of zeros. Jorgensen posited, however, that programs like WinHex could create blocks of zeros without leaving traces that they had been used. Id. at 12. He also offered an unclear explanation that the existence of a “hyberfil.sys” file inside a large blocks of zeros demonstrated that wiping had occurred. See id. at 13. In his the Fourth Report, Jorgensen explained the results of a data progression test he performed. Using a “fresh out of the box” Dell 610 hard drive, he proceeded to load large chunks of data onto the computer. In doing so, he explained that the data loaded “from left to right.” Fourth Jorgensen Report at 7. Extrapolating the results of that test to the JR Bell laptop, Jorgensen concluded that normal use of a computer would result in data being loaded left to right, rather than randomly throughout the drive as on the JR Bell laptop. Id. at 14. Jorgensen also elaborated for the first time on the “cypher.exe” program, a file included all Windows XP systems (like the JR Bell laptop). Jorgensen concluded that the program is capable of writing data “with zeros or random characters depending on how the program is used.” Id. at 11. He also concluded that the program “leaves known traces that are simple to remove.” Id. Finally, Jorgensen reiterated his belief that Ultimate Cleaner/Defender can be used to overwrite data with zeros, but did not opine that those programs were used to create the large blocks of zeros on the JR Bell laptop hard drive. Id. *4 Over time, some of the theories by which Jorgensen proposed that zeros were written to the drive have been eliminated as possibilities. McLinden noted that eScan cannot overwrite data with zeros in his May 5, 2007 report-the program only operates as an “antivirus solution.” McLinden May 5, 2007 Report at 35. Jorgensen has apparently accepted the validity of McLinden's conclusion because he has not mentioned eScan as a potential cause of the purportedly zero-ized data since his First Report. Moreover, the testimony and exhibits indicate that Jorgensen's opinion that Ultimate Cleaner and Ultimate Defender could cause the large blocks of zeros has been discredited. The manufacturer of Ultimate Cleaner and Ultimate Defender informed one of Jorgensen's associates that Ultimate Cleaner version 1.0-the version installed on the JR Bell laptop-did not have a “secure delete” function. See Sanctions Hrg. Def. Ex. 5. Indeed, the manufacturer told Jorgensen's associate that the version of Ultimate Cleaner with the secure delete function did not exist when the program was installed on the JR Bell laptop. See id. Finally, Jorgensen's and McLinden's testimony indicates that it would be very difficult to use the cypher.exe. program in a manner that would create the pattern of zeros found on the JR Bell laptop hard drive-even though it may be capable of doing so. See Sanctions Hrg. Tr. at 576-77; Sanctions Hrg. Tr. at 700-02. At bottom, defendants argue the totality of the evidence, combined with Jorgensen's admission that he cannot explain precisely what program was used to wipe the data, when the wiping occurred, who wiped the data, or what data was wiped,[4] makes his testimony unreliable under Daubert. Although defendants make valid points that speak to the weight the finder-of-fact may give Jorgensen's testimony, their criticism does not demonstrate that all of his testimony is so unreliable that it should be excluded. Jorgensen testified that there are programs available, like WinHex, that allow a user to overwrite data with zeros and leave no traces that the user ran the program. See Sanctions Hrg. Tr. at 80-81. Moreover, Madiant, the independent third-party consultant retained by the parties, also noted that these untraceable programs are available. Sanctions Hrg. Def. Ex. 6 at p. 3. McLinden has not refuted those conclusions. The Supreme Court has advised district courts to require more than the mere “ipse dixit” of the expert witness. See Gen. Elec. Co. v. Joiner, 522 U.S. 136, 146, 118 S.Ct. 512, 139 L.Ed.2d 508 (1997). In other words, an expert's testimony is unreliable if it contains “too great an analytical gap between the data and the opinion offered.” Id. In this case, the evidence that wiping programs exist that cannot be traced has sufficiently filled the gap between the data (the large blocks of zeros) and Jorgensen's opinion (that blocks of zeros represent intentional wiping). Moreover, Jorgensen has bridged that gap by actually testing his hypothesis and purportedly replicating the pattern of zeros on the JR Bell laptop hard drive. Finally, Jorgensen ran a test where he was able to replicate the pattern of zeros on the JR Bell laptop using WinHex. See Sanction Hrg. Tr. at 521-23. While Jorgensen has offered previous theories that have been discredited, that fact speaks more to his credibility and does not make his current testimony so unreliable that it must be totally excluded. 2. Jorgensen's Data Load Progression Tests *5 Jorgensen reasoned that the large blocks of zeros represent intentional wiping because they appeared at odd, non-consecutive sectors on the JR Bell laptop hard drive. A basis for Jorgensen's theory is that data should ordinarily load from “left to right” on a Dell hard drive. Thus, Jorgensen posits that the JR Bell laptop hard drive should have contained data that starts at the left of the drive and runs continguously to the right, without being interrupted by large blocks of zeros. Because the JR Bell laptop hard drive contains a left-to-right pattern of data followed by large blocks of zeros and then a large block of data, Jorgensen concluded that the zeros represent overwritten data. To test his hypothesis that data ordinarily loads from left to right, Jorgensen conducted what he called a “data load progression test.” As Jorgensen elaborated in his Fourth Report, “The purpose of the test was to determine how data was written to[a Dell D610] hard drive.” Fourth Jorgensen Report at 6. To conduct the test, Jorgensen purchased a new, “factory fresh” Dell D610 laptop, similar to the JR Bell Dell D610 laptop. Jorgensen noted that the new laptop appeared to have a configuration similar to the JR Bell laptop. He then took an initial defragmentation image of the fresh drive, which showed only a few blocks of data representing the factory-installed data and settings. He then proceeded to install software, including Microsoft Office and Adobe Acrobat reader. After setting up user and administrator profiles, Jorgensen downloaded many files from the internet until the drive was 58% occupied. He took analyzer images of the hard drive at regular intervals, demonstrating that the Dell laptop wrote the new data in a consistent left to right pattern. He performed the test a second time, and the second test produced similar results. See id. at 6-9 & attachment 3. Defendants argue Jorgensen's data load progression test is an unreliable method because it does not match how Bell used his SeverCorr Dell D610 laptop. Specifically, defendants note that “Mr. Jorgensen did not load and delete data in the same manner as the JR Bell Laptop, does not know how data was loaded to the Laptop, did not keep any records of how and when the files were loaded and deleted, and did not load the same type and number of files as those on the JR Bell Laptop.” Def. Mem. Supp. Mot. Exclude at 8. Because Jorgensen failed to replicate Bell's use of the computer, defendants argue his test does not replicate how Bell's computer ordinarily wrote data. An expert's testimony is only admissible if it will assist the trier of fact in understanding the evidence or in determining a fact at issue in the case. Fed.R.Evid. 702. The Supreme Court has explained that “[t]his condition goes primarily to relevance.” Daubert, 509 U.S. at 591. Relevance is judged on whether the expert's testimony “fits” the facts of the particular case. Id. However, “ ‘[f]it is not always obvious, and scientific validity for one purpose is not necessarily scientific validity for other, unrelated purposes.” Id. *6 Jorgensen's data load progression test is relevant and could assist the trier of fact in resolving some factual issues in this case. Jorgensen tested a simple hypothesis: whether a factory-fresh Dell computer, like the one Bell used, writes data in a left-to-right pattern. Jorgensen's test purportedly confirmed that it does. The trier of fact could find the results of the data load progression test useful because Jorgensen's test included the steps a user would ordinarily perform on a new computer, such as creating user profiles and loading new programs. Thus, the trier of fact could determine that Bell's computer, at some point in time, had a continuous block of data running from left to right on its hard drive based on Jorgensen's test and that the large blocks of zeros could represent wiped data. Defendants further argue that Jorgensen's test failed to account for the deletion and addition of data, and the effects of the Master File Table (MFT). The MFT first places new data on a drive in any previously allocated space that best fits the new data. If no previously allocated space is available, the MFT writes to previously unallocated space. Although Jorgensen's test did not consider the effects of previously allocated space, it demonstrates that the MFT will write to previously unallocated space in a left-to-right fashion. If the MFT writes to previously unallocated space from left to right, there should be a significant amount of data at the beginning of the drive, and any later deletions and additions to previously allocated space would occur in the same areas. Thus, Jorgensen's test could assist the trier of fact even if it did not consider how the MFT writes to previously allocated space. Finally, defendants contend that Jorgensen failed to adequately document how he performed the test, thereby rendering the test incapable of repetition. One of Daubert' s reliability factors is whether the expert's technique or theory can be or has been tested. See Daubert, 509 U.S. at 593-94. If an expert fails to document his tests such that they cannot be duplicated, then it would be reasonable to question the reliability of those tests. In this case, Jorgensen thoroughly documented each step of his test. The only missing information is the types of files he downloaded from the internet. But that information is not necessary to duplicate the test because there is no indication that the computer would write files in different locations depending on their type. Rather, the test can be duplicated with any data-making the type of file irrelevant to duplicating Jorgensen's test. See Sanctions Hrg. Tr. at 623-26. 3. Opinions Regarding the “hyberfil.sys” File Jorgensen's initial reports and testimony contained opinions regarding an irregular placement of the hyberfil.sys file on the JR Bell laptop hard drive. Jorgensen opined that the irregular placement of the hyberfil.sys file is indicative of wiping. Plaintiff now admits that Jorgensen is no longer relying on the hyberfil.sys file hypothesis to support his opinions. See Pl. Mem. Opp. Mot. Exclude at 17 n. 12. To the extent defendants assert Jorgensen's withdrawal of his own opinions suggests that his testimony is unreliable, that fact speaks more to his credibility as an expert witness than the reliability of the rest of his testimony. The withdrawal of his opinions regarding the hyberfil.sys file is not a sufficient basis to exclude his testimony on wiping. 4. Analysis of the Collingwood Computers *7 Jorgensen analyzed the hard drives of five or six other Dell computers that he obtained from another client. He analyzed the hard drives to determine if they had large blocks of zeros like the JR Bell laptop. He found that there were no large blocks of zeros, which he contends supports his conclusion that the JR Bell laptop hard drive is unusual. Defendants argue that Jorgensen's analysis of the so-called “Collingwood” computer hard drives is unreliable because Jorgensen cannot verify that they were used in the same manner as the JR Bell laptop and because they are not the same type of hard drive found in the JR Bell laptop. The only apparent similarity is that the hard drives were factory installed in the computers by Dell, as was the hard drive in the JR Bell laptop. Defendants are correct that the potential dissimiliarties between the Collingwood computers and the JR Bell laptop reduce the reliability of the results of their analysis. The reduction in reliability may well qualify the analysis as merely anecdotal evidence to support Jorgensen's opinions. Courts have considered an expert's reliance on anecdotal evidence as part of the Daubert reliability inquiry, often pointing to the use of anecdotal evidence as a marker of unreliability. See Allison v. McGhan Med. Corp., 184 F.3d 1300, 1312 (11th Cir.1999); Bradley v. Brown, 42 F.3d 434, 438-39 (7th Cir.1994). However, other courts have accepted the use of anecdotal evidence when used to confirm conclusions arrived at by other, more reliable methods. See Cantrell v. GAF Corp., 999 F.2d 1007, 1014 (6th Cir.1993). In Cavallo v. Star Enterprise, 100 F.3d 1150 (4th Cir.1996), the Fourth Circuit tacitly approved a district court's exclusion of an expert's testimony for over-reliance on anecdotal evidence.[5] Id. at 1159. The Fourth Circuit noted Daubert' s statement that “ ‘shaky but admissible evidence’ “ is best tested by “ ‘[v]igorous cross-examination, presentation of contrary evidence, and careful instruction on the burden of proof,’ ” but affirmed the district court's exclusion of the expert's testimony because the use of case studies was not a generally accepted method in the witness's field of expertise. See id. at 1158-59 (quoting Daubert, 509 U.S. at 595-97). The reliability of Jorgensen's analysis of the Collingwood computers is debatable. Nonetheless, his testimony indicates that what he discovered on them comported with his general experience that large blocks of zeros are uncommon on typical personal computers. See Sanctions Hrg. Tr. at 505-07. As discussed above, Jorgensen supported his wiping theory with other explanations-specifically the results of his data load progression test and his opinions on the availability of wiping programs that leave no traces. And even though his use of the Collingwood computers may be seen as “shaky” evidence, it is admissible and can be tested by defendants' vigorous cross-examination and presentation of contrary evidence. Finally-and significantly-defendants' expert admitted that analyzing other personal computers is a valid methodology. McLinden stated in an online forum that he planned on doing the same analysis: *8 I tried to get a factory fresh copy of the system but it is too old and they use a newer model. So, instead, I've rounded up a couple of systems that were purchased at the same time, and I'm going to image them, map the blocks that are written with zeros or a repeating pattern, and then see how these systems compare to the suspect drive. Pl. Sanctions Ex. 22. In light of the totality of the evidence, the court will not exclude Jorgensen's testimony as it relates to the Collingwood computers. 5. Ultimate Cleaner and Ultimate Defender Defendants argue that Jorgensen's opinions regarding the potential use of Ultimate Cleaner and Ultimate Defender have been so discredited that they are unreliable. The court agrees. Jorgensen opined in his Third Report that the program “perform[s] effectively as a file and data erasing program and replaces data with zeros in its registered versions.” Third Jorgensen Report at 8. He also noted that Ultimate Cleaner/Defender was installed and run on the JR Bell laptop in September and October 2006. Id. Jorgensen testified that Ultimate Cleaner is a wiping program at the sanctions hearing and stated that he found a registered version of that program on the JR Bell laptop. See Sanctions Hrg. Tr. 55-58. After that hearing, however, holes appeared in Jorgensen's opinions regarding Ultimate Cleaner and Ultimate Defender. Jorgensen's associate contacted the manufacturer of Ultimate Cleaner and Ultimate Defender. The manufacturer noted that only two versions of Ultimate Cleaner have been released: version 1.0 and Ultimate Cleaner 2007. The manufacturer further noted that the “secure delete option” (which is the program's ability to overwrite data with zeros) was only available in the 2007 version. Finally, because Ultimate Cleaner was installed on the JR Bell laptop in September 2006, it was “for sure” version 1.0 (presumably because Ultimate Cleaner 2007 was not available at that time). See Def. Sanctions Ex. 5. McLinden's testimony supports the manufacturer's statement: that Ultimate Cleaner 2007 was not the version on the JR Bell laptop. See Sanctions Hrg. Tr. at 677-78. Jorgensen tested Ultimate Cleaner's “secure delete” function, and he reported the results of the test in his Fourth Report. See Fourth Jorgensen Report at 11. He concluded that Ultimate Celaner can overwrite data using zeros and does not leave a trace that the particular function was used. See id. But it is clear from his report that Jorgensen performed his tests using Ultimate Cleaner 2007. See id. at Attachment 7. At the sanctions hearing, Jorgensen opined that the Ultimate Defender program installed on the JR Bell laptop had the same “secure delete” function as Ultimate Cleaner and that it could also overwrite data with zeroes. Sanctions Hrg. Tr. at 606-10. The only support for Jorgensen's theory was that the code for Ultimate Defender contained a “secure delete” subroutine and a “track eraser” function. Id . Moreover, Jorgensen stated that he could not state to a reasonable degree of scientific certainty that the Ultimate Defender version on the JR Bell laptop had a secure delete function, nor did he conduct any tests to determine if Ultimate Defender was capable of overwriting data with zeros. Id. *9 These facts demonstrate that Jorgensen's opinions on the wiping functionality of Ultimate Cleaner and Ultimate Defender are unreliable. First, the manufacturer has stated that the version of Ultimate Cleaner installed on the JR Bell laptop did not have the secure delete function, and was therefore incapable of overwriting data with zeros. Moreover, Jorgensen's tests on Ultimate Cleaner do not “fit” the facts of this case because he did not use the version that was installed on the JR Bell laptop. That disconnect is especially problematic when the evidence indicates the versions performed differently. Second, Jorgensen did not test the functionality of Ultimate Defender and was unable to state to a reasonable degree of certainty that it had the ability to overwrite data with zeros. In addition, his opinions on Ultimate Defender's purported ability to wipe data is conspicuously absent from his reports. For those reasons, the court excludes Jorgensen's testimony regarding Ultimate Cleaner and Ultimate Defendant as unreliable.[6] B. Plaintiff's Motion to Exclude the Testimony of Sean McLinden Plaintiff makes four arguments why McLinden's testimony fails to meet the requirements of Rule 702 and Daubert. First, plaintiff asserts that McLinden cannot qualify by virtue of his skill, knowledge, education, training or experience, as an expert in the area of computer forensics or the more specific field of computer wiping. Second, plaintiff contends McLinden's testimony is unreliable because he used “internet chat rooms” to form his opinions-a method plaintiff asserts is not generally utilized by experts in the field. Third, plaintiff asserts McLinden's testimony is unreliable because he did not use a “bit-for-bit” copy of the hard drive from the JR Bell laptop. Finally, plaintiff argues that some of McLinden's opinions should be excluded because they were not disclosed as required by Rule 26(b). 1. McLinden's Qualifications An expert may be qualified to offer his opinion on the basis of his education, knowledge, skill, training or experience. Fed.R.Evid. 702. Rule 702 is written in the disjunctive, meaning “a witness may be qualified as an expert on any one of the five listed grounds.” See Friendship Heights Assoc. v. Vlatismil Koubek, 785 F.2d 1154, 1159 (4th Cir.1986). The Fourth Circuit has held that a district court should be reluctant to exclude a witness on the basis of qualifications. See Thomas J. Kline, Inc. v. Lorillard, Inc., 878 F.2d 791, 799 (4th Cir.1989); see also Kopf v. Skyrm, 993 F.2d 374, 377 (4th Cir.1993) (“The witness's qualifications to render an expert opinion are also liberally judged by Rule 702.”). Moreover, the trial court should not hold a proferred expert to the highest standard of knowledge: “One knowledgeable about a particular subject need not be precisely informed about all details of the issues raised in order to offer an opinion.” Kline, 878 F.2d at 799 (citing Martin v. Fleissner GMBH, 741 F.2d 61, 64 (4th Cir.1984)). This liberal approach to qualifications under Rule 702 reflects the common-sense notion that a jury can adequately determine how much weight to assign a witness's testimony according to the quantity and quality of his or her education, knowledge, skill, experience, and training. See Holbrook v. Lykes Bros. S.S. Co., 80 F.3d 777, 782 (3d Cir.1996). *10 Defendants readily admit that McLinden's education (an M.D. degree) does not in itself support his qualification as a computer forensics expert. Instead, defendants assert McLinden has the requisite knowledge, skill, and experience. McLinden testified that he has been employed nearly full-time as a programmer, system analyst, or technology manager since 1977. See Sanctions Hrg Tr. at 142-43. Since 1993, he has been employed with Outcome Technology Associates, where he currently holds the title of President and CEO. See id. at 142. Outcome Technology Associates is a technology consulting firm that provides “software and systems design; network design and evaluation; security analysis; security audits and forensic information technology services.” Id. McLinden estimated that he has been involved with computer forensic analysis since the early 1980s. Id. at 144.[7] Although a court has never qualified him as an expert in computer forensics (or apparently in any other field), no court has ever denied him qualification as an expert. See id. at 144-45, 152. McLinden testified that he has been retained by various entities to perform computer forensic analysis, id. at 143, and defendants have provided a partial list of those engagements, see Defs. Mem. Opp. Mot. Exclude Ex. 1. Those engagements include forensic analysis and theft of trade secrets allegations in pending litigation, in the Pennsylvania state and federal courts. See id. The most important Fourth Circuit precedent on expert qualifications, and the only opinion discussing qualifications in any detail, is the court's decision in Thomas J. Kline, Inc. v. Lorrillard, Inc., 878 F.2d 791 (1989). In Kline, the plaintiff alleged, inter alia, that the defendant tobacco company had engaged in price discrimination in its sale of tobacco products. The plaintiff offered the testimony of a purported expert to demonstrate that there was no justification for the allegedly discriminatory changes in defendant's pricing and credit practices. The Fourth Circuit concluded the witness's MBA degree did not in and of itself qualify her as an expert. She had published only one article that had nothing to do with price fixing, credit practices, or antitrust issues. The expert also “admitted that she had no personal experience in making credit decisions” and that she was “unfamiliar with personal guarantees of stockholders or officers and how they would influence credit decisions.” Id. at 799. She also testified that her experience was limited to “analyses of companies' financial health.” Id. Moreover, the expert failed to take significant facts into account when reaching her conclusions, particularly the fact that the defendant sustained significant financial losses as a result of its former parent company's bankruptcy. Id. at 799. As a result, the Fourth Circuit concluded that the witness could not “satisfy even the minimal requirements of Fed.R.Evid. 702.” Id. at 800. The court elaborated: “There was no indication, for example, that Gordon's general business education included any training in the area of antitrust or credit. Similarly, Gordon admitted that she lacked any other experience in such matters.” Id. Because the expert lacked any qualifications in the relevant areas, the district court erred in permitting the expert witness to testify. “The evidence should have been excluded, it was not merely to be accorded the reduced weight normally allowed less qualified testimony.” Id. *11 In contrast, it cannot be said that McLinden lacks any knowledge, skill, or experience in computer forensics. His testimony demonstrates that he has worked with computers for approximately thirty years, in areas (programming and systems analysis) that lend themselves to a knowledge of computer forensics. Moreover, he has been engaged-and oversees the operations of a company that regularly engages-in computer forensic analysis. He has also provided a list of at least five other engagements where he performed computer forensic analysis for clients, including some jobs that involved trade secrets violations.[8] 2. McLinden's Use of “Internet Chat Rooms” Plaintiff next argues that McLinden's use of internet discussion forums affects his testimony in two ways. First, plaintiff asserts that his use of internet forums demonstrates that he lacks knowledge, skill, training, education, or experience in computer forensic analysis. Second, plaintiff argues that McLinden's reliance on “chat rooms” makes his testimony on wiping unreliable because it relies on hearsay testimony that is not admissible under Rule 703. As an initial matter, plaintiff's first argument is unpersuasive because, as discussed above, McLinden is qualified as an expert in the field of computer forensics. Plaintiff's criticism is better characterized as an issue of credibility, which the trier of fact may consider in deciding how much weight to give his testimony. As to McLinden's reliance on hearsay, Federal Rule of Evidence 703 provides, “The facts or data in the particular case upon which an expert bases an opinion or inference may be those perceived by or made known to the expert at or before the hearing. If of a type reasonably relied upon by experts in the particular field in forming opinions and inferences upon the subject, the facts or data need not be admissible in evidence in order for the opinion or inference to be admitted.” Thus, an expert's opinions and inferences are admissible even if he or she relied on hearsay in forming those opinions and inferences, but only if the hearsay is of a type reasonably relied upon by experts in the particular field. See Redman v. John D. Brush & Co., 111 F.3d 1174, 1179 (4th Cir.1997). To prove the foundation for the testimony, the burden is on the proponent to demonstrate that experts in the field would rely on the hearsay. See id. McLinden did not rely on his internet discussions in forming his opinion, thereby making Rule 703 in applicable. McLinden's testimony established, at least implicitly, that he did not rely on the discussions in reaching his opinions: “I'm saying if you want to introduce [the discussions] as evidence, that's fine. I wouldn't introduce the results of a conversation as evidence. I look for hard facts. This was a conversation ... with my peers, to see if anyone had ever seen anything like this before.” Sanctions Hrg. Tr. at 743. Moreover, McLinden's reports do not mention the internet discussions nor does it appear that he relied on the statements made there to reach his conclusions; he has set forth bases independent of the chat rooms for reaching his conclusions. *12 This case is therefore different than Redman. In Redman, the underlying issue was whether a particular safe model was an effective burglar deterrent. See Redman, 111 F.3d at 1179. The expert had experience in metallurgical engineering but had no experience in dealing with safes or burglaries. See id. To conclude that the safe was an effective deterrent, the expert relied on conversations he had with store personnel, who provided the expert with an accepted industry definition of “burglar deterrent.” Id. Applying that definition to the safe at issue, the expert determined that the safe was not an effective burglar deterrent. Id. The Fourth Circuit concluded that the hearsay was not admissible under Rule 703 because the proponent failed to prove that experts in the field would rely on “conversations with store personnel to identify a standard of burglar protection capacity.” Id. The expert in Redman necessarily relied on this hearsay to reach his conclusion because it was an integral part of his analysis. McLinden's internet discussions were not integral to the formation of his opinions-they merely served as a sounding board for his thoughts and ideas. Even assuming arguendo that McLinden relied on internet discussions, those discussions meet the minimal standard of admissibility established in Rule 703. “Just as a witness's own testimony may establish personal knowledge of an event about which the witness is testifying, it appears that an expert witness should be able to lay a foundation that establishes the reasonableness of relying on inadmissible evidence.” Saltzburg, Martin & Capra,, supra, § 703.02 [3], at 703-5. McLinden testified: A. As I stated, I have no peer reviewed publications. I have contributed knowledge to various forensic bulletin boards, as well as acquired knowledge from such bulletin boards. Q. So you've gone in some chatrooms and chatted it up? A. Not chatrooms. EnCase, um, provides a bulletin board for EnCase users. Um, and there is a computer forensics bulletin board. There is the Journal of Digital Investigations, um, that has a bulletin board like area. So I've had-I have been involved and engaged in discussions in those, yes. Q. Do you think those are valid areas to go to? A. This is an evolving field. The experts, um, upon whom I rely for my information and knowledge are participants in those grounds. People like Brian Carrier, who is probably the world's foremost authority on file system analysis participates in the groups that I'm in. Harlan Carvey, who is an expert in Windows forensic analysis. So it is sharing information with the community. Sanctions Hrg. Tr. at 153-54. Jorgensen's testimony also supports McLinden's assertion that experts in field use internet “chat rooms” in forming their opinions. Jorgensen testified that he used a Dell support chat room to gather information about background patterns of data that Dell might put on their hard drives. See Sanctions Hrg. Tr. at 108-10. He utilized that discussion even though he had no way of verifying who the person he was chatting with was or that person's knowledge-all he knew was that the person was associated with Dell. Jorgensen even cited to his chat conversation in his report. See Second Jorgensen Report at 10, 19. The evidence therefore establishes discussions in that internet fora are reasonably relied upon by experts in the particular field.[9] 3. McLinden's Unverifiable Bit-for-Bit Copy of the JR Bell Laptop Hard Drive *13 Plaintiff argues that McLinden's opinions regarding the JR Bell laptop hard drive are unreliable because he cannot verify that the forensic copy he used was an exact duplicate of the original drive.[10] In making this argument, plaintiff implicitly relies on the principle that “any step that renders the analysis unreliable ... renders the expert's testimony inadmissible. This is true whether the step completely changes a reliable methodology or merely misapplies that methodology.” Paoli, 35 F.3d at 745; see Fed.R.Evid. 702 advisory committee note (2000 amendment). McLinden offered testimony on the procedures he followed when the JR Bell laptop came into his possession. He testified that he obtained the laptop from defense counsel, examined the computer, and saw that the hard drive had not been tampered with. He proceeded to remove the hard drive and record the relevant information, such as the computer's express code and service tag numbers. McLinden then made a forensic copy of the hard drive using a hardware device and EnCase v. 4.22 software.[11] He recorded the serial number of the subject drive on the copy drive's case, and included the serial number of the subject drive in the name of the evidence file created by EnCase. Sanctions Hrg. Tr. at 155-63. Sometime thereafter, McLinden decided to create a second forensic copy from the original hard drive using EnCase v. 5.0. He testified he did so because he thought EnCase 5.0 might provide for faster searches of the drive. During this acquisition, the original drive “made a couple of clicks and then failed to spin up.” Sanctions Hrg. Tr. at 165. McLinden noted that drives had failed to spin up for him before but never during an acquisition, and that he did not do anything to cause this drive's failure. Id. McLinden claims that he provided Jorgensen with a bit-for-bit copy of the original hard drive, made using EnCase Restore, based on the forensic copy created on EnCase 4.22 before the original drive failed. See McLinden Report of May 5, 2007. McLinden also provided Jorgensen with the Encase evidence files. See Sanctions Hrg. Tr. at 23-24. Jorgensen testified that McLinden's handling of the original laptop hard drive violated generally accepted practices in two ways. First, Jorgensen stated that McLinden failed to establish chain of custody, either in the form of evidence logs generated by McLinden or audit logs generated by the software. Second, he argued McLinden acted contrary to best practices when he went back to the original hard drive a second time to create another forensic copy-resulting in the hard drive's failure. Id. at 20-25. For those reasons, plaintiff argues that “[b]ecause McLinden's conclusions are derived from a purported copy that cannot be validated as a forensic bit-for-bit image of the original drive,” any of McLinden's opinions with respect to the drive are unreliable. See Pl. Mem. Supp. Mot. Exclude at 12-13. *14 McLinden's dealings with the original hard drive do not make his testimony so unreliable that it must be excluded. First, defendants have adequately established that EnCase is a generally accepted tool that makes exact duplicates of hard drives. McLinden testified that EnCase is a widely accepted tool for making forensic copies, and that the United States Department of Justice and Securities and Exchange Commission have used forensic copies he made with this program. Sanctions Hrg. Tr. at 152, 156. Beyond offering merely the ipse dixit of their expert witness, defendants have offered a publication of the Sedona Conference, in which the Conference stated that “[a] Bit Stream Back-up is an exact copy of a hard drive, preserving all latent data in addition to the files and directory structures. Bit Stream Back-up may be created using applications such as EnCase ...” The Sedona Conference Glossary: E-Discovery & Digital Information Management (May 2005), Def. Mem. Opp. Mot. Exclude Ex. 12.[12]When McLinden later sought the help of a third-party to rebuild the original JR Bell laptop hard drive (per the parties' agreement), the third-party stated it was unnecessary if he had an EnCase image of the drive. See Sanctions Hrg. Tr. at 167. And although Mandiant was not specifically charged with analyzing the accuracy of the forensic copy, it expressed no reservations about the forensic copy's validity. See Def. Sanctions Ex. 6 at p. 8. That evidence supports plaintiff's assertion that EnCase is generally accepted and produces an exact copy of the original hard drive.[13] Plaintiff has further questioned the accuracy of the copy because, it argues, McLinden has not provided adequate documentation of the chain of custody. McLinden testified that he provided all of his documentation, most of it written on the hard drives, CDs, or contained in the file names, to Jorgensen. Plaintiff has offered no testimony to dispute that McLinden gave Jorgensen at least that information. Moreover, the version of EnCase that McLinden used did not produce an “audit log” as did later versions. Simply because Jorgensen prefers to use ImageMASSter solo does not make EnCase an unreliable method of duplicating hard drives. Finally, it is unclear how the “evidence logs” maintained by Jorgensen in his everyday work would make the forensic copy any more reliable; maintaining an evidence log or placing serial numbers in files and on hard drives both depend on the truthfulness of the person making the copy and creating the logs. As to plaintiff's argument that McLinden violated accepted practices by attempting to create a second copy of the original hard drive is unsupported by even its own expert's testimony. Jorgensen testified that is exactly what he intended to do: Q.... You actually went up in December to Dr. McLinden's office for the purpose of making forensic copies of the hard drives that the defendants had, correct? *15 [Jorgensen]. Correct. * * * Q. And you went up to, with the ImageMASSter Solo, to make a copy of the Bell Severcorr hard drive, correct? A. Yes. Sanctions Hrg. Tr. at 21-22. The drive could just as easily have failed when Jorgensen tried to make a copy of the hard drive. It would be odd to hold that McLinden's testimony is unreliable when Jorgensen-an expert in the field-sought to do the same thing. 4. McLinden's Rule 26 Disclosures Rule 26(a) (2)(B) requires that an expert witness's testimony be accompanied by a written report. “The report must contain ... a complete statement of all opinions the witness will express and the basis and reasons for them” along with the data and information considered by the witness; exhibits to be used in support of the opinions; the witness's qualifications; a disclosure of the witness's compensation; and a list of other cases in which the witness testified. Fed.R.Civ.P. 26(a)(2)(B). Rule 37(c) provides the penalty for failing to adhere to Rule 26(a)(2)(B). “If a party fails to provide information or identify a witness as required by Rule 26(a) or (e), the party is not allowed to use that information or witness to supply evidence on a motion, at a hearing, or at a trial, unless the failure was substantially justified or harmless.” Fed.R.Civ.P. 37(c)(1). The court may impose, in addition to or in lieu of that sanction, any other “appropriate” sanction. Id. Plaintiff argues McLinden failed to disclose three of his opinions and/or bases for his opinions in his reports: (1) his examination of other Dell hard drives, specifically the Dell 610 and 620 hard drives; (2) his opinions with respect to the deletion of the .OLK files; and (3) his opinion as to the FIST procedure, which was his theory of why Dell computers do not write data from left to right.[14] To determine whether the failure to disclose was harmless or substantially justified, the court should consider five factors: (1) the surprise to the party against whom the evidence would be offered; (2) the ability of that party to cure the surprise; (3) the extent to which allowing the evidence would disrupt the trial; (4) the importance of the evidence; (5) the non-disclosing party's explanation for its failure to disclose the evidence. S. States Rack & Fixture, Inc. v. Sherwin-Williams Co., 318 F.3d 592, 597 (4th Cir.2003). a. The Dell 610 and 620 Laptop Hard Drives Defendants assert they produced forensic copies of the other Dell hard drives McLinden examined. They claim they gave plaintiff a copy of the 610 hard drive on July 26, 2007 and a copy of the 620 hard drive on August 17, 2007. Thus, to the extent plaintiff was “surprised” by McLinden's testimony at the July 2 hearing, plaintiff has had plenty of time to cure that surprise. Its ability to cure that surprise is especially clear because Jorgensen was still forming his opinions and did not issue his final report until early September. Plaintiff had notice in early July of McLinden's opinions regarding these hard drives, so its expert had ample of time to address their effect before the final reports were due in September. The non-disclosing party also has a good excuse: this litigation has been plagued by a lack of certainty as to the plaintiff's expert's evolving testimony because it took such a long time for Jorgensen to conduct his analysis and form (and, in some instances, discard) his opinions. b. Opinions Regarding the .OLK Files *16 There is not significant surprise with respect to McLinden's opinions that the absence of the .OLK files can be explained by the way Outlook deletes temporary internet files depending on how the user views attachments. In his September 21, 2007 supplemental report, McLinden opined that each individual Windows application controls the management of its own temporary internet files. McLinden Sept. 21, 2007 Report at 44. He also stated that “there should be no expectation on the part of the user that files located in any subfolder of a temporary folder be persistent.” Id. To the extent he failed to disclose the information he learned from the Microsoft Knowledge Base, he only failed to disclose the basis for forming the opinion-plaintiff knew of the opinion from the report. Although Rule 26 requires a party to disclose not only an expert's opinions, but the information he relied on in reaching that opinion, McLinden used a publicly available source to reach his opinion. Thus, there is little surprise or harm where (1) the opposing party knew the witness's opinions, and (2) the supporting information could be found in publically-accessible sources. Moreover, given the importance of Jorgensen's theory that Dell computers write data from left to right, this evidence is especially important to defendants' attempt to counter plaintiff's expert. c. Dell FIST Processes McLinden opined that Dell computers come from the factory with allocated free space in the master file table. Thus, according to McLinden, even new Dell computers will not necessarily write new data at the beginning of the drive. Instead, the computer will-as is common with the master file table-write data first to the previously allocated free space; only when that space is completely used will the master file table write at the beginning of the drive. McLinden's opinions with respect to the existence of master file table entries on factory-fresh Dell hard drives were disclosed in his reports. The September 21, 2007 report described McLinden's general opinions that the allocation of free space is governed by the master file table, and that the master file table first writes data to previously allocated free space. Only when that space is full will the master file table write to unallocated free space. McLinden Sept. 21, 2007 Report at 12-17. McLinden also stated that the Dell laptop came from the factory with available master file table entries. Id. at 17. Those are the same opinions plaintiff now claims were not disclosed. To the extent plaintiff also relies on McLinden's failure to disclose his information regarding Dell's patent on its installation process, that argument also does not require exclusion of McLinden's opinion.[15] First, there can be little surprise to plaintiff. Plaintiff was well aware of McLinden's opinions regarding the existence of master file table entries on new Dell computers. Moreover, the Dell patent is a publicly available document. Second, the evidence is important to defendants' case given that Jorgensen has testified at length about how new, factory-configured Dell laptops should not place data at random intervals on the hard drive. Third, it is unclear how plaintiff believes it would have “cured” any surprise it suffered: because of the schedule for presenting expert reports, its expert had already submitted his final report before McLinden submitted his final report. Finally, McLinden cannot be faulted for failing to disclose the information on the Dell patents earlier in the litigation. Defendants have primarily offered McLinden's testimony to rebut Jorgensen's opinions. Jorgensen and his counsel spent most of mid-2007 revising his opinions, creating what can be fairly described as a moving target. Thus, defendants have a reasonable excuse for failing to disclose McLinden's use of the Dell patent. IV. CONCLUSION *17 For the foregoing reasons, it is hereby ORDERED that plaintiff's motion to exclude the testimony of Sean McLinden be DENIED. It is further ORDERED that defendants' motion to exclude the testimony of John Jorgensen be GRANTED on testimony relating to Ultimate Cleaner and Ultimate Defender and DENIED as to all other matters. AND IT IS SO ORDERED. Footnotes [1] Although the parties largely offered the expert testimony in connection with the motion for sanctions, the Daubert challenges seek to exclude the expert testimony for all purposes. [2] Rule 702 was amended in 2000. Cases decided prior to the amendment are nonetheless applicable because the amendment “crystalize[d] the central tenants of Daubert” and incorporated the existing case law. See Saltzburg, Martin & Capra, 3 Federal Rules of Evidence Manual § 703.02 [10], at 703-52 to-57 (9th ed.2006). [3] “Preliminary questions concerning the qualification of a person to be a witness ... or the admissibility of evidence shall be determined by the court.” Fed.R.Evid. 104(a). [4] See Sanctions Hrg. Tr. at 553. [5] The district court described its grounds for excluding the experts' testimony more clearly than the Fourth Circuit. See Cavallo v. Star Enterprise, 892 F.Supp. 756 (E.D.Va.1995). [6] The unreliability of his opinions on these programs is also apparent from the plaintiff's failure to defend the opinions in its memorandum in opposition. [7] Plaintiff does not dispute the veracity of McLinden's statements regarding his prior experience. Instead, plaintiff disputes only whether the quality of his experiences permit a conclusion that he is an expert in computer forensics and/or computer wiping. [8] Plaintiff attempts to argue that even if McLinden is qualified as a computer forensics expert, he is not necessarily qualified as an expert in the sub-field of computer wiping. That argument draws too fine of a distinction between computer forensics and computer wiping. An expert in computer forensics should be able to determine what a user did on a computer, which is the fundamental question in a wiping analysis. Plaintiff's hair-splitting argument is best saved for cross-examination at trial. [9] Plaintiff's argument at McLinden's use of the Guidance technical forum fails to recognize the increasing importance of internet communication-even anonymous internet communication. McLinden did not use the statements of users on the bulletin boards as the crux of his analysis; he used it simply as a place to bounce ideas off other people, not unlike an informal conversation among colleagues in an office setting (e.g., Jorgensen's conferrals with his son during his testing and analysis in this case). [10] Plaintiff acknowledges that this argument would apply to equal force to Jorgensen's testimony. Nov. 7, 2007 Hrg. Tr. at 17. Thus, if the court were to exclude McLinden's testimony on this basis, it would have not choice but to exclude Jorgensen's as well. [11] EnCase v. 5.0 became available in early 2007 but was not available at the time McLinden made the forensic copy of the JR Bell laptop hard drive. See Sanctions Tr. at 161-62. [12] Courts have frequently recognized the Sedona Conference as a useful source of information on electronic discovery issues. See, e.g., Zubulake v. UBS Warburg LLC, 229 F.R.D. 422 (S.D.N.Y.2004) ( “[P]rofessional groups such as the American Bar Association and the Sedona Conference have provided very useful guidance on thorny issues relating to the discovery of electronically stored information.”). Other district courts have cited to this particular publication. See In re Seroquel Prods. Liab. Litig., 244 F.R.D. 650, 651 n. 1 (M.D.Fla.2007); Williams v. Sprint/United Mgmt. Co., 230 F.R.D. 640, 643 n. 8 (D.Kan.2005). [13] Although only tangentially relevant, it should be noted that other courts have accepted copies made using EnCase and have noted that it produces an exact duplicate of the original drive. See, e .g., Sanders v. State, 191 S.W.3d 272, 278 (Tex.Ct.App.2006). [14] In its memoranda support the motion to exclude McLinden's testimony, plaintiff also argued that defendants failed to produce a forensic copy of the Dell 620 hard drive McLinden used. Plaintiff withdrew that portion of its motion at final arguments. See Nov. 7, 2007 Hrg. Tr. at 23-24. [15] Defense counsel asserted at the hearing on the Daubert motions that McLinden merely offered his opinions on the patented Dell process to rebut Jorgensen's testimony. As the Fourth Circuit has explained, “There is no basis in [Rule 26] for distinguishing disclosures of testimony to be used on direct examination or in rebuttal.” See Golden Nugget, Inc. v. Chesapeake Bay Fishing Co., 93 Fed. Appx. 530, 533 (4th Cir.2004). Thus, a district court errs if it permits testimony simply because the undisclosed opinions and information are offered in rebuttal. See id.