Maxtena, Inc., Plaintiff, v. Jeremy Marks, Defendant Civil Action No. DKC-11-945 United States District Court, D. Maryland Signed July 15, 2014 Connelly, William, United States Magistrate Judge ORDER *1 Upon consideration of Maxtena, Inc.'s Motion to Overrule Marks' Privilege Claims or in the Alternative to Compel Production of an Appropriate Privilege Log, Jeremy Marks' Opposition, and Maxtena, Inc.'s Reply, IT IS this 1st day of July, 2014 by the United States District Court for the District of Maryland, ORDERED: 1. That Maxtena, Inc.'s Motion to Overrule Marks' Privilege Claims (ECF No. 431) BE, and the same hereby IS, DENIED. Maxtena, Inc.'s Alternative Motion to Compel Production of an Appropriate Privilege Log (ECF No. 431) BE, and the same hereby IS, GRANTED for the reasons stated below; 2. That, by way of background, in the Order of November 22, 2013 the undersigned modified the scope of the search of Jeremy Marks' laptop computer. “The permissible search shall enable Maxtena, Inc. (“Maxtena”) to determine if anything was deleted or removed that could be responsive prior to the period of (and including) July 7, 2010. On July 7, 2010 [M]r. Cummings made a copy of the files on Marks' personal laptop computer and stored the copied files on a DVD-R.” ECF No. 315 ¶ 1; 3. That subsequent to issuing the November 22, 2013 Order with a date restriction (on or before July 7, 2010), the Neutral Examiner advised it was not technically possible to comply with the November 22, 2013 Order. The Neutral Examiner sent the following e-mail to the undersigned. I have read and attempted to follow the Nov 22nd, 2013 Order; specifically paragraph 1 of the Order. However, it is technically not possible to comply with the Order. The reinstallation of the Operating System on June 3rd, 2010, either overwrote or made ‘un-seeable’ to the Operating System, ALL of the files previously on the hard drive. The new Operating System does not see any of the previous files that were on the drive prior to the reinstallation. I will leave it to you to decide whether you consider this to mean “deleted or removed.” Whether the files could be responsive or not, i[s] unknown. Forensically, we may recover files from unallocated space that were on the hard drive prior to the reinstallation of the Operating System. However, if we located a file in unallocated space, we cannot use dates to determine responsiveness because all “File System Metadata” is lost when a file “becomes” unallocated (i.e. when it a file is deleted or when the Operating System is reinstalled). In other words, we can search unallocated spaces for files based on keywords, but we cannot limit this to any particular date range, because the dates are no longer present when the file becomes unallocated. The best analogy for this is when a piece of paper is thrown away. If you have the paper in your filing cabinet, it is organized (possibly even in date received order). If you throw that document in the trash, you lose that organization (and “date” information). Unallocated space is equivalent to looking in the garbage can (with all the other old garbage) for that paper. You might find the entire paper, you might find parts of the paper, or you might not find anything, but you will also not have any organization as you go through the trash. *2 To summarize, unallocated space no longer has file system metadata (“dates”) and therefore we cannot limit a search of unallocated space to a particular date range. Keyword searching is how you properly search unallocated space. E-mail from Neil Broom to Judge Connelly of 11/26/13; 4. That the undersigned subsequently initiated a conference call with counsel and the Neutral Examiner on December 18, 2013. See ECF No. 349. With a clear understanding about the inability of the Neutral Examiner to restrict his search of Marks' laptop computer based on dates, the undersigned approved the Neutral Examiner's proposed revised protocol for examination of Marks' laptop computer. See ECF No. 351; 5. That “[t]he Neutral Examiner's searches ultimately returned 1,857 separate files and file fragments. Those items were provided to Marks' counsel to review for any privileged or work-product protected materials to be withheld from production to Maxtena.” ECF No. 431-1 at 5; 6. That Marks asserts 1,752 of the 1,857 documents identified by the Neutral Examiner as protected by the attorney-client privilege or work-product protection; 7. That for the 1,752 documents Marks claims as privileged or protected, Marks supports his assertion with the following description: Jeremy Marks uses his personal laptop computer throughout this litigation in order to create documents for counsel, perform case-related research and review select documents obtained during discovery. The information contained in the “name” and “path” columns (among others) reveals the information that is itself privileged or protected as envisioned in Rule 26(b)(5). This particular document was created and/or reviewed after the case was filed and for litigation purposes. The “item” number identified was assigned by the forensic examiner and is contained on the spreadsheet supplied to counsel. 8. That in his opposition Marks alleges, Of the privileged or protected items identified by Marks, only three items fall within the scope of the search that the Court recognized as appropriate in its November 22 order. That is, the Neutral Examiner identified only three items that were created before July 7, 2010, when Marks was administratively suspended or April 13, 2011, when this litigation was filed. Thus, after conducting the searches without date restriction due to technical limitations, the Neutral Examiner is now able to identify the specific items that apparently fall within the scope of the search authorized by the Court in its November 22 order. ECF No. 442 at 7; 9. That Marks' interpretation of the undersigned's Orders is inaccurate. As Maxtena explains in its Reply, Marks also attempts to rely on the Court's Order of November 22, 2013 to impose after-the-fact limitations on the protocol for the inspection of his laptop. That argument is equally without merit, because the Court's November 22, 2013 Order regarding the protocol for inspecting Marks' laptop computer was superseded when the Court adopted an entirely new protocol for the inspection of the laptop on December 19, 2013. ECF No. 449 at 6; 10. That Maxtena correctly notes, “[i]t is undisputed that the December 19th Order and the protocol it adopted do not impose date restrictions.” Id; *3 11. That the undersigned finds Marks' Third Supplemental Privilege Log, with a generic description for 1,752 allegedly privileged or protected documents, is inadequate. It is impossible for the opposing counsel, or even the undersigned, to assess whether the basis for the assertion of privilege or protection is justified; 12. That the undersigned therefore orders Marks to address the following five questions with regard to the 1,752 documents he claims as privileged or protected in the Third Supplemental Privilege Log. a. What are the specific creation dates of the files listed on the log (excluding entry numbers 2, 14, 15, 16, 121 and 128 [which bear the “Item Numbers” 512, 46786, 46976, 48122, 385655, and 589003 in the Privilege Log] )? b. Identify which documents were created on the laptop computer after the lawsuit was filed and which documents were simply reviewed on the laptop computer after the lawsuit was filed. c. Explain what is meant by “created.” Do you mean that the document existed on some other device in Marks' possession and was simply saved to the laptop computer for the first time on the date specified? Or do you mean that Marks created the document from scratch on that date? Or does the word have some other meaning as you have used it? d. For any documents that were simply “reviewed” on the laptop computer after the lawsuit was filed, please state whether the document already existed on the laptop computer or some other device that was in Marks' possession, custody or control at the time the lawsuit was filed. e. Identify if any or all of the documents as to which Marks has asserted claims of privilege or work product protection are the Bates labeled copies of the documents that Maxtena and/or other third parties in this case produced. This question does not seek to know whether a separate Bates labeled copy of the same document was produced in the case. Instead, the focus of this question is whether the particular documents identified on the privilege log bear Bates numbers. 13. That, in addition to addressing the specific five questions above, Marks' Fourth Supplemental Privilege Log must provide all information required in accordance with this Court's Guideline 10.d.ii.b;[1] and 14. That Marks must serve Maxtena with his Fourth Supplemental Privilege Log not later than July 15, 2014. Footnotes [1] In accordance with Fed. R. Civ. P. 26(b)(5), where a claim of privilege is asserted objecting to any ... document request ... and information is not provided on the basis of such assertion: ... ii. The following information should be provided in the objection, if known or reasonably available, unless divulging such information would cause disclosure of the allegedly privileged information: ... b. For documents: (i) the type of document; (ii) the general subject matter of the document; (iii) the date of the document; and (iv) such other information as is sufficient to identify the document, including, where appropriate, the author, addressee, custodian, and any other recipient of the document, and where not apparent, the relationship of the author, addressee, custodian, and any other recipient to each other.