PETER WACHTELL, an individual, Plaintiff, v. CAPITAL ONE FINANCIAL CORP., a Delaware corporation; and CAPITAL ONE SERVICES, INC., a Delaware corporation, Defendants Case No. CV 03-267-S-MHW United States District Court, D. Idaho Filed March 02, 2007 Williams, Mikel H., United States Magistrate Judge ORDER *1 Currently pending before the Court for its consideration are the following motions: 1) Plaintiff's Request for an Order of Substantial Compliance with the Court's Prior Orders (Dkt # 350), filed September 21, 2006; 2) Defendants' Motion for Sanctions for Failure to Comply with Orders and Stipulations and to Strike or Stay Plaintiff's Request for an Order of Substantial Compliance (Dkt # 354), filed September 27, 2006; 3) Defendants' Motion to Strike Plaintiff's Sur-Reply and Attachments to Plaintiff's Opposition to Defendants' Motion for Sanctions (Dkt # 366), filed November 2, 2006; 4) Defendants' Sealed Motion for Leave to File the Supplemental Declaration of J. Christopher Racich in Support of Defendants' Motion for Sanctions (Dkt # 375), filed January 17, 2007; 5) Plaintiff's Motion for Expedited Discovery and Stay of the Issuance of Orders Respecting Pending Motions re: Forensic Discovery (Dkt # 383), filed January 30, 2007; 6) Plaintiff's Sealed Motion for Leave to Submit Report of Richard L. Albee in Further Support of Plaintiff's Request re Docket # 350, 383 & 354 (Dkt # 389), filed February 13, 2007; and 7) Defendants' Motion for Protective Order and to Strike Improper Rebuttal Reports (Dkt # 391), filed February 15, 2007. I. PROCEDURAL BACKGROUND These motions are yet another chapter in the long running dispute between the parties regarding the discovery of electronically stored information. It has been the subject of prior rulings by the Court, most recently the Orders entered on May 9, 2006 (Dkt # 308) and July 27, 2006 (Dkt # 338). The Plaintiff, Peter Wachtell, (“Wachtell”) started the current debate when he filed a motion seeking some type of a declaratory confirmation from the Court that he has fully complied with the Court's prior orders and the August 21, 2006 Stipulation for Preservation and Production of Electronically Stored Information (“Stipulation”) of the parties. Wachtell argues that conducting the further electronic discovery urged by the Defendants would be inordinately expensive, futile, burdensome and could take up to a year to complete and review. The Defendants, Capital One Financial Corp. et al., (“Capital One”) responded with a motion for sanctions against Wachtell for failure to comply with the Court's orders and the Stipulation. Capital One also moved to strike or stay the request by Wachtell that he has substantially complied with the Stipulation. A hearing was scheduled on the above motions for January 24, 2007. On January 17, 2007, Capital One moved to file a Supplemental Declaration of J. Christopher Racich, Senior Vice President and Counsel for First Advantage Litigation, a company engaged in the computer forensics field, who had been retained by Capital One. The thrust of this declaration is that Capital One now had proof that a computer, previously in Wachtell's possession and used by him while working with Capital One, had five previously undisclosed mirror copies made of the hard drive and also that data destruction software had been run on it, just prior to Wachtell returning it to Capital One. On January 23, 2007, just before the hearing, Capital One filed the Second Supplemental Declaration of J. Christopher Racich which contained dates and times when the downloads occurred from the computer and when data destruction programs were run. Capital One further argued that the timing of these events and other activities that were also taking place on the computer clearly indicate that it was Wachtell doing the downloading and erasing files from the computer. *2 After the January 24 hearing, Wachtell filed an Emergency Motion for Expedited Discovery and Stay of the Issuance of Orders Respecting Pending Motions Regarding Forensic Discovery (Dkt # 383). Wachtell seeks discovery of Capital One's experts to challenge the assertions that Wachtell made undisclosed mirror copies of the computer's hard drive and had used destructive software to erase files prior to returning it to Capital One. On February 13, 2007, Wachtell filed a Motion for Leave to Submit Report of Richard L. Albee, his retained forensic computer expert, which Wachtell asserts seriously calls into question the conclusions by Capital One's experts, J. Christopher Racich and John Ashley, that Wachtell made mirror copies of the hard drive of the computer or downloaded and/or used file destruction software. II. ISSUES. There are two primary issues raised by the various motions: 1. Did Wachtell make five previously undisclosed mirror copies of the hard drive of the laptop computer and download and run file deletion software programs which resulted in the destruction of files on the computer, or to put it more bluntly, has he engaged in spoilation of evidence, before the computer was returned to Capital One. 2. Should the parties be required to conduct further discovery for deleted data in the slack and unallocated space of the hard drives of the subject computers as contemplated by the Stipulation. III. DISCUSSION. With this backdrop, the Court delves deeper into the factual background of the dispute between the parties. First, the Court will address all the various computer hardware involved in this case. While Wachtell was involved in his business relationship with Capital One, he possessed and used a laptop computer for both business and personal purposes. This computer was used both at the offices of Capital One located in Boise, and possibly elsewhere, and at Wachtell's home and other locations. On this computer was information relating to Project Street, the gravamen of the dispute between the parties. This laptop computer has been consistently referred to by the parties as the “Capital One laptop.” Wachtell worked with Capital One from May 1, 1999 through February 21, 2003. When the parties relationship started to deteriorate, Wachtell realized that he would have to return to Capital One all of their property, including the Capital One laptop. Wachtell has admitted that he requested Capital One's IT personnel to make a copy of the readable files on the Capital One laptop and transfer them to another laptop or possibly a disc. There is evidence that Wachtell purchased a new VPR Matrix laptop on or about March 5, 2003, shortly after he was terminated. During this time frame, Capital One operated a division in Boise, Idaho, known as Credit Recovery Services, or CRS, and it had a IT Site Support department with a staff of approximately ten site analysts plus technical professionals who worked for the department. The CRS IT Support department was in existence prior to 2003 and decommissioned in July of 2006. Declarations have been filed in conjunction with the pending motions by two former employees of the CRS IT Site Support department. Don Bernaiche was in charge of all computer support at the department and responsible for issuance, configuration, retrieval and redeployment of laptops used by Capital One personnel. Steven Y. Christensen was a senior site analyst with the department and in February 2003 he was aware of work that was performed by the IT Support department on the Capital One laptop issued to Wachtell regarding reconfiguration because of difficulty logging on the Capital One server. In March of 2003, Christensen transferred data from the Capital One laptop to the VPR Matrix laptop that Wachtell had purchased. Wachtell used the VPR Matrix laptop until June of 2004 when he purchased an IMac G-5 computer which he used as a desktop. Wachtell transferred all of the files to the desktop and rarely used the VPR, which eventually stopped working. In June of 2005, Wachtell purchased a new Apple laptop computer and in responding to Interrogatory Number 8, Wachtell states that he mirrored the hard drives of the IMac with the new Apple laptop. The Court finds this statement to be of possible significance as it might demonstrate Wachtell's familiarity with more complex computer operations, such as mirroring a hard drive. The IMac was eventually lost during shipment to New Zealand. Wachtell also had a Blackberry while he was with Capital One, which he used for emails. After termination, Wachtell purchased a Blackberry from T-Mobile which he used as a PDA and telephone. In 2005, Wachtell purchased a new Blackberry from AT&T. Wachtell's business partner, John Phren (“Phren”), has four computers which contain potentially discoverable information. In addition, Wachtell has a Sidekick PDA and a Verbatim 30 bit tape. Collectively the Court will refer to this group of computers, etc., as the “subject computers.” *3 It is the Court's understanding that to the extent possible, except for the Sidekick PDA and recent work that has commenced on the Blackberry and the Verbatim 30 bit tape, that mirror copies of the hard drives of the subject computers have been provided to the expert retained by Wachtell, Sergio Kopelev, of LECG, who has been tasked to conduct the forensic search and follow the protocols discussed in the Stipulation. Prior to the recent allegations by Capital One that Wachtell had personally erased files from the Capital One laptop, and as discussed, the parties had jointly developed a protocol for the search of the subject computers. After lengthy negotiations between counsel, and consultations with their own computer experts, this protocol was reduced to the August 21, 2006 Stipulation. The parties have also agreed that Sergio Kopelev of LECG, previously retained by Wachtell as his own computer expert, could conduct the forensic search. The Stipulation provided that the searches would be conducted by LECG on two data sets. Data Set 1 would consist of the material readily retrievable, including all active user files, such as Word documents, spreadsheets and PowerPoint presentations, recovered deleted files, to the extent not overwritten by new data, and all email messages. Data Set 2 consists of all other file types not included in Data Set 1, such as fragments contained in unallocated and slack space and deleted logical files that could have been overwritten. According to Wachtell, Capital One insisted on a vast keyword search list containing 31 pages and 712 terms. Wachtell and his expert stated that a search of this scope would return a vast number of non-responsive documents and would require an extensive and expensive review by counsel. This concern was primarily directed to Data Set 2, which consisted primarily of unallocated clusters and file slack that constitutes mere data fragments. According to Wachtell, LECG has repeatedly recommended to Capital One that the search terms for Data Set 2 be limited and focused. When LECG conducted its review of Data Set 1, the search produced over 13,000 emails and e-files consisting of 1.3 GB of data. As to this body of information, Wachtell states that 75% was either not related to Project Street, Capital One, Wachtell's employment or partnership with Capital One or was privileged.[1] Of the responsive documents, Wachtell states that a vast majority were produced to Capital One more than a year and a half ago. The real problem, and now bone of contention between the parties, is the search of the data comprising Data Set 2, which consists of about 580 GB of data or 290 million pages of text. LECG has predicted, based on its preliminary sampling of the four Phren computers totaling 160 GB, that using 629 keywords, would yield 21 million hits. Even four terms, such as Project Street, Capital One, Kenneth Xu and CODA, could result in 150,000 hits. In his declaration, Kopelev states that a search of Data Set 2 presents further complication over and above the forensic work done on Data Set 1 because: *4 • The data residing in the Unallocated/Transactional Areas consists largely of discontinuous data fragments, meaning that such data is often not attributable to any particular document or file or date criteria (i.e., it cannot be established when such data fragment was created, modified or deleted or where it originated, without review of the actual data). Accordingly, all data that resides in such unallocated clusters or file slack would be required to be searched, since no date limitations can be applied; • A search of Unallocated/Transactional Areas is likely to result in a voluminous number of duplicative responsive fragments that cannot be electronically de-duplicated because the data fragments, although duplicative, are not exactly identical. Thus, for example if a search was conducted for the terms “Project” and “Street” and all data within 30 characters surrounding each of those search terms were retrieved, the data retrieved would essentially be overlapping and duplicative, but not identical, since the characters surrounding the keyword terms may differ, even by only one or more characters on each side. Kopelev Declaration, para. 18, Dkt # 352. Wachtell argues that not only would all of this electronic information create a massive number of non-responsive hits, it would require that each hit be manually reviewed to even determine if the data falls within the 1999 to 2003 time period. Based on the amount of time it took to review the Data Set 1 information, Wachtell predicts it would take 1800 hours of professional time to manually review Data Set 2. Wachtell argues that Capital One has already been provided with the richest quality of data based on the production of Data Set 1 documents. Wachtell's point is that the data fragments that Capital One now seeks under Data Set 2 is of inferior quality and a vast majority of the material cannot be date stamped or authenticated. Capital One disagrees with Wachtell's assessment that a search of the data in Data Set 2 creates insurmountable forensic hurtles. Of course, Capital One is relying on guidance it is receiving from its own retained computer expert. Capital One states that Wachtell has not completed the full search, agreed to in the Stipulation, of the subject computers and of the Blackberry. Capital One argues that the Court should not find that Wachtell has substantially complied with the Orders and Stipulation. Capital One maintains that relevant data resides in the slack and unallocated space of the computer systems. In refusing to produce the deleted data, Capital One contends that Wachtell is relying on misleading manipulations of the search process. For example, if a search was made for the word “Street” and this word was used 20 times in a document, each use of the word would result in a hit. Capital One believes that Wachtell has grossly overestimated the actual number of e-files or emails in the space that contain keywords. As mentioned, Wachtell's expert, LECG, has been conducting the forensic examination. The Stipulation required that the parties communicate and try to develop search protocols that would be beneficial. Wachtell states that efforts to limit the search universe were unsuccessful because Capital One wanted the broadest search possible and would not agree to a more limited approach. Capital One claims that it suggested on several occasions that LECG use software capable of searching by Boolean expressions. Another suggestion Capital One states was ignored by LECG was searching the deleted data using “carving tools” or “file carvers,” forensic tools that can reconstruct deleted files by locating and piecing together fragments of deleted files. Capital One states that at one time LECG admitted that using carving tools would be better but has now reversed its position and states that it would not be productive. In sum, Capital One argues that Wachtell has not used the best available technology to search the computer systems and produce the data. *5 Capital One's suggested remedy is that Wachtell turn over mirror copies of all of the hard drives that exist on all of the subject computers. Capital One would then use its own expert to search the slack and unallocated space and retrieve relevant data using appropriate forensic methods. Wachtell objects because the relevant computer hard drives necessarily include a large volume of information that falls outside the general 1999-2003 time frame of this lawsuit, involving other unrelated business and private matters and containing privileged material. This is how the parties had more or less framed their positions prior to the hearing on January 24, 2007. As mentioned earlier, the day before the hearing, Capital One submitted the Second Supplemental Declaration of J. Christopher Racich which contained the assertions that Wachtell personally had made five mirror copies of the Capital One laptop and ran file deletion software on the computer, all prior to the time it was picked up by Capital One personnel at his home. Following the hearing, Wachtell countered with an Emergency Motion seeking expedited discovery to respond to the issues raised in the Second Supplemental Declaration of Racich before the Court ruled on the motions for substantial compliance and Capital One's motion for sanctions. Wachtell also objected to this Racich Declaration on the grounds that Capital One had the Capital One laptop for 4 years and only on the eve of the hearing did they present the declaration, denying Wachtell the opportunity to challenge the assertions made by Racich without adequate discovery. Finally, on February 13, 2007, Wachtell filed a Motion for Leave to Submit Report of Richard L. Albee. Wachtell contends that the information in this report demonstrates that the data presented by Messrs. Ashley and Racich are inherently unreliable and that the conclusions they have drawn from examination of the Capital One laptop's hard drive are substantially flawed and unsupported. According to the Albee Report, there is no evidence that any data destruction software was ever installed or run on the Capital One laptop, but even if it had been, the laptop was configured in a “lock down mode” which would have prevented non-authorized personnel (other than IT personnel working for Capital One) from installing and running any third party software. Albee asserts that evidence in the Ashley Report does not support Capital One's argument that a partition table was destroyed. Also, based on the timing of the roll out of the Marimba program by Capital One, the backups could not have occurred on the dates represented, since it had yet to be installed on Wachtell's Capital One laptop. According to Albee, any backup done of the Capital One laptop in February or early March of 2003, had to have been done by Capital One's IT staff at its Boise facility. It is difficult to sort through this maze of accusations and counter-accusations by the parties and their experts about possible spoilation of evidence and what can or can not be retrieved from the slack and unallocated space on the hard drives on the subject computers. It appears that the layers of this onion, will have to be pealed back one at a time. 1. Additional Discovery. While not worded in these precise terms, Capital One argues that Wachtell has engaged in spoilation of evidence when he erased files and documents from the Capital One laptop before it was returned. The suggested remedy is to allow Capital One unfettered access to the hard drives of subject computers that Wachtell or Phren used after Wachtell no longer worked with Capital One to retrieve this information. It is from these computers that Capital One believes it will obtain evidence that Wachtell was using the technology developed from Project Street for his own personal financial gain. *6 This information would also presumably be contained on the five mirror copies of the hard drive that were made in the late February, early March 2003 time frame before the erase programs were allegedly run. As noted, Wachtell's position, supported by the declaration of Steven Y. Christensen, is that Capital One's IT personnel made the copies. Christensen states that he used the Maxtor 5000XT hard drive to make the backups and that the data was held on those drives until such time as the data were no longer required to be held or the hard drive re-used.[2] These drives and potential data was at the CRS IT Site Support department in Boise in 2003 until the site was decommissioned in July 2006. Mr. Christensen states he was never asked to search for any of these backups by anyone at Capital One. The Court will allow factual discovery to be reopened for the limited purposes of taking the depositions of Steven Y. Christensen and/or Don Bernaiche regarding their knowledge of what activities were taking place in February and March 2003 regarding Wachtell's Capital One laptop. This inquiry will be primarily directed to concerns raised in reports and declarations of J. Christopher Racich, John Ashley and Richard Albee about what was being done or could have been done to the Capital One laptop in February and March 2003. To the extent business records exist, Capital One shall produce logs or files documenting all of the service work that was done, the date and time the work was done and by whom. The examination of Christensen would encompass whether he accessed any of Wachtell's files while he was doing the downloads, accessed Wachtell's Yahoo email account, visited other sites that Wachtell had subscribed to, such as rebeccalord.com, customarily used Retrospect Backup software when backing up the hard drive and if he conducted searches on Google for information about erasing hard drives, or attempted to load or use such programs as killdisk.com, or ULTRAWIPE.HLP. The Court has determined to allow this further discovery in an effort to finally resolve the question of whether Wachtell actually did erase any files from the Capital One laptop prior to returning it to Capital One. If Wachtell either did not or could not have run any erase programs because of the lockdown feature on the laptop, then the files that he has admitted to “soft deleting” from the computer have already been retrieved by Capital One's expert. Capital One can obviously search the remaining information on the hard drive in the slack and unallocated space, to the extent it can be searched, since it would be in the format that it existed on the hard drive when the computer was returned to Capital One. Following this discovery, the parties will submit to the Court supplemental memorandums by April 6, 2007 addressing the issues surrounding the Capital One laptop. The Court will also consider any additional reports from the parties' experts in this limited area. If the experts take diametrically opposite positions on whether Wachtell ran erase programs and destroyed files prior to returning the computer to Capital One, then the Court will consider the appointment of an independent computer forensic specialist to review their reports and advise the Court. The procedure for the appointment of this expert and apportionment of fees and costs between the parties is discussed in the next section. 2. August 21, 2006 Stipulation. *7 Following extensive negotiations, the parties agreed what procedures could be used for recovery of electronically stored information on the subject computers, including other areas of the hard drive, such as unallocated data areas, slack data areas, as well as other system areas. The parties envisioned that difficulties might arise during this search and agreed that additional consultations would take place if technological difficulties presented themselves. The Court has concluded that the Stipulation will be complied with since it was entered into in good faith by each party. As discussed above, the parties are now at loggerheads over the question if further search of the unallocated and slack data areas on the hard drives of the subject computers can actually be accomplished in any meaningful fashion. Wachtell's expert states that they cannot be, while Capital One states that it can be done if Wachtell's expert would only follow their suggestion for the search protocols. Wachtell states that Capital One would never agree to limit the search, while Capital One states that they offered several suggestions on how the search could be conducted in an efficient manner with different forensic tools. The Court is going to require that the parties meet and confer as to steps that need to be taken to limit the search, such as the use of carving tools or Boolean expressions. Their respective experts will also attend the meeting. The Court would hope that the experts would have a frank and honest discussion if further techniques could limit the scope of the search and be productive, and not just be advocates for their respective clients. If further sample testing still produces the millions of hits that have plagued the process to date, then the parties will have to decide whether they are satisfied that they have used their best efforts or still wish to proceed to some Court ordered resolution of the matter regarding the enforcement of the Stipulation. The Court wants to put both parties on notice that if they are unable to resolve the matter in a cooperative manner, then the next step will be to have each of the parties' retained expert prepare a comprehensive report discussing why the search could or could not be done in the manner they have suggested. The Court will appoint an independent computer forensic specialist who will review the reports and advise the Court of the merits of each sides position on the feasibility of further discovery of this data. The Court will request the assistance of the parties in identifying to the Court a suitable expert that has had no prior involvement in the case along with an estimate of his fees and costs for reviewing the reports and conducting any of his/her own examination and evaluation of the data from the subject computers. Each side will then be responsible for depositing with the Court one-half of the estimated fees and costs and will also be responsible for one-half of any additional fees and costs. If the Court determines from the report of the independent expert that one side or the other has not taken a reasonable approach in searching for data pursuant to the parties' Stipulation, then the Court will make further allocation of the cost of the independent expert, which could include assessing his/her entire fees and costs solely against that party. 3. Rebuttal Expert Reports A hearing was held on March 1, 2007 regarding Capital One's Motion for a Protective Order and to Strike Improper Rebuttal Expert Reports (Dkt # 391) which seeks to bar Wachtell from filing rebuttal expert reports regarding the Capital One laptop and patentability of ideas related to Project Street. Capital One argues that since the Amended Scheduling Order did not provide a deadline for disclosure of rebuttal expert reports, Wachtell cannot submit them. Capital One also argues that the issues on which Wachtell seeks to submit rebuttal reports have been well known to him all throughout the litigation and should have been addressed in his initial expert disclosures. *8 As to the Albee Report, the rebuttal report regarding the Capital One laptop, the Court finds it to be an appropriate area for rebuttal and will permit the filing of this report. As to the expert reports Wachtell wants to submit regarding patentability, the Court will allow supplementation of the Carbonnell Report under Fed. R. Civ. P. 26(e)(1) but will exclude the report by the new expert, Mr. Kunin, as the Court does not believe it is in the nature of a true rebuttal. The Court expects the parties to work in good faith to promptly set up a schedule for the depositions of the experts that will be testifying at the trial. Because of the issues raised by the Reports of Ashley and Albee regarding the Capital One laptop, the Court envisions that the parties may also want to take their depositions. 4. Amended Scheduling Order The Court will amend the Amended Scheduling Order (Dkt # 371) as follows: 1. All expert discovery and depositions will be completed by April 6, 2007. The same day the parties will submit supplemental memorandums addressing the issues surrounding the Capital One laptop. 2. The parties are still directed to attend mediation between March 25, 2007 and April 25, 2007, and to notify the Court of the results. 3. All dispositive pretrial motions shall be filed on or before April 25, 2007. Opposition briefs to dispositive pretrial motions shall be filed on or before May 16, 2007. Reply briefs to dispositive pretrial motions shall be filed on or before May 30, 2007. 4. A hearing on all dispositive pretrial motions will still be held on June 26, 2007 at 10:00 a.m. in Boise, Idaho. ORDER Based on the foregoing, the Court being otherwise fully advised in the premises, IT IS HEREBY ORDERED that: 1) Plaintiff's Request for an Order of Substantial Compliance with the Court's Prior Orders (Dkt # 350), filed September 21, 2006, be DENIED without prejudice. 2) Defendants' Motion for Sanctions for Failure to Comply with Orders and Stipulations and to Strike or Stay Plaintiff's Request for an Order of Substantial Compliance (Dkt # 354), filed September 27, 2006, be DENIED without prejudice. 3) Defendants' Motion to Strike Plaintiff's Sur-Reply and Attachments to Plaintiff's Opposition to Defendants' Motion for Sanctions (Dkt # 366), filed November 2, 2006, be DENIED. 4) Defendants' Sealed Motion for Leave to File Supplemental Declaration of J. Christopher Racich in Support of Defendants' Motion for Sanctions (Dkt # 375), filed January 17, 2007, be GRANTED. 5) Plaintiff's Motion for Expedited Discovery and Stay of the Issuance of Orders Respecting Pending Motions re: Forensic Discovery (Dkt # 383), filed January 30, 2007, be GRANTED. 6) Plaintiff's Sealed Motion for Leave to Submit Report of Richard L. Albeee in Further Support of Plaintiff's Request re: Docket # 350, 383 & 354 (Dkt # 389), filed February 13, 2007, be GRANTED. 7) Defendants' Motion for Protective Order and to Strike Improper Rebuttal Reports (Dkt # 391), filed February 15, 2007, be GRANTED in part and DENIED in part. [1] It is important to note that the information on the hard drives of the subject computers contains a vast amount of information which would not be relevant to this litigation and could contain privileged communications between Wachtell and his counsel, since these computers were used for several years afterWachtell left Capital One. [2] Wachtell initially denied he even owned or had access to a Maxtor 5000XT so he could not have been the one making the backups. On February 28, 2007, Wachtell filed a declaration where he stated that he has now found documentation that he purchased a Maxtor 5000XT on February 3, 2003 in California. He still denies ever using it to backup the disc on the Capital One laptop.