CAMPBELL ALLIANCE GROUP, INC., Plaintiff, v. Ashwin DANDEKAR, Emily Hua, and Jonathan Betts, Defendants No. 5:13–CV–00415–FL United States District Court, E.D. North Carolina, Western Division January 13, 2014 Counsel Daniel F. Lanciloti, Seyfarth Shaw, LLP, Chicago, IL, for Plaintiff. Phillip J. Strach, Ogletree Deakins, P.C., Raleigh, NC, for Defendants Ashwin Dandekar and Emily Hua. J. Philip Martin, Kastner Kim LLP, Mountain View, CA, for Jonathan Betts. Flanagan, Louise W., United States District Judge ORDER *1 This matter comes before the court on plaintiff's renewed motion to expand expedited discovery (DE 50). The matter has been fully briefed, and the issues raised are ripe for decision. For the reasons that follow, the court grants in part and denies in part plaintiff's motion to expand expedited discovery. BACKGROUND The court focuses here on the status of the case as it relates specifically to the instant motion, where reference can be made to prior orders, including most recently the court's order on plaintiff's motion for temporary restraining order, for a more detailed background summary. On December 6, 2013, plaintiff filed a motion seeking to expand expedited discovery (DE 37). Plaintiff sought to expand the previously ordered expedited discovery to include, among other things, a forensic examination of any computer(s) and/or electronic device(s) on which plaintiff's confidential and proprietary information may be located. By order entered December 23, 2013, the court denied as moot plaintiff's earlier motion to expand expedited discovery where the original defendants asserted that Blue Matter already had offered to make the relevant computer(s) available for forensic examination under a protocol to be mutually agreed upon by the parties. The court directed the parties to meet and confer to determine a forensic examination protocol for the relevant computer(s) on or before December 30, 2013. If resolution was not reached, plaintiff could renew its motion seeking to expand expedited discovery, to include specific reference(s) on the face of any discovery motion, as to what, precisely, it seeks to discover, in filing on or before January 3, 2014. Accordingly, plaintiff filed the instant renewed motion to expand expedited discovery. By text order entered January 6, 2013, the court informed the parties that it was ordering a forensic examination of the subject computer(s) and/or electronic device(s), despite the protests of the original defendants, Ashwin Dandekar and Emily Hua. The court allowed defendants until 12 noon on Wednesday, January 8, 2013, to address further plaintiff in an effort to reach agreement among all parties as to protocols. The court directed any response to the instant motion to be filed by Friday, January 10, 2014, if no agreement could be reached. While newly added defendant Jonathan Betts, through counsel, voiced agreement to plaintiff's proposed protocol, the original defendants did not. Accordingly, where the original defendants timely filed expedited response in opposition to the instant motion, the issues raised are ripe for decision. DISCUSSION Plaintiff seeks to obtain additional, expedited discovery to conduct a forensic examination of (1) the Seagate electronic storage device, Serial No. NA5KJ7SM, onto which Betts allegedly copied Campbell information; (2) the Blue Matter computer to which the Seagate device was attached; and (3) any other electronic device in defendants' custody, possession, or control which may contain Campbell information. Plaintiff also seeks to depose Berts on or before January 31, 2014. Plaintiff's proposed forensic examination protocol, attached as Exhibit D to its supporting memorandum, is made a part of this order in addendum hereto. *2 “The gist of the parties' instant dispute is the scope of the forensic examination protocol.” (Pl.'s Mem. in Supp. 6). Plaintiff seeks to forensically examine the Seagate device, Betts's Blue Matter computer, and any other electronic device in defendant's custody, possession, or control which may contain Campbell information. Defendants contend a search of any Blue Matter computer and/or device, without an identification of the information plaintiff seeks, would amount to an unlimited fishing expedition for a competitor's information. (Defs.' Resp. 7). Accordingly, defendants seek to limit the forensic examination to a search of Berts' Blue Matter laptop for the specific information contained on his Seagate device. (Id.). After review of the record and for good cause shown, pursuant to Federal Rule of Civil Procedure 26(b)(1), the court hereby orders the parties to conduct forensic examination of the Seagate electronic storage device and Betts's Blue Matter computer. The Seagate electronic storage device shall be examined first, in accordance with the protocol attached hereto, which protocol is adopted by the court as its own in the case. Thereafter, Betts's Blue Matter computer shall be examined pursuant to the specified protocol, but with examination limited to a search for the responsive information identified on the Seagate electronic storage device. The search of the Blue Matter computer shall be for the responsive information generally, not merely the specific files identified on the Seagate device. Plaintiff's motion is denied in that limited part where it requests a forensic examination of any other electronic device in defendants' custody, possession, or control which may contain Campbell information. In addition, Berts shall appear for deposition on or before January 31, 2014. CONCLUSION For the reasons given, plaintiff's renewed motion for expanded expedited discovery is granted in part and denied in part as set forth above. SO ORDERED. Protocol STIPULATION REGARDING PROTOCOL FOR FORENSIC INVESTIGATION AND ANALYSIS Pursuant to agreement of Plaintiff Campbell Alliance Group, Inc. (“Campbell”), on the one hand, and Defendants Ashwin Dandekar, Emily Hua and Jonathan Betts (collectively, “Defendants”), on the other, and as provided for by Federal Rules of Civil Procedure Rule 26(b)(1) and (c)(1), the following Stipulation Regarding Protocol for Forensic Investigation shall govern the handling of all forensic investigation, imaging and analysis in Campbell Alliance Group, Inc. v. Dandekar, et al., Case No. 13–cv–415, which is currently pending in the United States District Court for the Eastern District of North Carolina: 1. Campbell and Defendants (the “Parties”) jointly agree to this forensic inspection protocol (the “Protocol”), which sets forth the full agreement between Campbell and Defendants for the forensic imaging, search, and inspection of designated electronic devices and virtual repositories used by Defendants and potentially containing Campbell's confidential and/ or proprietary information in the possession, custody, or control of Defendants. *3 2. The hard drives of any computer(s) and other relevant devices, including a Seagate external storage hard drive bearing serial number NA5KJ7SM, along with necessary passwords, will be turned over to Campbell's designated computer forensics expert, Innovative Discovery (“ID”), by next week. Defendants will give Campbell's counsel 48–hours' advance notice of when the items will be shipped so Innovative Discovery can arrange for the necessary staffing to expeditiously image the devices. ID will aim to return the devices within 48–72 hours of their receipt, assuming they are produced with advanced notification and the devices are not encrypted. 3. Before any search or other analysis is conducted, an agent or representative of ID will sign an affidavit in compliance with the Protective Order in this matter. To that end, all information received or located by ID shall be treated as confidential, unless otherwise designated, and shall not be disclosed to anyone except in compliance with this Protocol and the Protective Order in this matter. 4. Before beginning any work on the devices, ID will utilize a hardware write block device on the devices in order to protect the integrity of the existing data. 5. ID will create a forensic image of each device. Upon completion of the imaging, ID will verify the resulting forensic images by comparing the MD5 hashes of the device and the forensic images. If the MD5 hashes match exactly, ID will return the computers and devices to Defendants after Campbell's information, if any, is permanently removed from the devices. 6. ID will then conduct a search of the images using search criteria defined by Campbell's counsel. Any search will be formulated to identify and collect data responsive to Campbell's discovery requests. Campbell has absolutely no interest in Defendants' personal or irrelevant data. 7. ID will also conduct a forensic investigation of each device to review activity involving data downloads, data deletions, data obfuscation, and data transfers during the time frame of January 1, 2013 to the present. 8. If the search identifies responsive information, that data will be isolated and copied onto new media. Before Campbell's counsel is provided with the data on the new media, defense counsel will have a period of five (5) business days to review the data for privilege and/or confidentiality designations (pursuant to the Protective Order in this matter), and prepare an appropriate privilege log. 9. After any confidential or privileged data is identified by defense counsel, Innovative Discovery will copy the responsive information, including data designated as confidential data but excluding the data designated as privileged, onto new media and deliver it to Campbell's counsel. 10. Counsel for the parties will then resolve the handling of the data identified on the privilege log, involving the Court if necessary.