Imaging — without any further examination and without disclosure of the contents of computers — may be agreed upon by the parties as a mutually beneficial way to get Electronically Stored Information (ESI) quickly preserved. Such an agreement allows the parties to put their computers (or other ESI storage devices involved) put back into productive service without fear of loss of evidence. Immediate imaging may be your option of choice, both for what you want your client to do, and what you want the adversary to do. If you adversary will not agree on it, consider asking the court for immediate imaging in the objective, safeguarded, manner of this protocol.
This legal form (Agreement or Order for Imaging Computers) gives you:
- “Best Practices”: Language to have the expert image the computer in a way the lawyers need it done. (For example, using this form you will not make the mistake of omitting a bit stream of unallocated and slack space in the storage device.) Don’t reinvent the wheel, don’t make mistakes.
- Time: Don’t waste time when you have more important things to do. Start with the known best practices.
- A Versatile Form: The protocol gives you the best ways to safeguard ESI without going further to have an expert examine the contents and report on the contents. This protocol works whether you are doing the imaging by agreement of the parties, by court order over the objections of the adversary, or by your own directions to your own expert.
- Evidence: You gain a “frozen image” in the hands of an expert who can testify to foundation and chain of custody to the evidence you later find and use from that image.
- Protection: A proper forensic image “freezing the ESI in your client’s computers protects both you and your clients from claims of spoliation.
- Cost-Saving: Imaging without further work by an expert is relatively inexpensive. It may be all you need (unless there is a dispute about what your client later produces from the “unfrozen” original disk drive).
- Knowledge: Dos & Don’ts: Learn from this form the items you need to consider and “nail down”.
Preview: Here are two of the sections of this protocol that can be used for your agreement with counsel, for your proposed order on a contested motion, or simply as directions to preserve your own client’s evidence.
07. Hash values. All images and copies of images shall be authenticated by generating [a hash value] [an MD5 hash value] verification for comparison to the original hard drive.
* * * *
10. Non-disclosure. The Forensic Examiner will not deliver copies of the forensic images and will not disclose any information in the forensic images, to the parties or any other persons, pending [the further order of the court or the joint request of both parties] [the request of the attorney for A].
Imaging Protocol is furnished to you, in PDF format, right to your computer, immediately. If litigation is imminent or just starting, buy Imaging Protocol and get ready to talk to your adversary in the next ten minutes.
Not only will you get a great form which will work for a checklist, you’ll get it for only $21.90.
The fact is, just the FEELING of knowing what to do must be worth $21.90. Consider your small investment a little “emotional insurance policy”.
