XPEL Technologies Corp. v. American Filter Film Distributors, Case No. 08-0175 (W.D. Tx March 12, 2008)

In a case in which plaintiff alleged serious copyright infringement through unlicensed downloading and modification of designs for automotive paint and headlamp protection for various models of automobiles, and attached declarations to its motion describing in detail the manner in which the infringement took place and where the illegal copies were likely stored, Magistrate Judge Nancy Stein Nowak granted plaintiff’s motion for expedited forensic imaging. The Judge did not explain her reasoning, but it is notable that defendants did not file a brief opposing the motion.

The court ordered all of the computers and other electronic storage devices located at defendants’ place of business to be imaged, all images to be authenticated using hash value verification, and all images to be maintained in confidence by the forensic expert until such time as the court orders or the parties agree on destruction of the images.

The interesting part of the order is what is not there. Plaintiff’s motion had requested three phases of relief. The court granted the first. The second and the third would have given the plaintiff pretty open access to the defendants’ computer systems. Plaintiff sought the following:

Phase 2 - Forensic Analysis:

a. For each computer imaged, the Forensic Examiner will generate a standard set of reports in the form of electronic Excel spreadsheets or Access databases, showing all allocated/unallocated files and folders on each media image (an "all files" listing), and will distribute this to all parties. The "all files" listing will be produced by the Forensic Examiner within five days of imaging each media item unless processing difficulties occur at which time all parties will be advised immediately of the problems and anticipated resolution date. Any additional reports requested by any party shall be borne by the Requesting Party.

b. Both parties may request from the Forensic Examiner certain reports from its forensic analysis, including, but not limited to, system registry information, deletion history information, internet browsing history, web-based email activity, system events, Ink files, recycle bin entries, and USB, USB2, Firewire, and/or Bluetooth storage devices. Such searches shall be limited by the Date Range. The cost of reports requested by Defendants shall be borne by Defendants.

c. Any party may request that the Forensic Examiner extract metadata, deleted files and/or file fragments at the Requesting Party's expense, subject to the agreement of the producing party. Consent by the producing party to extract such data will not be unreasonably withheld.

Phase 3 - Production:

a. Forensic Examiner will maintain all mirrored images. Working copies may be requested by Defendants, and the cost of such working copies will be borne by the Defendants.

b. All parties may review the "all_files" spreadsheet and reports as run per the Protocol outlined in Phase II. If the idea here was, as plaintiff suggested in its moving papers, to preserve the data as it exists now, the court’s order does the job. What happens with that data will undoubtedly be the subject of intense discovery negotiations, as it should be.

Read the Court’s Order