BACKGROUND AND PRIOR PROCEEDINGS

*1 The Special Master was appointed on March 3, 2014. (Dkt. No. 149.) On March 10, 2014, the parties, counsel for all parties, and ESI consultants for all parties, met with Special Master Daniel Garrie and United States Magistrate Judge Peggy Leen in chambers. (Dkt. No. 151.) On March 18, 2014, Special Master Garrie memorialized his directives to the parties in a written order. (Dkt. No. 154.)

On March 18, 2014 Order Special Master Garrie set a hearing schedule, with hearings on April 4, 2014 and April 7, 2014. Present on behalf of Plaintiffs were Counsel Jon Tostrud, Marc Godino, and David O'Mara and ESI consultants Douglas Forrest and Bruce Pixley. Present on behalf of Defendant were Counsel Margaret Foley and Cayla Witty, ESI vendor Joe Edmondson, and Dean Schaibley, Network Security Administrator from the UMC IT Department. In addition, the following UMC IT individuals attended the April 7, 2014 hearing: Jason Clark, Sr. Systems Administrator, Marilyn Susan Kisner, IT Customer Support Manager, and Shane Lattin, Network Engineer. See Exhibit A (April 4, 2014 rough hearing transcript); Exhibit B (April 7, 2014, hearing transcript.)

At the April 7, 2014 hearing, Special Master Garrie ordered an additional telephone hearing on April 10, 2014. See Exhibit B at 234:01–236:21 Present at the April 10, 2014 telephonic hearing were Counsel and their respective ESI Consultants and ESI vendor, and no individuals from UMC's IT Department. See Exhibit C (April 10, 2014, rough hearing transcript)

The Special Master conducted full day hearings on April 4, 2014 and April 7, 2014 with counsel, the parties' representatives, and consultants regarding UMC's ESI collection and production issues, as well as UMC's efforts to preserve discoverable materials pursuant to the Plaintiffs' litigation hold/preservation letters, and UMC's search of the ESI collected.

These hearings identified multiple potential failures by UMC with respect to the collection, preservation, and search of the ESI by UMC.

ISSUES WITH UMC COLLECTION EFFORTS

Among other things.

B. UMC Failed to Perform Custodian Interviews.

UMC failed to perform custodian interviews and this contributed to many of the above collection issues. See Exhibit A (hearing transcript from 04/04/14) at 50:3–25; 51:1–5 (UMC states that no custodian interviews were performed by it on or before the Special Master proceedings.)

C. UMC and UMC ESI Vendor Did Not Create Any Chain of Custody Paper Work for any of the ESI that was Collected by the UMC IT Department.

On March 18, 2014, Special Master Garrie ordered UMC to create Chain–of–Custody paper work before the hearing on April 4, 2014. While UMC did submit a chain-of-custody, it was inadequate for its purpose. See Exhibit A (hearing transcript from 04/04/14) from 46 to 48. Specifically, the chain-of-custody failed to record several things, including (i) what sources UMC collected data from for each of the twenty seven (27) custodians, (ii) how they identified the ESI, (iii) how they collected the ESI, (iv) how the ESI was preserved, (v) what criteria were used to identify the ESI that was collected.

ISSUES WITH UMC PRESERVATION EFFORTS

UMC was informed by Plaintiffs and the Court multiple times of its obligation to preserve information, including on: August 6, 2012, November 6, 2014, March 10, 2014, March 18, 2014 and April 4, 2014. See e.g., Exhibit E (preservation letter sent to UMC); Exhibit F (internal UMC email informing patient service leaders to preserve documents); Exhibit G (deposition testimony of Mr. Espinoza where he states he is aware of his duty to preserve documents). Despite this it appears that UMC did not take the necessary steps required to ensure preservation of relevant ESI by all custodians. See Exhibit B (hearing transcript from 04/07/14) 84:1–15 (Ms. Kisner states she did not receive a preservation notice and yet Ms. Kisner is one of the UMC IT employees responsible for wiping blackberry devices.)

*3 It appears that UMC has not preserved:

In addition, UMC is still unable to answer questions as to what data preservation policies have been implemented on their blackberry server and intranet. See Exhibit B (hearing transcript from 04/07/2014) at 98–102 (Several UMC IT employees state they do not know the policies implemented on UMC Blackberry server or intranet.)

ISSUES WITH UMC FIRST, SECOND, AND THIRD PRODUCTION

The UMC productions suffered from certain technical issues that prevented appropriate search and collection. See Exhibit I (UMC ESI vendor findings regarding production) at 3 (states that “[d]espite the manufacturers claims of compatibility the results of these tests show that it is likely that most errors were caused by P2 Commander not processing the source files accurately.”) It appears that the software tool chosen by UMC, while used in the industry, did not work. Special Master Garrie was able to resolve these technical issues.

In addition, UMC failed to identify several encrypted files in production, which were not searched. See Exhibit B (transcript of hearing on 04/07/2014) at 26–29 (UMC ESI vendor states there were various encrypted files which included two DMG files for Macintosh, which UMC is unable to explain since none of the custodians supposedly had or used Macintosh devices.)

POSSIBLE SPOLIATION ISSUES

UMC has yet to accomplish a complete collection of all responsive ESI. This fact, together with the issues identified above, suggests potential spoliation of relevant evidence. Spoliation will be the subject of further attention by Special Master Garrie, and will be one of the topics addressed in his final order.

IT IS HEREBY FURTHER ORDERED THAT Plaintiffs and UMC will have done or do the following:

Plaintiffs.

Defendants.

5. UMC is to provide, on or before April 16, 2014, a letter to Special Master Garrie and Plaintiffs a letter affirming that, on a going forward basis, the following ESI repositories are being preserved using industry best practices:

HEARING DATES

The following dates for hearings are as follows: April 15, April 22, and May 7. All hearings will be held at the Las Vegas court house or telephonically with a court reporter present. The Special Master will coordinate with the court to confirm space is available. The Special Master Orders the parties to be PREPARED and their ESI and UMC IT EXPERTS TO BE AVAILABLE either by phone or in-person.

At the hearing on April 22, 2013, the Special Master has ordered Lawrence (Larry) Bernard, Chief Executive Officer, Ernie McKinley, Chief Information Officer, and John Espinoza, Chief Human Resources Officer to appear at the hearing, their presence being necessary to provide a complete understanding of UMC's discovery related actions and inactions to date.

The Special Master Orders the parties to provide all materials to be discussed at the hearing at least 24 hours prior to the hearing.

TIME ESTIMATE

The Special Master at this time is unable to provide a precise estimate as to the amount of time required to perform the work set-forth above.

SO ORDERED.

4–4–14 ROUGH DRAFT OF SPECIAL MASTER'S HEARING

This realtime draft is unedited and uncertified and may contain untranslated stenographic symbols, an occasional reporter's note, a misspelled proper name and/or nonsensical word combinations.

This is an unedited version of the deposition transcript and should not be used in place of a certified copy. This document should not be duplicated or sold to other persons or businesses. This document is not to be relied upon in whole or in part as the official transcript. This uncertified realtime rough draft version has not been reviewed or edited by the certified shorthand reporter for accuracy. This unedited transcript is computer generated and random translations by the computer may be erroneous or different than that which will appear on the final certified transcript.

Due to the need to correct entries prior to certification, the use of this realtime draft is only for the purpose of augmenting counsel's notes and cannot be used to cite in any court proceeding or be distributed to any other parties.

Acceptance of this realtime draft is an automatic final copy order.

UNITED STATES DISTRICT COURT

DANIEL SMALL, CAROLYN SMALL, WILLIAM CURTIN, DAVID COHEN, LANETTE LAWRENCE, and LOUISE COLLARD, Individually, and on Behalf of All Other Persons Similarly Situated, Plaintiff,

*7 vs.

UNIVERSITY MEDICAL CENTER OF SOUTHERN NEVADA, Defendant.

Case No. 2:13–cv–0298–APG–PAL

* * * ROUGH DRAFT * * *

REPORTED BY: Janet C. Trimmer, CRR, CCR No. 864

APPEARANCES:

For the Plaintiffs:

For the Defendant University Medical Center of Southern Nevada:

Also Present:

I N D E X

THE SPECIAL MASTER: I'm going to get started now. This is the hearing, just for the record purposes today, in regards to resolving a series of e-discovery and collection-based issues.

There was a prior order. I forget the day it was issued. Does anybody have a copy of the prior order that was issued by the Court?

MR. TOSTRUD: Yes. THE SPECIAL MASTER: I just want to enter it in so that we have the record, because we are going to use that as sort of a framework for our conference today.

MR. TOSTRUD: Just to be clear, you would like a copy of the order appointing you?

THE SPECIAL MASTER: Not appointing me. The subsequent one where I issued an order saying we are going to cover—

MR. GODINO: The special master e-discovery order?

THE SPECIAL MASTER: Yes. Off the record.

THE SPECIAL MASTER: Back on the record.

THE SPECIAL MASTER: We're going to use this order as a framework for parts of the conversations throughout the day today and we'll touch on certain things.

*8 I have high hopes that we will make dramatic progress. I spent a lot of time reviewing materials and understanding everything. I'm going to quickly go off the record.

THE SPECIAL MASTER: Back on the record here.

So going forward, I had a chance to review all of the materials, which was very extensive and complete, and I also received the chain of custody interview forms, etc. There will be a discussion about privilege, and we will certainly touch on that.

Before we get to that, though, I wanted to check: The PST repair, can we enter that into evidence? Is there any objection as privileged by counsel?

MS. WITTY: No.

THE SPECIAL MASTER: So I would like to enter into evidence, provide a copy. I have three copies printed. I'm going to go for the easy ones to start, and then we'll progressively deal with the more challenging issues. But I want everybody to feel at least we are making progress to start.

So as they are entered into evidence, I'm going to turn to our colleague. Did you enter your name and your card?

MR. EDMONDSON: I still don't have a card. She has my name.

THE REPORTER: I have his name.

THE SPECIAL MASTER: Do you want me to call you Joe or Joseph?

MR. EDMONDSON: Joe is fine.

THE SPECIAL MASTER: Joe, I'm going to ask you a bunch of questions about this material. I would like counsel to get a copy of it, and before I get into it, I'm going to explain what it is.

MR. GODINO: We have somebody on the phone.

THE SPECIAL MASTER: Oh, you do? Are they on the phone? Have they dialed in?

MR. GODINO: We were told him that the Court would dial him.

THE SPECIAL MASTER: Thank you for joining us today.

Unfortunately, we don't have wireless Internet so you can't see the exhibits as they are going in.

MS. WITTY: We do have wireless.

THE SPECIAL MASTER: Oh, we do?

MS. WITTY: Yes.

THE SPECIAL MASTER: So it might be useful to provide their ESI expert with a soft copy of the ...

So Bruce, this is Daniel. We are going to arrange so that when we have exhibits entered, that you will receive soft copy of them when they pertain directly to ESI issues, so that way you can work with your counterparts as necessary.

MR. PIXLEY: Okay. Thank you.

THE SPECIAL MASTER: Okay, Joe. Ready?

MR. EDMONDSON: Yes.

THE SPECIAL MASTER: Did the other side get it?

MR. TOSTRUD: Yes, we have a copy.

THE SPECIAL MASTER: And it's Exhibit 2.

JOSEPH EDMONDSON—EXAMINATION

BY THE SPECIAL MASTER:

Q. So I want to start at the top and go all the way through, but before I jump into it: So you, the PST—first things first. It certainly appears that Paraban does not work?

A. Yes.

Q. No?

A. In this case, that is correct.

Q. I mean, in this particular case with this

9 particular situation, based on the table you provided, it's very evident that, contrary to the e-mails and their own direct statements saying that it would work, it didn't work.

*9 The good news is—why don't you walk us through what you did for each of the custodians. And I particularly want to—when we are going through them with John Espinoza, I'd particularly love to know where you got the PST and OST files from. We can table that for downstream.

A. Okay.

Q. The PST/OST file question arises from, the collection script that was run, does not appear to have collected PST or OST files relating to them. So one of those issues we'll talk about a little downstream. So I'm a little-I want to know how you got them. But we'll get to that in a minute.

So why don't you walk me through what you did, starting with you identify PSTs and OSTs. How did you identify them?

A. I filtered an EnCase by extension.

Q. And this is total number?

A. Yes.

Q. This is total number of the entire case file?

A. Inside the case file, yes, which was the EO 1 that I had created from the A.

Q. And we'll get to the chain-of-custody piece later.

So this is the universe of what you working for OST and PST files?

A. Correct.

Q. What about MBA, like Outlook Express?

A. Outlook Express, there were some files, but I didn't run the—scan PST on those.

Q. Okay. You need to run them on that as well.

A. Okay.

Q. Because it would appear—and we will touch on that—that as much as people want to tell users to use a certain system, at least it would appear, based on the collection script, that either their children were using or they were using Outlook Express in lieu of Outlook at least, one or two of them, and we'll touch on that later. But just please run it on Outlook Express.

What were the results—so you mentioned Jackie Panzeri?

A. Yes.

Q. Walk me through Panzeri.

A. Two of her PSTs failed.

Q. For the record, who is Jackie Panzeri?

MS. FOLEY: Payroll.

MS. WITTY: Jackie Panzeri is payroll manager at UMC.

BY THE SPECIAL MASTER:

Q. So keep going. So she has—

A. Two of her PSTs failed when we were in scanned PSTs, and the error suggested that it was an ANSI format PST that was over 2 gigs. So it had to be trimmed in order to successfully run the scanned PST.

Q. So we're on the same page, those are the only two you came across with errors?

A. Well, they are the only two that failed.

Q. That failed.

A. Yes.

Q. When they failed, just so we are on the same page, what did you do when they failed?

A. I then ran PST 2 gig to trim off the end of the file. So I started at 10, to see if it would actually repair after that. If it repaired, remove only 5 from the original, try again. Till I got the smallest amount that I could remove and still repair it successfully.

Q. You went from 2 gigs to 36 megs?

A. Yes.

Q. And then 2 gigs to 512 megs?

A. Yes.

Q. That's a big haircut, so to speak?

A. Yes, it is.

THE SPECIAL MASTER: We will revisit those two mailboxes or those two PST files.

You didn't have—and we'll get to—we'll touch on the collections.

*10 Thank you to you. I didn't catch your name.

MR. SCHAIBLEY: Dean Schaibley.

THE SPECIAL MASTER: Thank you, Dean, from UMC, showing up. I like to have people with feet on the ground, because at the last hearing there was a little—more in the clouds, we had a much-higher-in-the-air perspective, and so this will be pretty much more useful.

Q. So you trimmed them, but you only found two that failed?

A. Correct.

THE SPECIAL MASTER: And you provided me with those log files, and I started to review them. But would you have any objection, Counsel, to the other side seeing the results of the log files that he was—the repair—

MS. WITTY: From the scan and repair?

THE SPECIAL MASTER: Yes.

MS. WITTY: No, there is no issue.

THE SPECIAL MASTER: So I'm going to order you to turn them over to the other side.

I would say we would enter them into evidence, but they are way too long, and nobody deserves to have to carry those around.

But let the record reflect that I have ordered the parties to turn over the scan repair logs that were provided to me in an e-mail by counsel in a timely fashion, meaning within 24 to 48 hours.

Q. So tell us about the results of the tests here.

A. The results, yes. What I did was, I then took the repaired PST files, located the—

Q. For those two, or for all of them?

A. For all of them. So I took—

Q. Were there any other errors on the repairs that you ran, or was this it?

A. Those were the only errors that failed.

Q. But there were other errors?

A. There were other things that were repaired. Within the log files, there were other errors that were repaired in other PST and OST files.

THE SPECIAL MASTER: I believe that almost every one of them at some point had some sort of repair done. The logs will reflect that and it will allow the other side to see what exactly ...

Mr. Pixley, can you hear me?

MR. TOSTRUD: Bruce?

MR. PIXLEY: Yes, I've been able to hear.

THE SPECIAL MASTER: So I'm going to let counsel figure out who they want to send them to look at as well I'm looking at them. We'll have a conversation about what we will do with the errors, but let's first talk about what we found and what we can do going forward, and then we'll deal with the other pieces that remain from that.

Q. So keep going.

A. Okay. So I took the Bates numbers from the production and the discussion that we had before, and I look—

Q. And that's referring to Mr. Pixley's declaration where he provided where he identified a series of e-mails?

A. Correct. And so I located the original source of those e-mails, and then-

Q. In the containers; right? In the PST/OST files?

A. Yes, which PST or OST they came from, and then I exported using P2 Commander in both EML and MSG format. I also mounted those PSTs in EnCase 6 and 7 and exported the same file in MSG format from both of those. That way we could compare all four possible production options.

*11 THE SPECIAL MASTER: And what was the end result, at a summary level? And we'll go through it.

Do you guys want to go through each one? They are pretty much the same, but we can if you want.

MR. TOSTRUD: You mean each of the different custodians?

THE SPECIAL MASTER: No, we'll go through that later. All we're discussing right now is that we ran, scan, and repaired, and then I ordered them to look at—and in Mr. Pixley's declaration he identifies a series of e-mails that were problematic. I told him to focus on those specific ones and see if the software breaks for Paraban, and if Paraban doesn't work, find me something that works.

He's now talking about EnCase 6 and EnCase 7 and the results of what he found. And if you will look at the exhibit, you will see the Bates number 1—

MR. TOSTRUD: Uh-huh.

THE SPECIAL MASTER: It has, just for the record, it says P2 commander software EML, the native body view is blank, the native attachment view is a text file, that's mime, eCapture text was a raw mime, and Ipro eCapture was left blank.

If you then go to what P2 Commander did with the MSG file, it was even more spectacular. It couldn't open them in the native body view; it couldn't actually open them in the native attachment view. But it did appear correct in the eCapture text extract.

Then we look at EnCase 6 and EnCase 7 and we see there were no problems, which means that at the end of the day, it appears based on if you look at all the different specific Bates stamp pages, that if you use EnCase 6 or 7 to perform the extraction and that piece of it, it will resolve or remediate at least the sample of e-mails that you provided as a test case, it fixes all of those, which then leads me to believe that the error was with the Paraban software itself. Does that make sense? Any questions?

Is that accurate?

MR. SCHAIBLEY:

A. Yes.

THE SPECIAL MASTER: Does counsel have any questions? We'll talk about the error logs and all of that a little bit later. I'm just trying to get through at the very least we know that we can now process e-mail.

MR. TOSTRUD: I don't think we'll need to go through each one individually.

THE SPECIAL MASTER: Okay. Good. You never know. If I don't ask, I'll never know. I'm going to go off the record for a second.

THE SPECIAL MASTER: I'm going to—Joe—I'm going to request—or Mr. Edmondson. My apologies—that you process everything again through EnCase 7, because—and assuming that we don't have Chinese character issues, we'll—and recognizing fully and completely that there is a whole set of other issues that we need to have a conversation about, and counsel for UMC, that you need to be aware of, that the e-mails that were actually—the PST and OST files themselves had errors, and we're not talking for some of these custodians that were identified on the list, particularly Ms. Panzeri, like her PST and OST collection itself; those e-mail containers had substantial issues.

*12 So we have to have a conversation about how to deal with that and address that to make sure that the search you are running is actually of the e-mails that you believe to exist there and, if not, how we can address that.

But recognizing that, I'd like to suggest: You'll get the scan and repair logs, and I request that you guys, in some sort of timely fashion or by on or before Wednesday of next week, review them.

And if you have any—we'll have a conversation about them, but if you want to raise any issues about them or things that you identify that we do not discuss today or in the hearing on Monday, we will talk about them.

I'd like to get it in writing by Wednesday, and so we can then either figure out if we need to have a phone hearing or an in-person hearing accordingly.

MS. WITTY: They should have received an electronic copy of the zip file containing those.

THE SPECIAL MASTER: Did you receive it?

MR. TOSTRUD: Yes.

MR. GODINO: Yes.

THE SPECIAL MASTER: So counsel did receive it. Okay. So that's good news; right? I mean, there is a whole lot—there is a litany of other things to cover, but at least now I think what I'm going to suggest—I'm going to go off the record for one second.

THE SPECIAL MASTER: Let's go back on the record.

MR. TOSTRUD: Plaintiffs are absolutely amenable to rolling production beginning next week or as soon as possible or practicable. We just want to put on the record that these five custodians and 10 or 12 search terms, however we identified them, is an initial ESI—

THE SPECIAL MASTER: 100 percent.

MR. GODINO: Also, that this is a production of only e-mails.

THE SPECIAL MASTER: Well, that will be—it will be a production—I would request not only—when I said process, I meant process it all. It will be a process of whatever they collected, and we will have a conversation later today about what was actually collected, but it will be whatever was in the collection containers for each of these custodians that was provided by UMC to their initial forensic expert, then was provided to the next forensic expert, then was provided to counsel. So whatever fits within that realm of what was collected is what you will be getting in the rolling production.

MR. GODINO: Understood.

THE SPECIAL MASTER: The only—if there are additional errors and etc., I would request that you notify me within 24 hours in writing. You don't have to be specific about it. Say we have identified a specific error issue, and we will either flag it and address that specific technical issue or, if necessary, we'll slow down the rolling production and address that, if necessary.

I'd like, if at all possible, make this production at least start moving somehow forward in some fashion, and I know at the very least e-mail works.

So I'm going to keep the bar low and go with just—I know for a fact that whatever is sitting on this page was mounted and works. So I can rest assured that you'll receive those.

*13 Does counsel for UMC have any objection to that?

MS. WITTY: Can you clarify what you mean by the production for next Friday?

THE SPECIAL MASTER: What I do want by end of today—and there will be a lunch break. I know that's, exciting as it may be, to not talk about work at lunch. I'm going to kindly ask that you look at your EnCase file and you coordinate with counsel to at least come up with a tentative schedule so that by the end of this hearing, we're walking out of this here saying by this day we will turn over one custodian, two custodian, three custodian, four custodian, five custodian; however it works, for whatever has been collected. We're not talking about what—the scope of the collection—we're not commenting at all on the collection. It's just what exists now that has been collected. Is that all right?

So I'm not going to order by Friday. I'm going to wait till the end of day today. I do request plaintiffs, please remind me need to make sure we cannot leave here until we have that set.

MR. TOSTRUD: Okay.

THE SPECIAL MASTER: I want to be clear. I fully intend to go home to Seattle today, so we're all on the same page.

So that's good news. So the good news is that hopefully we'll have a rolling production going forward of the five custodians that's pointed out. There is the initial conversation of 10 or 12 ESI terms, and hopefully that will be flowing, and there will be privilege logs created, and you can have a new sort of interactive dialogue with the Court around that.

Okay. Any questions around that?

I do want to stress, and we do need to, now that we've come up with that, I want to have a conversation about the errors. It sort of is troubling. I did look at the error log in some detail. Dean?

MR. SCHAIBLEY: Dean.

THE SPECIAL MASTER: What's your last name?

MR. SCHAIBLEY: Schaibley.

MR. GODINO: Excuse me. Bruce's call was dropped.

THE SPECIAL MASTER: I want to talk now about the scan repair log issue. I realize on occasion that nothing is perfect and that you do occasionally have errors.

It is not often you end up with having to cut 1.95, 1.96 of gigs of the actual e-mail container itself. So that leads me to the question of the evidence that was collected and where it sits and the hash values.

So I'm going to table this. I'm going to ask plaintiffs, because I know you won't let me forget: Please remind that we have to revisit this and resolve this today.

But before we can actually resolve it, we need to have a broader conversation about the chain of custody and what was down and how it was collected.

I do want to commend counsel for UMC for undertaking a mammoth task of getting me the custodian interviews and getting them moving and forward, and I fully recognize that it is a function just as much of your clients as it is you being a lawyer, and so a give-and-take in that process.

With regards to the chain of custody, I would like to enter that into evidence. Is there any objection?

*14 MS. WITTY: No.

THE SPECIAL MASTER: So I'm marking it Exhibit 3.

THE SPECIAL MASTER: So I want to understand, Dean—okay. So first things first. I'm going to need them redone. I know that sounds like a shocker and I am being difficult.

But when I gave you my initial order—right? And I apologize. Maybe part of it sits on my shoulders—what I was hoping you would do, for each custodian that was collected, you would specify—because the problem that I run into is—and it's reflected by the—understanding just for back purposes, if anybody has a bad back, feel free to stand.

The issue I have is that, for example, with Jackie or Mrs ...

MR. TOSTRUD: Panzeri.

THE SPECIAL MASTER: Yes, Panzeri, the problem we have without having the chain of custody and the collection broken down for each one, we don't actually know what was actually collected and where it was collected from.

So what I need you to do, while I have managed to do it, I'm going to bestow upon you the opportunity and honor to say we collected—I now know you have all of the data, because I have had the opportunity to read it.

You need to say, “I ran a script and we collected from these servers” and say, “This server maps to this.” You have given me the files. I have all of the data myself, but as exciting as that may be for me to do, I'm going to leave it in your trusted hands.

I need you to redo the chain of custody form, specify “I collected from these custodians from this server, this computer, this device,” etc.

The reason why this is so important is that I'd like to start carving out the people we didn't have issue with. I'd like to start making progress so that we can say we have five, now we only have one person that's perhaps an issue, rather than we have right now all I have is for all five and so that makes the process a little more challenging.

So if you would be so kind—is it clear what I'm expecting? That I'm expecting the custodian's name, then I'll give you an example. For HRD Spring, there was a source PDP 001 you collected from that, and then the script you ran has this very nice little text file in it that says how it played out. I'd like that to be attached.

I don't need the filenames, I don't need the data, but I do need the results. I need to say this server and this is what we got. I don't need the filenames. I understand there could be issues there. But we need to know what was actually collected respectively, because it took a great deal of time.

So that's with regards to chain of custody. Is there any confusion there with regards to, not the mobile devices, this is specifically and relating only to the data UMC holds on site.

And also, did you collect from the BlackBerry servers?

MR. SCHAIBLEY: No.

THE SPECIAL MASTER: Off the record.

THE SPECIAL MASTER: I'd like to know who within the UMC's legal group, be it outside counsel, inside counsel or whoever, was directing you and didn't bother to inform you that, hey, look, we need to include their mobile devices and the BlackBerry servers they use. I'd like to note who that person is, and I'd like to also understand has it been collected to date from the server.

*15 MS. WITTY: No.

THE SPECIAL MASTER: That needs to happen now. So when we leave here, UMC needs to go to their BlackBerry server or their archive of the BlackBerry server, and I read the whole backup policy. So I'm not sure where it might fall within the classifications of the—off the record.

THE SPECIAL MASTER: Going on the record. I want to mark for the record the importance, and I'm ordering UMC counsel and, hopefully, with Dean, who is actually in network security and not the BlackBerry administrator, but hopefully he knows the right individual within UMC or goes to lunch with or somehow can connect counsel with that person.

I'm ordering UMC to immediately preserve, for whatever custodians they have represented to the Court are within the ambit of the initial collection, to be completed by no later than this coming Wednesday. There is no excuse in my book for it not being done. A BlackBerry server you post on site, having administered one myself, having actually had to deal with the—having to deal with the politics as well as the policies that go with it, it's not that hard. It's literally like counsel gives them a list of names and they literally log into the BlackBerry server and they check off the boxes and export them.

I mean, it's not a—I'm not asking for a lot of work to be done. We're talking about two, three hours. I'd like you to fill out separate chain of custody paperwork for that effort using the forms I provided and document them.

I'd also like counsel for UMC to work with whoever within the UMC organization is responsible for overseeing the backup, and it appears there are multiple groups that are involved in the backup, which is complete, would be useful to—can we submit this and—would counsel have any objection to—

MS. WITTY: The policies? No.

THE SPECIAL MASTER:—having the policies put on the record?

So I'm going to put to the record UMC's data backup and restoration policy.

MR. TOSTRUD: Yes, Exhibit 4.

THE SPECIAL MASTER: Exhibit 4.

THE SPECIAL MASTER: And I also want the record to reflect that I recognize that UMC's counsel, having seen the custodian collection interview form and having recommended what it should say, I fully recognize that UMC itself needs to figure out how to communicate with that individual if they are running a BlackBerry server, which was represented by—who is the guy that was here last time?

MS. WITTY: Mr. Ernie McKinley.

THE SPECIAL MASTER: Ernie McKinley represented that they administer—is there a phone?

MR. GODINO: Sounds like a printer.

THE SPECIAL MASTER:—represented that such a server does indeed exist. The custodian interviews seem to suggest that such thing exist. So I would like to see that collection immediately done and that preservation to immediately be done.

MS. WITTY: Can I clarify for the record: When you say “preservation,” we have taken initiative to maintain all text messages and other information—(inaudible.)

*16 THE REPORTER: I didn't hear the end of that.

MS. WITTY: We have taken the initiative to maintain all of their text messages and data on the BlackBerry server. I just want to make sure technically what to tell them.

THE SPECIAL MASTER: So technically I'm going to communicate here with my colleague here, Dean.

Dean, you know what a BlackBerry server is, right, at a high level?

MR. SCHAIBLEY: Yes, sir.

THE SPECIAL MASTER: If you look at the scripts that were run, Dean was not given instructions to run a script or work with the BlackBerry server people to collect—

THE SPECIAL MASTER: My phone's off.

Still on the record, a BlackBerry server, right, is its own repository for e-mailing everything. So the way it works is you have an exchange server and a BlackBerry server, and it depends how they are configured.

But based on my understanding of what was run on the collection script, that it seems to me that the BlackBerry server preserves a copy locally on the BlackBerry server as well.

I could be wrong.

MS. WITTY: I'll clarify it.

THE SPECIAL MASTER: I don't need it clarified, because I know that whatever is there—the text messages you are preserving of what he has imaged may be very different than what they have sitting on the server. The BlackBerry server has its own set of policies. So just because—it happens a lot in banking, right? A banker will go out one night—go off the record.

THE SPECIAL MASTER: Go back on the record.

MR. TOSTRUD: On January 31, 2014, defendant, pursuant to an order from Judge Leen, produced text messages for, I believe, three people, three custodians, and represented to plaintiffs' counsel that those were all the messages that were available and that that was everything.

THE SPECIAL MASTER: I'll let the record reflect that, and as far as counsel knows, the problem that I've been able to discern is that UMC's counsel, internal in-house people, don't under—there is a disconnect, because what was asked for makes a lot of sense.

You have a BlackBerry server. I see the script running. There must be a fundamental disconnect there between what was done and what was delivered, and I'll certainly let the record reflect that.

But irrespective of the record, I want it by Wednesday. Whoever is the BlackBerry administrator, take three hours out of their day and preserve whatever they do have for those 26 people from the 25 BlackBerry server side.

I get the fact that we've done the individual devices, and we'll have a whole separate conversation about the individual mobile devices. Okay?

And I want a separate chain of custody form filled out for that effort. I don't need it for each individual custodian, but I do need to list the custodians that were collected, I need to know their directory password. I don't need to know the filenames, but I need to know you got the right people with the right custodians in the chain of custody paperwork so that way I don't have to read 1400 pages downstream.

*17 Are we crystal—clear here? Like Dean, you know what I'm asking, right?

MR. SCHAIBLEY: Yes.

THE SPECIAL MASTER: Counsel.

MS. WITTY: Yes.

THE SPECIAL MASTER: He understands. He should be able to work with the right people within UMC's organization to get me what I'm asking.

Now, returning back to the original point of discussion, I want to understand the chain of custody, Joe. Walk me through this. I want to make sure I get this. There were multiple—are you—(inaudible).

THE SPECIAL MASTER: I asked Counsel Foley if she was just a partner on the case, and she said yes (to reporter).

The only reason I'm directing that to you because there have been multiple associates that have been involved in the chain of custody. I want to just trace back—we're going to redo the chain of custodies, full stop, and provide the detailed information that's necessary.

But I want to understand just a couple of pieces of the information that were provided by Joe and how Joe got that information.

So, Dean, just so I get it, before we get to the mobile phones, how did this work? Did you get an order or a note or an e-mail, or how did you find out I'm supposed to go and get X, Y and Z people, just generally speaking?

MR. SCHAIBLEY: I received an e-mail stating that we needed to go and collect the e-mail and local and home folders for a list of 26 individuals.

THE SPECIAL MASTER: And you got that e-mail from ...

MR. SCHAIBLEY: I received the e-mail back in April 2013 from the initial counsel litigation group.

THE SPECIAL MASTER: Got it.

Counsel Foley, you guys were not involved at that time; correct?

MS. FOLEY: Correct. We came on in May, I believe.

THE SPECIAL MASTER: Okay. Because it gets really down to like it's sort of a weird coalescing of dates and things that all happened. Doesn't make anything all right. I'm just saying that it took me a while to understand who came when and where and did what.

So that, you got initially from a former counsel?

MR. SCHAIBLEY: Correct.

THE SPECIAL MASTER: You then went and ran this Robocopy script.

MR. SCHAIBLEY: Correct.

THE SPECIAL MASTER: Which, generally speaking, when was—just for my own edification—I hesitate to submit it to the record because it has all of the filenames in it and all of the details for everything. So I'm not going to put it on the record. I'm just going to ask questions about it, and I apologize. We'll talk about privilege. We can go on or off in just a couple of minutes. I just want to get my question answered first. On occasion, when I look at, for example, HRD Spring—let's pick a better one—off the record.

THE SPECIAL MASTER: Back on the record.

A couple of questions about the BlackBerry server:

I would like counsel to provide me—do you have any data policies around how that works? Like how long you keep it and other sorts of ...

*18 MR. SCHAIBLEY: I don't know off the top of my head what that—

THE SPECIAL MASTER: If you have to say I don't know, just say I don't know. Totally okay.

I would like you to connect counsel from UMC with that person.

Counsel, I would like you to provide me with that information, how long do they keep the backups, how do they run, how far back does that information go for the BlackBerry server.

MR. O'MARA: That's on April 9th as well?

THE SPECIAL MASTER: Make it the 10th.

Let's talk about Mr. Espinoza.

So when I look through the collection for J, there are no PST or OST files in it. How did PST and OST files end up being collected? I'll tell you what I did so you understand. I received the text files, I converted them to Adobe PDF. I then wrote a script to then go through and pull out every OST and PST file for each one.

When I ran it for Mr. Espinoza, unless it didn't work, I wasn't actually able to find any OST or PST files in there, which leads me back to my question of Joe Edmondson, who has two and two logged in his thing. Just trying to figure out how that ended up there.

I can show you. I have it here if you want to see how I ran it, Counsel, I mean, to explain to you exactly. I'm pretty sure there aren't any, I mean, unless you found some.

MR. SCHAIBLEY: No, there were no PSTs on his computer pull. When—

THE SPECIAL MASTER: Or OSTs, either one.

MR. SCHAIBLEY: When I do the collection, when it was requested for local folders, home folders and e-mail, the Robocopy script only goes and pulls their home folder and then it pulls the local profiles from whatever computers they've logged into.

As far as the e-mail box, what we do with that is we will go into Microsoft Exchange and, as an investigator, give ourselves back-end access to their mailbox and then open Outlook as that user on our desktop. We'll pull back all the deleted items, basically restore the entire mailbox, and then export it into a PST file. So that's their active current mailbox.

THE SPECIAL MASTER: I think I get it.

So we had two PSTs and two OSTs for Mr. Espinoza?

MR. SCHAIBLEY: Uh-huh.

THE SPECIAL MASTER: They were—this is why chain of custody is so important and invaluable, so I will know I collected from this person's server rather than in this session.

So that's those four PSTs and OST files?

MR. SCHAIBLEY: Correct. The first data pull that was done in April would have had his first mailbox, and then when it was requested to rerun it in August, that would be the second PST.

THE SPECIAL MASTER: And that's in addition to all of the other PSTs or OSTs that may or may not have existed, as in some people's cases, within their ...

MR. SCHAIBLEY: Their archives that they—

THE SPECIAL MASTER—myself—

MR. SCHAIBLEY:—themselves.

THE SPECIAL MASTER:—everywhere.

And do you use Commvault for any archiving or just—

MR. SCHAIBLEY: Yes.

THE SPECIAL MASTER: You use CommVault archiving?

*19 MR. SCHAIBLEY: Yes.

THE SPECIAL MASTER: For e-mail?

MR. SCHAIBLEY: Not at this time—not at that time.

THE SPECIAL MASTER: But today it is?

MR. SCHAIBLEY: It's being prepared to be installed, yes.

THE SPECIAL MASTER: So it's not rolled out yet?

MR. SCHAIBLEY: Correct.

THE SPECIAL MASTER: All right. Ironically, he had no failures on Mr. Espinoza.

However, we can turn to HRJ Mumford, and he—what I am referring to, just for the record purposes again because of this issue, they ran a script, and that's how the whole entire collection was done for each custodian. In the process of running the script, I have several questions about that, but there were failures.

And one thing they needed to make sure, when you collect everything, is that you—that, A, when there is a failure, that counsel is—how did that work? Because if you look at PITRDP20 on, I believe, page—had two failures; and then if you look at WHRDTT12, there's 10 failures; and if you look at W11090, two failures; PB0R0—or it might be OM—12 had two failures; UMC–FS01 had six failures.

In your process, did you notify—when you provided this data and results to counsel, explain to me how it worked. So you run the script. If there is a failure, what happens?

MR. SCHAIBLEY: When we run the script, we don't go back and look at the log unless it's requested. We need to make sure we get that recovered.

THE SPECIAL MASTER: You are not the lawyer. You are just running the tech. I get it.

MR. SCHAIBLEY: Right.

THE SPECIAL MASTER: You ran it.

Is counsel aware of any of these failures in this collection?

MS. WITTY: We were not, until log files were provided from Mr. Edmondson.

THE SPECIAL MASTER: I'm going to order UMC to quickly figure out, A, if any of the files did fail in the collection, because you—that you have, and that they are—because some of the files that failed were like .dat files and .htm files that not be as relevant as the .pst file.

But before we get to determining relevancy, I would like to know—I'd like counsel to understand all of the things that weren't collected in the process of running that script.

I fully get that—but just so I understand, you ran the script, then you output the result—who did you give that to you? You got an e-mail, ran the script?

MR. SCHAIBLEY: Correct. Once all the data was collected, it was stored on a secure server that only the IT security team has access to.

THE SPECIAL MASTER: And that was, the whole pathway created a unique path?

MR. SCHAIBLEY: Correct.

THE SPECIAL MASTER: And you still have that today?

MR. SCHAIBLEY: Correct. And then from there the forensic investigator did forensic image.

THE SPECIAL MASTER: He didn't create any hash values—so when the collection was done, just so I get this, they didn't actually go and collect for each custodian, creat an evidence container? They just took everything?

MR. SCHAIBLEY: Correct. And that's just UMC's process for running investigations, depending on when—

*20 THE SPECIAL MASTER: No, I get why you did it.

THE SPECIAL MASTER: Repeat that.

MR. SCHAIBLEY: Just UMC's process for investigations when it's requested of investigating an individual, is grab everything.

THE SPECIAL MASTER: I'm going to quickly go off the record.

THE SPECIAL MASTER: Back on the record. So I understand, you ran it, you copied the files, preserving the metadata according to the filters you set, the parameters of Robocopy. You copied that data to a separate server in your organization that only IT people had access to?

MR. SCHAIBLEY: Only IT security.

THE SPECIAL MASTER: At no time did counsel, your prior counsel in April, never asked you were there any, ever, errors?

MR. SCHAIBLEY: No.

THE SPECIAL MASTER: And at that time you hired—a forensic person was brought in at the direction of prior counsel?

MR. SCHAIBLEY: Correct.

THE SPECIAL MASTER: That person created a set of forensic images?

MR. SCHAIBLEY: Correct.

THE SPECIAL MASTER: Which was the collection, as far as everybody understood it, which is then what was turned over to you?

MR. SCHAIBLEY: Yes.

MR. EDMONDSON: It was turned over to—

THE SPECIAL MASTER: Turned over to counsel. And then you made a copy of it, and who has it today, in the evidence log sheet?

MR. EDMONDSON: I have a copy that I work off of. She has the original.

THE SPECIAL MASTER: And it's reflected in the log.

So sequence again—but, Counsel Foley, this is my question for you, and this is what I was originally getting at:

You were brought in in May, so when you guys received what you thought was these container files, as you understood it, it was no errors because nobody told you there were any errors?

MS. FOLEY: Yes, we didn't know exactly what it was.

THE SPECIAL MASTER: All right. Okay. When, Joe, you received it, did you receive the log files with this?

MR. EDMONDSON: I believe the logs are inside the container.

MR. SCHAIBLEY: Correct.

THE SPECIAL MASTER: Did you ever look and see the errors?

MR. EDMONDSON: I didn't review the log files until we were asked to provide them.

THE SPECIAL MASTER: So then—

MR. EDMONDSON: They were processed—

THE SPECIAL MASTER: Right, so you process it. Because that could be another possible contributing source to how we ended up with some issues, some issues with the production as well, because some of the errors look like there were partial copies made, and I couldn't tell—Dean, maybe you can answer this.

If it fails on the copying, does it then just not make a copy?

MR. SCHAIBLEY: It attempts to recopy it three times, and if it fails after the third time, it moves on.

THE SPECIAL MASTER: And if it's a partial copy, it doesn't keep it?

MR. SCHAIBLEY: I believe that's correct.

THE SPECIAL MASTER: Can you just verify that? Because that's how I read it. Can you just double-check to make sure?

*21 MR. SCHAIBLEY: Uh-huh.

THE SPECIAL MASTER: Okay. So then you got it. You got these evidence containers.

MR. SCHAIBLEY: Yes.

THE SPECIAL MASTER: We're going to redo the chain of custody so we know what was collected for each user.

Now, Dean, returning back to my question, I need you to also document on the chain of custody form, for the exact reason I was just discussing with John Espinoza, right, when I look at the scripts, there is no PST, no OST files in there, full stop.

So I'm not—my job is to sort of get to the bottom of this and make sure that everything was properly collected and preserved.

Help me understand. You ran the scripts, then you ran an additional independent process with each one of the 26 custodians, going to their mailboxes?

MR. SCHAIBLEY: Correct.

THE SPECIAL MASTER: Just to be clear, you would go to a mailbox, you would extract—I don't know what version you had. Like, were you ExMerging or ...

MR. SCHAIBLEY: No, it wasn't ExMerge. It was literally opening Outlook as the user. It pulls everything down from the mailbox exchange server into that Outlook session, go in and recover any deleted items in the deleted items folder, recovering deleted items in the inbox, and restore it into the mailbox, and then export as a PST the entire mailbox.

THE SPECIAL MASTER: Okay. Do you verify the mail once it's done? Once you finish that process, do you try to load those mail accounts?

MR. SCHAIBLEY: Yes, we do reload the PST to make sure that it will open.

THE SPECIAL MASTER: So then I'm a little—so then returning back to Mrs. Panzeri, if you were able to open it and he had to run a 1 point cutoff 9 plus percent of the—to repair it, either that needs to be redone or recopied?

MR. SCHAIBLEY: I'm not sure which PST is erring out. For example, I was—

THE SPECIAL MASTER: Why doesn't he provide you the error logs and then you guys work through specifically with Panzeri what the issue is.

MR. SCHAIBLEY: When we reload the PST, we're only reloading the one that we exported, which is the main mailbox.

With regard to like Ms. Panzeri, for example, users will archive their own e-mail into a PST file, and we don't go back and reload every single one of the PST files.

THE SPECIAL MASTER: Can we just double-check to work your way through it and make sure it's not connected in at least the work you did? I need you to add to the chain of custody forms for each of them, “I went to this custodian on these days and this is what I got,” because I need to know what the active mail was that you got on that day versus the script running. And there's still within your script PST and OST files, and I think counsel wants to know the difference as well between what we collected physically on a specific day from these custodians versus what was collected from the server or the scripts, because there is a different value to the—necessarily just for understanding purposes. So I would like you to go back and amend that.

*22 Does plaintiffs have any questions here?

MR. GODINO: No.

THE SPECIAL MASTER: Just so I understand, then, the chain of custody, the MD 5 hash values that were calculated or not calculated, can someone please go back and calculate the hash values so that we make sure the evidence items that we're looking at are all the same?

MS. WITTY: When you say the MD 5, you mean information taken from the secure server?

THE SPECIAL MASTER: Yes.

MS. WITTY: We have that, so we can verify that.

THE SPECIAL MASTER: Did you verify it?

MR. EDMONDSON: Yes, it verifies when it opens.

THE SPECIAL MASTER: I'll just point out, there's a—how long is the hash? It's typed, though, right? It's electronic, and this is a Word document. So copy it and input it in, on the chain of custody.

MS. WITTY: Okay.

THE SPECIAL MASTER: It says—where is it? Under “identify details.” It says “if item requires the storage device includes the MD 5 for the entire image required ^ EXBT.”

Okay. So I'm going to—now that we have sort of done the easy stuff, we'll get into the other stuff. I want to talk about verifying—sorry. Strike that.

Counsel Foley, returning back to where I was discussing with you, I want to understand a couple of things for my own edification.

MS. FOLEY: Sure.

THE SPECIAL MASTER: There was another associate assigned to this case prior to this current one.

MS. FOLEY: Two, yes.

THE SPECIAL MASTER: Were custodian interviews ever done at any point in this litigation prior to now?

MS. FOLEY: Custodian interview being what is the inventory—

THE SPECIAL MASTER: Can you give me—

MS. FOLEY: I know she did it, but I don't understand what the definition is.

THE SPECIAL MASTER: Can you give me a copy of the custodian interview?

MS. WITTY: This includes all six custodians.

THE SPECIAL MASTER: And you saw my order?

MS. FOLEY: Yes, I did.

THE SPECIAL MASTER: In my order I attached a full custodian interview where it says, at the very beginning here, to locate and preserve all electronic and hard copy documents, including e-mail related to whatever action and the devices that are subject to the action. A more substantive interview may come later. Step B, explain attorney-client privilege, keep discussion confidential. Do not discuss case with others except attorneys. C, explain outline of case. D, explain preservation duty. F, explain upcoming preservation and acknowledgment form if that was what you used.

I'm talking about those things.

MS. FOLEY: Right.

THE SPECIAL MASTER: Was that ever done?

MS. FOLEY: I do not know.

THE SPECIAL MASTER: When I read over the transcripts of the Court that were provided to me, there was representations to the Court that there had been conversations with their IT individuals within UMC.

MS. FOLEY: Yes.

THE SPECIAL MASTER: So I was wondering, were there any—is there any documentation of what was—I'm trying to figure out how we ended up with custodians that—we ended up with custodian interviews finally in hand, hearing now, and I want to make sure that it didn't happen beforehand and it got lost in the shuffle of old counsel, new counsel, associates, and the like. So I'm just asking, were they ever done?

*23 MS. FOLEY: I say—I would have to say I don't think so, but I'm not sure.

THE SPECIAL MASTER: Do me a favor and go back and check, because it's actually fairly important from my perspective. I was appointed by the Court to make sure that everything is being properly preserved, and before I get into that I want to know if there is any other information I should be reviewing that you might have had through prior custodian interviews or conversations you had with IT, because it's important before I reach any—or issue any ruling or recommendation that I fully understand what was actually done—right—before I reach that point. So if you would be so kind.

MS. WITTY: In review of prior counsel's records, there is no indication that specific custodian interviews were done.

The profiles that were initially requested for preservation I believe were based upon the list that came from plaintiff's counsel, and the discussions, I believe, with regards to scope remain mainly with the prior technologist.

THE SPECIAL MASTER: All right. So plaintiffs, because they weren't there when it all sort of started and you were, did you ever have conversations with them about custodians? How did you come up with your list of custodians?

MR. TOSTRUD: We assembled a list of custodians initially through review of some documents, I believe some of their disclosures, and some interviews that we conducted with our plaintiffs.

THE SPECIAL MASTER: What I'm basically getting at is did you ever receive anything from them that might indicate—usually when custodians are selected, each side goes off and interviews who they believe are the relevant parties, and sometimes when we have these custodial interviews, it turns out that, oh, no, this person doesn't really do anything related to what the dispute is about, and they should be talking to this other person.

Were you ever made aware of any of that sort of happening, on the other side, and when you made your interview?

MR. TOSTRUD: No, I'm not aware of any custodian—

THE SPECIAL MASTER: Thank you. That's all—

MR. TOSTRUD:—I just want to add also we took the deposition of Mr. Espinoza and we pulled some names from that deposition.

THE SPECIAL MASTER: Mr. Espinoza we are going to have a whole separate conversation about in a second.

MS. FOLEY: As far as I remember, the custodians were proposed by plaintiffs.

MR. TOSTRUD: That's accurate.

THE SPECIAL MASTER: I'm trying to understand if there was any effort by the defense to make sure that the custodians that were identified were the right people.

MR. TOSTRUD: There was not.

THE SPECIAL MASTER: Okay. So this takes me to one—I'm going to go off the record and then back on the record.

THE SPECIAL MASTER: Let's go back on the record.

Counsel for UMC iterated with me through these custodian interviews—she was actually fairly patient and cooperative. I sent her back about—a lot of questions—I don't know the total number, many pages of questions about the custodian interviews that I wanted additional clarification.

*24 I assume, when she offered to clean up the custodian interviews, she's going to merge everything that we've covered, and that includes specifically the issue around executive assistants and how are they used and in what capacity for the different executives to ensure that there isn't any additional issues there.

I will take—did you have—I just wanted to clarify what we just covered for the record purposes. We're going to add an additional custodian, because in the process of the custodian interview process, we identified Claudette Myers, who is John Espinoza's assistant, as a likely source of responsive and relevant information.

MR. TOSTRUD: May I approach, because we are in possession of a document that was produced by UMC, UMC Bates number 100004, which purports to come from Cindy Dwyer.

THE SPECIAL MASTER: Oh, I have lots of people I have questions—

MR. TOSTRUD: On behalf of Brian Brannman, one of our custodians.

THE SPECIAL MASTER: So what we've done—so what I've done and requested is—so let's run with that. Let me first finish up. We are going to table that for one second.

We are going to return to going through with counsel on the record who has executive assistants and what they were used for, and that I would expect to be immediately amended to the custodian interviews. And anybody in any way, shape or form that was acting in the capacity to send, represent, communicate, dialogue, however that we're talking about, that that will be preserved.

If the collection was not done, I want that identified to me immediately, and I would like it to, obviously, be done immediately. And obviously, the chain of custody paperwork that will be provided will reflect the work that was also done from Ms. Myers. So it will be like Ms. Myers collected her e-mail boxes, whatever was done.

So we will have for every executive assistant, that is, when you receive the custodian interviews it will be crystal-clear.

I'm simply talking about Claudette Myers, because—but I fully expect and we covered, actually, I believe, Doug Spring, was it? We had a conversation—he—his use was—of his executive assistant was limited. Was that—

MS. WITTY: He did not, actually—

THE SPECIAL MASTER: He didn't have one. They had a shared pool. I covered all this. You will see it when you get it and they'll clean it. I want to respect the attorney-client and work product and let them clean it up. They will give it to you.

If I believe it is insufficient in any shape or form, I will raise that and I will flag that for discussion, but I don't think I foresee any issue there. You can talk among yourselves. I just want to make sure you didn't want to—

MS. WITTY: We were just clarifying the need to include Ms. Dwyer's law firm, and the CEO, Brannman.

THE SPECIAL MASTER: I suspect, when you go back, for everybody that—I try to be thorough, but thank you for pointing out—what was the name, again, for the record?

MR. TOSTRUD: So this is an e-mail from Cindy Dwyer—

*25 THE SPECIAL MASTER: Let's just enter it. Let's just put it on the record so we'll have it. That way I know how to spell her name. Enter this as an exhibit, please.

THE SPECIAL MASTER: Let the record reflect that Exhibit 5 is an e-mail that's Bates stamped UMC100004, and it is from Cindy Dwyer sent on behalf of a Brian Brannman, which appears was his executive assistant, I believe.

MS. WITTY: Yes.

THE SPECIAL MASTER: Okay. Moving forward, returning back to what I was just saying, we will get the cleanup custodian interviews. In it we'll include that—I would like you to also—UMC provide said interviews to—I apologize. I forgot your last name.

MR. SCHAIBLEY: Schaibley.

THE SPECIAL MASTER: Schaibley.

I would like counsel for UMC to provide the custodian interviews that are cleaned up to Mr. Schaibley to verify properly that everything was done with the chain-of-custody paperwork that will then be given to Joe and so on and so forth. Okay?

It's a rolling production we're going to cover before we leave here. Obviously we need to add Claudette Myers into that process for your timing considerations.

Now, let's talk about voice mail messages for a minute here. I don't know if it would be within your—Mr. Schaibley, within your purview or you feel comfortable answering questions on that. If not, we can write them down—

MR. SCHAIBLEY: It would be better to write them down. I have nothing to do with the BlackBerry server.

THE SPECIAL MASTER: As with the voice mail, the Nortel—not Nortel. I apologize. With ...

MR. SCHAIBLEY: Avaya, the—at work at UMC?

THE SPECIAL MASTER: Yes.

MR. SCHAIBLEY: Yeah, I don't have anything to do with that system either.

THE SPECIAL MASTER: I got a little confused. Counsel, I apologize in advance, but when I was reading over the discussion around the PBX system—

MS. WITTY: Yes.

THE SPECIAL MASTER:—I was, A, surprised that custodians knew what a PBX was. B—

MS. WITTY: Well, it's used in the title for the personnel that they work with. I don't know that they understood what PBX—

THE SPECIAL MASTER: For the record, in the custodian interviews they were referencing PBX systems. PBX, for the record, is a phone-routing system that's used to manage phone networks, usually for enterprises. Naturally, I was a little surprised when the custodian mentioned PBX and this and that.

And during the course of that I asked, if they—because a PBX system and a unified messaging system are actually two different things, and I wanted to understand if the voice mail messages that people got left, A, could be e-mailed to them, B, were they stored on their server, and how did that actually work.

Can you please talk to someone within the organization that can figure out whether they back up—so according to their backup policy, which is different than what was provided, they need to figure out which one is which.

*26 MS. WITTY: They do have a separate communications recovery policy. I'm not sure that that was provided ahead of time. It was just actually released to counsel last night, and we can provide that as well to you.

THE SPECIAL MASTER: Please do.

MS. WITTY: To you and to plaintiffs.

THE SPECIAL MASTER: Because, obviously, the reason why I'm even mentioning this, it just goes to the collection; right? Like if they actually have a separate server where they have been storing the voice mail messages that are being e-mailed to people that relate to your key custodians, I'd like to have a conversation—I'm fully not ordering or saying that it's necessary, because often voice mail message is a very costly experience for all parties involve.

But I would like to first understand do they have it and how does it actually work, because—yeah, and send me the policy, and then I'll figure it out, because their backup policy seems to suggest that it would be, and another might suggest otherwise. And then we'll go from there on the voice piece.

I want to then talk about when the collection was done, so let's talk about phones. Again, the work-product privilege I fully respect, but some of the information there around it I would like to disclose. Is there any objection to that?

MS. WITTY: No.

THE SPECIAL MASTER: It would appear—I forget—identify the individual. Counsel, you know who I am referring to, where there was just—what's the name of the individual, with the ...

MS. WITTY: The one who mentions text messages and—

THE SPECIAL MASTER: Yes.

MS. WITTY: James Mumford.

THE SPECIAL MASTER: Yes.

So given the total number of messages that were collected against what Mr. Mumford indicated is ongoing, or was at the time, or—I'm a little confused as to the disconnect. Any thoughts?

MS. WITTY: I'm not exactly sure. From the custodian interviews it's difficult to understand how much of them, how many of them actually use their texts for business purposes.

THE SPECIAL MASTER: Someone uses it to talk to their wife a lot.

MS. WITTY: Yes. And I actually—I visually inspected the phones of Mr. Mumford and of Mr. Espinoza, the two custodians still with UMC that have UMC-issued BlackBerries. It's a very limited scope.

THE SPECIAL MASTER: The issue is, the issue with the mobile device is that for, at least Mr. Espinoza, this is the same one he had at the time, and the way I read it, when there was an ...

Mr. Schaibley, maybe you can clarify. You mentioned you weren't—on the BlackBerry, an expert in.

So as I understand it, when a BlackBerry is pushed with a new image, it wipes the old one.

MS. WITTY: Yes.

THE SPECIAL MASTER: The way they have it up. So, theoretically, everything that was there wiped by Mr. Espinoza. No?

MS. WITTY: Yes.

THE SPECIAL MASTER: So that might explain why—

MS. WITTY: And further, something we've raised with plaintiffs, the upgrade between the Microsoft Exchange server 2003—

*27 THE SPECIAL MASTER: Oh, we're talking about—

MS. WITTY:—to Exchange 10, there would have likely been an additional wipe—

THE SPECIAL MASTER: Of the phone or of the Black—

MS. WITTY: Of the server.

THE SPECIAL MASTER: Of the BlackBerry server?

MS. WITTY: Yes, as part of the—

THE SPECIAL MASTER: You need to get that BlackBerry server person front and center on the phone or here or available, because I have run BlackBerry servers on occasion, and I don't understand how—unless he was under no knowledge that this was relevant to be preserved, which is possible, I'm a little confused as to—when you get the updated custodian interviews, I expect it to fully detail out that for Mr. John Espinoza, you know, it was updated twice on the following date.

MS. WITTY: Yes.

THE SPECIAL MASTER: And you'll get in detail those dates.

MR. TOSTRUD: Can I get the dates when they were ... THE SPECIAL MASTER: Well, there's a lot of them.

MR. TOSTRUD: Did he get a new BlackBerry?

MS. WITTY: No.

THE SPECIAL MASTER: This is—off the record for one second.

THE SPECIAL MASTER: Let's go back on the record.

I'm still struggling, based on the information that I've been given, to understand when you upgraded from 2003 to 2010, that impacted the BlackBerries, first question. I don't understand how when you are upgrading your exchange environment and you are not upgrading your BlackBerry server—

MR. SCHAIBLEY: The BlackBerry server was upgraded.

THE SPECIAL MASTER: So you need to talk to the BlackBerry server person, because I don't think that has anything to do with your exchange upgrade. I think it has to do with the BlackBerry Server upgrade much more than the exchange server upgrade.

My question about the upgrade to 2010, that was, did you upgrade your exchange servers?

MR. SCHAIBLEY: We did.

THE SPECIAL MASTER: Did you make a copy of the EDB?

MR. SCHAIBLEY: It's a brand-new environment.

THE SPECIAL MASTER: No, but I mean the old one.

MR. SCHAIBLEY: The old one is still sitting there.

THE SPECIAL MASTER: Yeah, I mean, IT is—I mean, I've run data exchange environments. You don't—wait two years before you turn off that old exchange box.

MR. SCHAIBLEY: Correct. It's still sitting there right now.

THE SPECIAL MASTER: At least.

So we still have the old exchange environment.

So, Counsel, just turning back, for purposes of edification, the BlackBerries shouldn't have been impacted by the Outlook upgrade.

More importantly, even if it were impacted, it doesn't matter because you guys have a full operational set of the old exchange environment, I assume, available.

So I need to figure out the BlackBerry piece, because obviously the scope of the collection included relevant messages or contemporaneous communications that related to whatever the dispute as the Court decided, which I was not involved with, but you guys have already had prior conversations with the Court around mobile devices, extensive conversations. So ...

*28 MS. WITTY: I think the confusion there—and this is something that obviously is between the parties and counsel that was needed for clarification—the request was made for the text messages, and so we went to the phones to image them for the text message purpose.

THE SPECIAL MASTER: Which is a great place to look if they didn't remotely wipe them.

The other place that people store text messages, on the BlackBerry servers.

MS. WITTY: At that time UMC was not retaining text messages on the servers.

THE SPECIAL MASTER: BlackBerry servers by—you need to talk to the BlackBerry server administrator, not the exchange server administrator. They are two totally different people with two totally different policies.

Luckily, according to their policy, they would have a backup. So you can pull it from the backup tape if necessary.

At some point in the last year, what—I think—my belief is—well, if this backup is—the window backup and restore matrices is followed as set forth in what was provided as an exhibit in the additional—as an Exhibit, 4, and the additional information was provided in the custodian interviews, I'd have to believe that they make a backup of the BlackBerry environment daily, weekly, monthly, and then hold one tape a month for at least a year and then they hold the year for ten years usually, is how it works, standard. I'd like to—so in worst-case scenario they'll have to load it up and pull it off.

But what I think, counsel for UMC, you just need to make sure that you are talking to the right person within the UMC technology department to make sure—you need two people, actually. The BlackBerry people and the backup group.

And the backup group—do they run CommVault as well? So CommVault is an enterprise backup solution. I've used it myself. Excellent. My personal preference, better than Symantec. Personal preference, though. CommVault Enterprise level backup has that capability to include the BlackBerry servers.

Let's go off the record.

THE SPECIAL MASTER: Let's go back on the record. Two questions about Brian Brannman. When you ran his collection, did you run a script with it? You ran the script and then you personally made copies?

MR. SCHAIBLEY: Everybody was run the same, yes.

THE SPECIAL MASTER: So then who is the J. Mumford? I've got to just correlate the name. That would be Mr. Mumford. Mr. Mumford had 25 different mail containers.

MR. SCHAIBLEY: It would be more appropriate to say he had 25 different computer profiles.

THE SPECIAL MASTER: Well, that was my question. So that's why I need you to go back to the custodian and explain to me—I need to understand specifically, because 25 different—one thing that was mentioned by UMC, and, I think, counsel for UMC you should think about, is it might be that you have a whole lot of duplicative data.

MR. SCHAIBLEY: Yes, I would say that's very accurate.

THE SPECIAL MASTER: But I don't know that for a fact, because I don't actually know the—I have no—I only saw the filenames. But I have yet—it's not that often you will have—how many did I say now?

*29 THE REPORTER: 25?

THE SPECIAL MASTER: Yeah, that someone will have 25 different mail containers, which leads me to my next point.

Which is, you need to figure out how much data is actually duplicative in the data collection you have, because it's either that or he loved e-mail. I mean, they are big files. These aren't small mailboxes either.

So my other question is, when you run the script, Yahoo mail and Gmail, I know there was a conversation in the custodian interviews where it was discussed, but do you have the actual text files, the script?

MR. SCHAIBLEY: Yes, I do.

THE SPECIAL MASTER: Okay. Can you look at J. Espinoza on page 26. Or, actually, wait. Look at B. Brannman on 77 or page 12—or yeah, page 77. And show that to counsel as well, and then I'm going to ask my question, but I think you might want to look at it really quickly. I can actually just show it to you.

MR. SCHAIBLEY: That would be quicker.

THE SPECIAL MASTER: I'm just showing it to him and then I'll present it to the parties, so they know it—what I did is I ran—let's go off the record.

THE SPECIAL MASTER: Back on the record.

So I'm going to ask counsel for UMC to go through the scripts that were provided and identify personal e-mail addresses that might have been associated with each of the five custodians and verify with them that they did indeed not use this for purposes relating to this (inaudible) litigation.

THE REPORTER: “Relating to”...

THE SPECIAL MASTER: This litigation.

And the reason I'm requesting you do this is because there was explicit questions in the custodian interview—do you have a question?

MR. O'MARA: Can we get all of the custodian records, not just the five as you have expanded them? We've expanded it to six.

THE SPECIAL MASTER: Oh, six, but I haven't even seen—yes, so for the six—for Claudette, thank you very much. For the six, to look at them and just verify, because based on the custodian interview responses you got against the script that was run, it doesn't fully—they might have forgotten because it was done so long ago.

I don't know how the scripts run. I don't know—because I didn't actually get a chain of custody, I don't actually know—it could be that they just sit at a terminal, they log into a terminal wherever, and they are just using it to use their personal e-mail account just on that box or something. I just have no context.

So I need to get context and I need you to verify with them, because some of them said they didn't have any or they didn't use—

MS. WITTY: Right.

THE SPECIAL MASTER:—personal e-mail, and it's clearly every single one of them had some sort of indicia of personal e-mail.

I don't need to know the personal e-mail. I'm saying they could have forgotten for whatever purposes. But it's important to make sure that the collection, if indeed they did use it at the time and they forgot, that you check.

*30 MR. SCHAIBLEY: The only two that would have been able to get to any personal e-mail would have been Brian Brannman and John Espinoza.

Based on our policy, we actually do not allow access to Yahoo, Gmail, any Web-based e-mail through our processor.

THE SPECIAL MASTER: Let's go off the record.

THE SPECIAL MASTER: Back on the record and just reiterate the importance:

I acknowledge to you, I understand and appreciate your policy. I would just strongly—rather than focusing on those two individuals, you apply it all to six for purposes of what I have just shown you as the reason to revisit it.

MR. TOSTRUD: Just for clarification's sake, are we talking about the use of personal e-mail for any work setting?

THE SPECIAL MASTER: Yes, that's it. The only purpose I'm having this conversation, in the custodian interview form, it says did you use personal e-mail at work.

Now, what most people say is no. Yes, I used personal e-mail at work, but it was for only personal things. Most people say, no, I've never used e-mail, and I never brought home a computer, and I never—you know. Most people say, yes, I did personal e-mail, but it was for my personal e-mail.

Now, when someone says no, that usually motivates me to—I mean, as a human being, myself, my wife e-mails me, and I can promise you that while I'm at work or wherever I am in world, I will respond, because she is my wife and I will always respond.

So similarly, I would expect that, so I would encourage you to go back through and refresh them just to confirm. I'm not saying anything one way or the other. I'm just saying check because of that issue with—and you'll see the custodian interviews when you get them and you'll understand.

MR. TOSTRUD: Okay.

MR. O'MARA: Is it just specific to work or specifically towards using their personal e-mail for any work-related aspects whether they are at their desk at work or if they are at their home e-mailing from their computer?

THE SPECIAL MASTER: Well, as I understand it, and I'll let Dean speak to this exact—because he's in charge of networking security. But as I understand it, and Dean, correct me if I am wrong, the only way you can actually access e-mail for work is using TS Web something ...

MR. SCHAIBLEY: TS Web or Web build through OWA ^ SPELLING.

THE SPECIAL MASTER: So there is a very limited way, and every custodian says we don't do it, it's too difficult. Literally I think every single one of them in the responses said we don't use that.

Which again I just want you to revisit and remind them, because if you run—just as a heads-up, you can just run it against the script, you just look for Web mail, and you will see—it speaks for itself.

I assume, Counsel, when you spoke with them, you asked them did you use personal e-mail for work related business as well; right?

MS. WITTY: Yes.

THE SPECIAL MASTER: So that's in the custodian interview when you get it, and it's crystal-clear.

*31 Again returning back to the purpose, the whole purpose is just I want to make sure that on a going-forward basis we've got all the right information, and that includes from Counsel Foley looking at the prior custodian interviews—because at some point in the transcript that was provided to me, there was representations that there have been multiple conversations with the IT Department, and I just wanted to check those to make sure I see what they may or may not have said.

Oh, perfect, collection. I have several more questions for you. As to the collection effort, is there any reason why you didn't pull from the exchange environment? Just for my own edification.

MR. SCHAIBLEY: Just the way that our—the way our investigation process has always run when I got there and was trained on doing these investigations is how I was trained to do it, was just to do a back-end, pull the mailbox and create a PST.

THE SPECIAL MASTER: But you are not pulling from the exchange environment? You are not exporting or ex-merging it?

MR. SCHAIBLEY: Correct.

THE SPECIAL MASTER: And you are going to resolve the failure points? Counsel will be paying close attention and look at the failure files which are identified in the script that you ran?

MS. WITTY: Yes.

THE SPECIAL MASTER: Question about the deleted e-mail issue, which ties to how the evidence that was received—question? Was there a question?

MR. GODINO: No.

THE SPECIAL MASTER: So one of the error issues we were having was that there were—that Mr. Edmondson and Mr. Pixley—are you on the phone, Mr. Pixley?

MR. PIXLEY: Yes, I am here.

THE SPECIAL MASTER: Okay. I have a question for you specifically because it relates directly to your declaration that you provided.

One of the issues we had had to do with the fact that there were deleted recovered e-mails. Is that right? Is that correct?

MR. EDMONDSON: Yes, I believe. Well, there were e-mails that had to be recovered within the PST files during mounting.

THE SPECIAL MASTER: So I'm trying to understand—is that accurate, Mr. Pixley? Is that what you said was one of the possibilities in your declaration you provided?

MR. PIXLEY: Yes.

THE SPECIAL MASTER: So I want to understand from a collections standpoint when it was done. If you are collecting active mailboxes, why would there be the need to do what was just said?

MR. EDMONDSON: Some of the PSTs during the mail process did identify additional deleted e-mails as it was opening it and mounting the PST file itself. So there were some that weren't recovered prior to the PST being provided.

MR. SCHAIBLEY: I don't know.

THE SPECIAL MASTER: I'm not saying—I mean—okay.

MR. EDMONDSON: There were PSTs provided that came from the home share, PSTs from the copying.

THE SPECIAL MASTER: If they were—I mean—any idea?

MR. SCHAIBLEY: The only e-mail where we go in and do—recover deleted items, we only do that when we're going into the active mailboxes. Any other PSTs we don't even attempt to look at or recover any deleted from any other cases other than the active mailbox we go to.

*32 THE SPECIAL MASTER: That makes a ton of sense. So what do you think?

MS. FOLEY: I'm not sure what the question is.

MR. EDMONDSON: I'm not sure what the question is either.

THE SPECIAL MASTER: My question is, how is it possible that you are loading the mailbox, mail files, PST, OST files into mail if theoretically there are hard copies; right? If you scan and repair them, that's one thing. It's totally different thing to load it and then have to recover deleted fragmented e-mails from an archive.

MR. EDMONDSON: I don't know why. I know that they did recover some.

THE SPECIAL MASTER: I get that. Is that normal? Does happen a lot to you?

Mr. Pixley, can you hear this?

MR. PIXLEY: Yes.

THE SPECIAL MASTER: I want to hear your thoughts on it.

MR. EDMONDSON: I wouldn't say it's un-normal. There is usually some deleted e-mail on any PST. That's why I always recover it.

THE SPECIAL MASTER: I get the recover part, but I'm talking about the fragment. If you can't recover it, fine, but I mean, his script ran and he only copied an archived OST, PST. He wasn't recovering deleted files. He only searches active files.

What I'm saying is that—correct me if I'm wrong, but your script only collects valid active files.

MR. SCHAIBLEY: Correct. The Robocopy script, it copies what's there.

The only thing I could say to that is if a PST this was in, for example, a home folder, that is a PST that the individual user created on their own. If, for example, they were actively in their mailbox and had that PST loaded—

THE SPECIAL MASTER: I get it, the machine shut off or whatever.

MR. SCHAIBLEY:—that would be a possibility.

THE SPECIAL MASTER: Okay. This is why the chain of custody is so important, because when I saw the home, whatever, etc., I interpreted it as something else. I interpreted it as being not their own personal backup, but their OST and PST files.

Mr. Pixley, do you have any idea or wish to speculate?

MR. PIXLEY: On the recovery of deleted e-mail messages?

THE SPECIAL MASTER: From an active valid file.

MR. PIXLEY: My only thought, if we're talking about PST files, is, if these people had created archived PST files and then deleted messages from within those PST files, then I could see the recovery part.

THE SPECIAL MASTER: Yes, but as fragments or as a whole message in the active file?

MR. PIXLEY: You could certainly pick up entire messages, but I've also seen during that recovery process where, as long as it can still find a pointer, it will recover it, but what it's actually pointing to is largely just a fragment that still happens to be left.

THE SPECIAL MASTER: Right. I get that part. I guess the part—if the user created them—never mind. The user created them. Ignore me. I get it. Never mind.

I'm just trying to figure out to make sure we don't have any production issues when we have this rolling production and if it's the user created it, we should be fine. If it's not user-created and it's from the actual mailboxes itself, it could be—that's where I get a little unclear.

*33 So we'll see how it goes. So we'll table that for now and go forward, unless—Mr. Pixley, do you have anything—were you here for the beginning part, Mr. Pixley, where we established that EnCase 7 fixes the problems with Paraban?

MR. PIXLEY: Yes.

THE SPECIAL MASTER: Do you have anything you would like to comment, Mr. Pixley, on that?

MR. PIXLEY: No.

THE SPECIAL MASTER: One other question: Kronos and SAP, and then we can move forward from the collection people.

Your script ran and collected SAP client files?

MR. SCHAIBLEY: Whatever was on a local machine.

THE SPECIAL MASTER: Every single one of them, I believe, had an SAP directory folder. I just want to understand: Is SAP data—you are not pulling from the server. You are just pulling the client files?

MR. SCHAIBLEY: Correct.

THE SPECIAL MASTER: So the data still sits on the server side? Within your org–––I don't understand how it's actually connecting to the SAP.

MS. WITTY: That's the problem. It's not actually something that is—

MR. SCHAIBLEY: It's not on our SAP system.

MS. WITTY: It's connected to the larger accounting—

THE SPECIAL MASTER: That would be why it's on everybody's computer.

When we went through it all, there was a question about SAP and Kronos, and on every—when you ran the script, every computer, actually, it appeared had an SAP client on it, but no data, and I was a little confused. I want to make sure that the collection was done properly and that if—you don't—UMC doesn't actually control the SAP server; right?

MR. EDMONDSON: Correct.

THE SPECIAL MASTER: My concern was they controlled the SAP server itself and that they hadn't actually preserved—oh, I don't even know what it's used for, but if it may have responsive information, that that information been properly preserved, but it's not within your custody or control, which would make sense, because everybody had the exact same file structure.

Plaintiff have any questions there?

MR. TOSTRUD: I'd just like to understand that a little bit better.

THE SPECIAL MASTER: So on every—when he runs the script, right, the script basically goes through and makes a copy of every profile for every device—

MR. SCHAIBLEY: The Robocopy script is a Microsoft product, and it goes through and will copy whatever source folder you tell it to.

In this instance we identified every computer within our environment that each custodian had a local profile on and we copied their local profile. Everything in the profile—

THE SPECIAL MASTER: Which included an SAP client, and it wasn't clear to me why when we asked the question, nobody was like I use SAP. And so I wanted to double-check today during the hearing to understand why did everybody have this but nobody actually was using it.

MR. TOSTRUD: Thank you.

MS. WITTY: We can clarify further with plaintiff's counsel with regards to what the content and why the client for SAP was used. It's essentially the county interface for tracking personnel information, which has all been provided with the opt-in packets.

*34 THE SPECIAL MASTER: Do you require further information around the SAP?

MR. TOSTRUD: Not at this time. Thanks.

THE SPECIAL MASTER: Just one of those things I saw on everybody's profile and I was like, nobody uses it, huh.

Now, let's talk about—are you the exchange administrator.

MR. SCHAIBLEY: Yes.

THE SPECIAL MASTER: You are going to wear a lot of hats.

Your policy, what is the current policy, standing policy around your exchange environment?

MR. SCHAIBLEY: What do you mean?

THE SPECIAL MASTER: When you—how long do you keep—so starting from—I'll run through three or four scenarios.

I'm a user and plaintiff if you want to add a scenario, feel free.

I'm a user, and I delete an e-mail, but usually in an exchange environment that e-mail will exist on the exchange server for X. Period of time.

MR. SCHAIBLEY: 14 days.

THE SPECIAL MASTER: And then is it purged out?

MR. SCHAIBLEY: Yes.

THE SPECIAL MASTER: But it's captured by your backup tapes?

MR. SCHAIBLEY: Yes.

THE SPECIAL MASTER: So you have an annual backup of your exchange environment?

MR. SCHAIBLEY: The backup is done by a separate individual.

THE SPECIAL MASTER: Can you confer with that individual to see if they actually have a snapshot or how far back they have a backup tape?

MR. SCHAIBLEY: I can find that out.

THE SPECIAL MASTER: For the exchange environment?

MR. SCHAIBLEY: Yes.

THE SPECIAL MASTER: Because the policy that was admitted into evidence doesn't—it states that—exchange is a window-based server?

MR. SCHAIBLEY: Yes.

THE SPECIAL MASTER: So you have full weekly backups, full monthly backups, and incremental daily backups, and it doesn't—and it says for three cycles for you keep them, but it doesn't say if you recycle them or if you pull them out or—and then it says [RPTR NOTE: looking at an exhibit] I just want to understand because the gentleman that was here last time, what was his name at the time.

MS. WITTY: Ernie McKinley.

THE SPECIAL MASTER: He was kind enough to tell us they kept it for several months. I would really like to talk to the back-up person and ask do you have a backup snapshot.

For disaster recovery, don't you have a snapshot at some point going back?

MR. SCHAIBLEY: I don't know what it is they have. We have to speak to that individual.

THE SPECIAL MASTER: Okay. All right. Because obviously if there are additional executive assistants that we couldn't—that we're not properly collected from, we'll need to collect from them, and we have to figure out where that may be.

So I said a couple of scenarios. That was my first scenario. Second scenario I have with you is I'm running my exchange environment. I make a backup much my own mailbox. Do I have the ability to write it to my C drive directly.

MR. SCHAIBLEY: At this time, yes, and that is the reason we collect during our script running all the mobile profiles because it will go to the local profiles. You don't have it to the top-level C drive, but desktop or the default folder under your profile.

*35 THE SPECIAL MASTER: So can you tell me how that works so I understand? What we're talking about now, Counsel, so you understand, is that when this script runs, every—a user gets a profile, and—but if you think about a hard drive, it's actually—a C drive will be an entire hard drive and that's what we will call the big, big, big, all the data. A local profile is usually some segment of that hard drive at that time. Does that make sense?

MR. GODINO: Yes.

THE SPECIAL MASTER: So what I want to understand is, was it possible at that time for users to back—create a local backup copy outside of their profile to the C drive.

MR. SCHAIBLEY: No.

THE SPECIAL MASTER: Do you understand what that question is, Counsel.

MR. TOSTRUD: Uh-huh.

THE SPECIAL MASTER: So, then, can I—is it IMAP, Pop, SMTP has—

MR. SCHAIBLEY: SMTP.

THE SPECIAL MASTER: Is it IMAP or Pop?.

MR. SCHAIBLEY: IMAP.

THE SPECIAL MASTER: So it's possible for someone to use an iPhone to configure them out? I mean, iPad, iPhone, I do it on both, so I mean ...

MR. SCHAIBLEY: It was enabled at one point in time in the past and for a specific user's use. It is against policy.

THE SPECIAL MASTER: Do you know which users?

MR. SCHAIBLEY: There were a total of, I believe—at the time, when the initial collection was run, 86, that were utilizing the personal phone.

THE SPECIAL MASTER: So because when I looked through the script, it kind of looked—I understand it, since you're on I map—did you tell counsel who those six individuals were for the mobile purposes?

MR. SCHAIBLEY: The 86 that were previously using it?

THE SPECIAL MASTER: Yeah, yeah.

MR. SCHAIBLEY: I don't believe we did, no.

THE SPECIAL MASTER: Counsel, you need to have a conversation with them and figure what the overlap is with the 26, for the obvious reason that if they specifically turned it on so that they could use IMAP protocol on their iPhone, that probably that would mean that they were using their iPhone to do work during that time. Maybe not. As the custodian interviews seem to indicate, there is a very strong culture there of enjoying your weekends and time off.

So I would encourage you, though, to make that inquiry.

Does counsel understand what I'm conveying here?

MR. TOSTRUD: I believe so.

THE SPECIAL MASTER: Do you have any questions?

MR. TOSTRUD: Not at this point.

THE SPECIAL MASTER: So then returning back to my scenario, I could have an I pad or an iPhone with my I Mac configured and I can use it to do—but I have to get permission, right? When I used to run an IT department or whatever, it was a frustrating experience to occasionally have certain executives that would take it upon themselves to come in and say I must use my device and whatever.

And I would have to carve out a specific policy to allow them to use it. It wasn't like anybody could just turn it on and make it work. It's the same as UMC?

*36 MR. SCHAIBLEY: At this time at that time; that is correct. But at that time it was all or nothing. And that's the policy I inherited. Anybody can go up to Google and how do I sync my iPhone.

THE SPECIAL MASTER: Then they could sync their UMC iPhone?

MR. SCHAIBLEY: Correct. The way the policy was set up it was all or nothing. Everybody is able to do it if they discover how or no one can do it.

THE SPECIAL MASTER: Off the record for one second.

THE SPECIAL MASTER: Back on the record. I'm going to ask UMC's counsel to add an additional search term called iPhone and I want any or iPad and the signature lines for the e-mails anywhere it hits I want them to locate those e-mails, I want them to then go talk to the custodians and clarify why that directly contradicts what they told us in their custodian interviews if that happened.

Off the record.

THE SPECIAL MASTER: Back on the record. Okay. Returning back to the scenario we were just in, I'm Mr. Brannman's executive assistant. I configure my iPhone or iPad to send messages at the time, not today, but at the time, since it was an all-or-none policy, and if I could go to Google how to configure my iPhone to send e-mail using an IMAP environment or just how to configure my iPhone to send mail.

They could theoretically make that work.

MR. SCHAIBLEY: The only way to make that work is if you had the actual password for the user.

THE SPECIAL MASTER: Right. We can pick a user, right? Forget the executive assistant. Just say Doug, Mr. Springer—Mr. Spring had—because I believe an I device of some type.

So it would be possible at the time for him to configure his phone, iPhone to do UMC-related work?

MR. SCHAIBLEY: Yes.

THE SPECIAL MASTER: Did you use exchange messaging services?

MR. SCHAIBLEY: No.

THE SPECIAL MASTER: Did you use any other third-party messaging services?

MR. SCHAIBLEY: No.

THE SPECIAL MASTER: Do you allow Dropbox as a third-party storage services?

MR. SCHAIBLEY: No.

THE SPECIAL MASTER: Do you monitor it?

MR. SCHAIBLEY: Yes.

THE SPECIAL MASTER: Let's return back to the BlackBerry server. How is the exchange set to sync to the BlackBerry? How does it work? Is it push or is pull? How does it work?

MR. SCHAIBLEY: I believe that the BlackBerry is pulling.

THE SPECIAL MASTER: So when the initial custodians were collected from, there were nobody actually—can we go off the record for a second.

THE SPECIAL MASTER: Let's go back on the record.

Okay. So here's the scenario. I'm a user. I write an e-mail on my BlackBerry and my iPhone but the might be different because I don't know—let's start with the iPhone. I'm write an e-mail message on my iPhone. I send that message to my colleague within the UMC organization discussing something relating to this litigation.

I then go to my computer at work and sit down at my computer at work. That e-mail doesn't show up in the sent folder?

*37 MR. SCHAIBLEY: No.

THE SPECIAL MASTER: The only place that e-mail actually sits is where?

MR. SCHAIBLEY: It was sit on the recipient and it would sit on the device itself.

THE SPECIAL MASTER: So it's on the mobile device and on the recipient's device?

MR. SCHAIBLEY: No, the recipient's mailbox. THE SPECIAL MASTER: Thank you. So then—okay. So if the recipient deleted that e-mail message from their mailbox, the only place that e-mail exists would be on the phone?

MR. SCHAIBLEY: It would still exist on the server as well until it's purged.

THE SPECIAL MASTER: Which is 14 days later?

MR. SCHAIBLEY: Correct.

THE SPECIAL MASTER: So now today it wouldn't exist anywhere but that device?

MR. SCHAIBLEY: Correct.

THE SPECIAL MASTER: Did anybody from the UMC internal legal team or HR talk with you about all of this, about how this works?

MR. SCHAIBLEY: No.

THE SPECIAL MASTER: Can we go off the record.

THE SPECIAL MASTER: Let's go back on the record.

So, then, Counsel, this takes me to my current concern, which is the possibility that the only place that e-mails that were sent by key custodians, if you run the iPhone iPad search and you hit on one of those custodians, you are going to have to image their devices immediately because the only place that e-mail would sit today now if it doesn't show up anywhere else is on that device. Does that make sense?

MS. WITTY: Yes.

MR. GODINO: That is assuming it wasn't deleted on that device.

THE SPECIAL MASTER: If it was deleted from the device and deleted from the mail account—but the trick is, when he ran his script, he made a copy of their sent box and their mailbox at the time. So what I'm saying is that if—they might have deleted—so if you think of it like this.

We have a copy today of everything that was actually in that person's mail environment on that day, right, in their sent folder, trash and etc.

The only time this becomes an issue is isn't the situation you are saying, but if it's if we search and we find out A they were using the iPhone or iPad mobile device and that then you would have to go and look at that device, because the only place today that possible that information would exist would be, we don't know what they have on their device, but you have to assume that whatever they captured they captured accordingly, but if they deleted it from theirs, rights, and they deleted it from here, yes, nobody is going to know, but they have a copy of what was in there at that day at that time so the only real issue is if there are other messages on that device that weren't captured in that time span on the iPhone or iPad. Does that make sense? Because they have everything that was there then, so it's a matter of whether it was before or after.

But to keep it efficient just search for iPhone and iPad and if it shows up in the signature line, there is a reason to look. Every one of the custodians were asked the explicit question do they use these devices for personal, for work related use, and they disavowed it some multiple times.

*38 So I have no reason to think that it's otherwise, I just want to double-check, because it is possible they forgot, it's possible that they—you know, lots of things have happened since that point, so you just run the search and if it comes up clean, which is what we would expect it to do, it shouldn't be an issue. This is just making sure that we got it properly.

Did I get Claudette's custodian interview?

MS. WITTY: Yes.

THE SPECIAL MASTER: I did.

MS. WITTY: I believe it's the last one before the supplements.

THE SPECIAL MASTER: I'll check it over in a few minutes.

I have a question about personal laptops and devices. How does that work, because I'm a little confused as to how that actually operates because some of the custodians indicated—

MS. WITTY: The only custodian that actually has an UMC issued laptop to them is Doug Spring. It was issued to him prior to the SC I U negotiations in 2009 which occurred prior to the relevant time period for this. He hasn't used it since then. The device is still with UMC. It can be searched. It wasn't because the use of that machine fell outside of the relevant time period.

MR. TOSTRUD: This is news to us. When was it issued to him?

MS. WITTY: It was issued to him in late 2008. It was used up until June of 2009. So it was regarding the SEIU negotiations prior to the relevant time period.

MR. TOSTRUD: Plaintiffs would request that that device be searched because defendant has relied extensively in its defense on a collective bargaining agreement. They rely on that defense throughout their interrogatory responses and their RFP responses. They brought a motion to dismiss on the basis of that ^ SPELLING, and we clearly think that's relevant.

THE SPECIAL MASTER: I'm going to reserve and read the briefing a little more before I make any ruling there, but I'm going to assume that you will continue to preserve it.

MS. WITTY: I will make sure—

THE SPECIAL MASTER: In a forensically sound manner. That's a lot of information.

MR. TOSTRUD: We're happy to provide information on—

THE SPECIAL MASTER: You guys are taking—your notes from last time are extremely useful. So if you want to write that down for us to stay on top of.

MR. TOSTRUD: You bet.

THE SPECIAL MASTER: Super helpful. Turning back to personal laptops and the secure policies. They reference—is there any list—do you track who has tablets and laptops connecting into the OST laptop.

MR. SCHAIBLEY: No personal laptops connects to the network or tablets. Only UMC issued and observed devices connected to the network.

THE SPECIAL MASTER: So no MDM.

MR. SCHAIBLEY: Not at this time. We're looking at bringing one in in the future. As far as with our new 2010 exchange environment, personal cellphones are starting to be able to brought in and we control that through multiple policies.

THE SPECIAL MASTER: But at the time of the time period at issue that wasn't available?

*39 MR. SCHAIBLEY: Correct.

THE SPECIAL MASTER: Have we figured out if any of the—when I looked at the mobile devices, only three out of the five custodians actually had them.

MS. WITTY: Yes.

THE SPECIAL MASTER: That were UMC issued.

MS. WITTY: Yes.

THE SPECIAL MASTER: At the time were you able to track if a mobile device was connecting to UMC systems? So if I wanted to bring in my BlackBerry and I didn't want to tell UMC that I have my own BlackBerry 10 to whatever, would it be possible for me to actually access that system?

MR. SCHAIBLEY: No.

THE SPECIAL MASTER: Except for e-mail? Because I could set up e-mail.

MR. SCHAIBLEY: Correct.

THE SPECIAL MASTER: Do you have any enterprise architecture diagrams?

MR. SCHAIBLEY: I do not with regard to the enterprise as a whole. Each team will maintain their own basic, the server team, the network team, etc.

THE SPECIAL MASTER: The desktop team as well?

MR. SCHAIBLEY: I don't know if the desktop team maintains any diagram.

THE SPECIAL MASTER: Because where I get a little confused, when I look at the script that was collected, there is a whole bunch of WordPerfect documents. Again, I can't see the content, so I don't actually know. But when I read the custodian interviews, they're like—(inaudible) WordPerfect.

THE REPORTER: ...“WordPerfect”?

THE SPECIAL MASTER: WordPerfect.

MR. SCHAIBLEY: Our desktops are extremely old. I don't know how often they are swapped out and re-imaged.

THE SPECIAL MASTER: When you run your searching you are looking the Word document types? When you are searching and running search terms.

MR. EDMONDSON: Sent case 6 and 7.

THE SPECIAL MASTER: List of file types.

MR. EDMONDSON: We can double-check—

THE SPECIAL MASTER: Just making sure because I haven't seen a version for a while. Off the record.

THE SPECIAL MASTER: Let's go back on the record. I want to talk about e-mail list servers? Do you manage them?

MR. SCHAIBLEY: E-mail list servers.

THE SPECIAL MASTER: Counsel for UMC, multiple custodians indicate they use mail lists.

MR. SCHAIBLEY: Oh, distribution lists?

THE SPECIAL MASTER: No—yes, I know the difference, but—

MS. WITTY: My technical misunderstanding.

THE SPECIAL MASTER: There was software that you identified that they—they reference mailing lists.

MR. SCHAIBLEY: Those are distribution lists within the exchange environment.

THE SPECIAL MASTER: Did you pull those?

MR. SCHAIBLEY: When the initial request came in for the initial 26.

THE SPECIAL MASTER: Mailing lists, I want to cover. In the custodian interviews they mention mailing list. Do you have any mailing list software to the best of your knowledge?

MR. SCHAIBLEY: I do not. When a user refers to a mailing list, they are referring to a distribution group that we maintain on the exchange server.

THE SPECIAL MASTER: So UMC post—

*40 MR. SCHAIBLEY: UMC post is dynamic distribution group on the exchange server that includes everyone with a mailbox in the environment.

THE SPECIAL MASTER: And it was something people could have been using to communicate?

MR. SCHAIBLEY: The list that we maintain that only a small list of users are able to send to UMC posts.

THE SPECIAL MASTER: Let me tell you—can I reference the custodian interviews? Are you okay, Counsel?

MS. WITTY: Uh-huh.

THE SPECIAL MASTER: Mr. Spring was one of those individuals. So when you did Mr. Spring's collection, did that include the mailing lists.

MR. SCHAIBLEY: It included whatever was in his mailbox. If he sent an e-mail to UMC post, it would have been saved in his sent values.

THE SPECIAL MASTER: But you never took a copy of UMC post.

MR. SCHAIBLEY: There is no way to take a copy of it.

THE SPECIAL MASTER: They are saying there are multiple mailing lists.

MR. SCHAIBLEY: There were two or three other distribution groups that were referenced in the original—

THE SPECIAL MASTER: Patient service leaders, mountain service group, and it was told to me that they have been fully preserved and they are referenced as lists.

MR. SCHAIBLEY: When the request came in, I responded to—

THE SPECIAL MASTER: I'll show it to you.

MS. WITTY: That may be a clarification that I could make because we actually just discussed this yesterday.

It was included on the initial list for preservation, and I was informed by Mr. Schaibley's supervisor that everyone on that list—everything on that list had been preserved. After speaking to Mr. Schaibley he explained because those are distribution list, not a repository.

THE SPECIAL MASTER: Let me understand from my perspective. Based on when the litigation started, this has to do with people's working schedule and whatever and related details therein that we're here to talk about the discovery.

I would assume that there had been—someone's phone is on still.

For my own edification, you get a litigation—I'm just trying to understand because the way they describe these, the custodians describe these mailing lists, which they are not actually mailing lists. They were using them to have communications with large groups of individuals within the organization.

MR. SCHAIBLEY: Yes.

THE SPECIAL MASTER: And they are all dynamic lists, or how does that—

MR. SCHAIBLEY: No. UMC host is the only dynamic lists.

THE SPECIAL MASTER: The others are preserved?

MR. SCHAIBLEY: The others are just individual users added to or removed from them based off of the owner of the group list.

When the initial request came in, I responded to the litigation group that sent the initial e-mail that they were distribution groups and not mail repositories, and was told to only concern myself with collecting the custodians that were on the list.

THE SPECIAL MASTER: Let's add to that those mails, because they reference in their custodian interviews, specifically Doug Spring, that he would use it—

*41 MR. SCHAIBLEY: Any e-mail that he or any other custodian would have sent to one of the distribution groups would have been preserved in that user's, that custodian's mailbox.

THE SPECIAL MASTER: As long as they didn't delete it? I'm not saying he did or didn't. All I'm saying is from appropriate—in a sense of where the evidence sits, the best source of the evidence is the list.

MR. SCHAIBLEY: Correct. And then additionally it would be in any other mailbox of recipient on that distribution group.

THE SPECIAL MASTER: Just one person that doesn't delete the e-mails ever ideally would be the mailing list if that exists.

On a go-forward basis, I need you to take whatever you have for that time period relating to that mailing list communications that weren't in their sent folders, if I get what you are saying and see if there is anything within that time period that still exists.

Because based on Doug Spring's statements—there is a difference between a mailing and a distribution list, which is something I get the difference of.

So my only concern is that—let's go off the record.

THE SPECIAL MASTER: Go back on the record. Please state it again. Sorry I forgot we were off the record.

MR. TOSTRUD: So UMC with respect to the issue of list serves and e-mail, what I will call blasts, which is probably the wrong term, but I'll use my layman's term, produced documents, including e-mails in hard copy form, not in electronic form, to plaintiffs with their initial disclosures and many supplements to their initial disclosures. Included in that grouping were e-mails as Ms. Witty just informed us from something called the patient—

MS. WITTY: Patient service leaders.

MR. TOSTRUD: Patient service leaders lit serve, and that's clearly a very relevant issue, that those e-mails are relevant based on the issue of the department of labor investigation and—

THE SPECIAL MASTER: That's a whole—we have a whole set of other questions around department of labor—

MR. TOSTRUD: The so-called remediation campaign.

THE SPECIAL MASTER: Counsel for UMC.

MS. WITTY: Yes. So the patient service leaders are in a distribution list.

THE SPECIAL MASTER: It was at the time a distribution list?

MS. WITTY: Yes.

THE SPECIAL MASTER: Under 2003 or 2010?

MR. SCHAIBLEY: 2003. It's a distribution group under 2003.

THE SPECIAL MASTER: You understand the obvious issue we have that if any one of the named custodians for whatever reason deleted or purged their sent folder or whatever was sent to that list, that would end it, because the former counsel never bothered to tell you to preserve—

MR. SCHAIBLEY: When I responded to them that it was a distribution group, they responded to only concern with the custodian list because a number of the custodians were in those distribution groups.

THE SPECIAL MASTER: Do you actually know which custodian? Were they in every group?

MR. SCHAIBLEY: I'm pull it up right now.

*42 THE SPECIAL MASTER: So can I get that delineated in a document provided to me, like what list, what users. So here is a mailing list, here are the custodians that they were collected from that were in this, what version of the distribution 2002 you were using, and then—yes?

MR. TOSTRUD: Yes. Just for clarity's sake, the documents and e-mails that I referenced were produced UMC's four settlement to documents and witnesses submitted to Federal Rule of Civil Procedure 26.1, and the date on that production is August 29th, 2013.

THE SPECIAL MASTER: Is there a Bates stamp on it?

MR. TOSTRUD: The Bates stamp numbers for that production are UMC 10000 through UM C100047.

THE SPECIAL MASTER: Got it.

I need to get that information before I figure out—so I understand the importance of the information and I note that for the record, I need to make sure at the very least on a going-forward basis that it's being preserved properly.

So what we need to do is identify a custodian who exists or create a mailbox or—I'm not exactly sure your mail system is set up, but attempt to identify—it's tricky because effectively as I understand it you have to find an individual that never deleted an e-mail from the list. Is that accurate?

MR. SCHAIBLEY: As accurate as it can be, yes.

THE SPECIAL MASTER: I'm trying to think of what the alternative might be, because obviously that's—given the importance of the communications.

MR. TOSTRUD: I'm happy to enter these into the record.

THE SPECIAL MASTER: We took the Bates numbers.

MR. TOSTRUD: There is an e-mail, example, from Claudette Myers now on behalf of Doug Spring, not just on behalf of John Espinoza, and she appears to be gathering many of the responses relating to the department—

THE SPECIAL MASTER: What's the Bates number?

MR. TOSTRUD: UMC 100018.

THE SPECIAL MASTER: So clearly like we need to figure this out. Were their mailboxes created—this makes a nice segue. We need to resolve this issue.

Another area that I have—want to get some clarity around was, did counsel I guess prior counsel ever—so let me—timing again—in April again you ran the scripts, right?

MR. SCHAIBLEY: Correct.

THE SPECIAL MASTER: Did anybody ever visually verify the mailbox structures that you were getting?

MR. SCHAIBLEY: What do you mean?

THE SPECIAL MASTER: Like did counsel sit in front of you and say, oh, we've got the right user's mailbox?

MR. SCHAIBLEY: No.

THE SPECIAL MASTER: And then just to verify, all I'm saying is did counsel seek to verify or validate the collection that was done, former counsel?

MR. SCHAIBLEY: I cannot answer that. I pulled the data—

THE SPECIAL MASTER: Did they talk to you about it?

MR. SCHAIBLEY: They didn't talk to me about it. I pulled the data as requested. Their forensic person made a forensic image of it and that was all I had to do with it.

THE SPECIAL MASTER: A duplicator and boom done?

*43 MR. SCHAIBLEY: Correct.

THE SPECIAL MASTER: I'm a little bit concerned. Maybe even more than a little bit concerned about how the collection was actually done and verified.

Counsel for UMC, you mentioned you were going to get me snapshots demonstrating that you verified what the mailboxes were indeed collected as said?

MS. WITTY: Yes.

THE SPECIAL MASTER: Is that in the works?

MS. WITTY: Yes.

THE SPECIAL MASTER: Because one of my concerns is that the collection was done, but no lawyer actually looked to verify that what they thought they were getting was what they got.

And then you proceeded—the custodians, they proceeded to suggest the list of custodians, never clarified that what you got for the custodians when the scripts were actually the right information for what you are looking for; for example, the mailing list as an example, or related sort of communications, or the BlackBerry server.

So I'm a little concerned, maybe even more than a little, that that needs to be verified, I need someone to verify that what you think you have and are searching is indeed what it is. Does that make sense?

MS. WITTY: Yes.

THE SPECIAL MASTER: Because then we know at least on a going-forward basis we have the right stuff, because we need to make sure.

So from plaintiff's perspective, I guess, and we've agreed that we're going to add—actually, counsel for UMC and also Dean particularly, were you aware of any other laptops during the time period in question that were being used by any of the custodians?

MR. SCHAIBLEY: No.

THE SPECIAL MASTER: Any other devices? Because nobody apparently had a lab top ever outside of his personal laptop.

MS. WITTY: That's true, yes.

MR. SCHAIBLEY: That's correct.

THE SPECIAL MASTER: And nobody worked from home.

MR. SCHAIBLEY: Anybody that worked from home would have worked over TS Web.

THE SPECIAL MASTER: Which everybody said they didn't use because it was too cumbersome?

MR. SCHAIBLEY: It is.

THE SPECIAL MASTER: Well, have a strong group of people from UMC who agree with you.

I guess I'm trying to reconcile, Counsel, when we were at the custodian interviews I asked you specifically how some people mentioned they checked in on his laptop during his meeting?

MS. WITTY: Yes.

THE SPECIAL MASTER: No. He checked it during meetings. He didn't say on his laptop.

MS. WITTY: I'm confused.

THE SPECIAL MASTER: Well, how can someone check something during a meeting if they are not—

MS. WITTY: The only person who had any mentioned any access during meetings was James Mumford.

THE SPECIAL MASTER: Yes, James Mumford.

MS. WITTY: And he mentioned that he used TS Web in meetings to allow him to e-mail.

THE SPECIAL MASTER: From what device?

MS. WITTY: From his personal laptop, probably in violation of policy.

THE SPECIAL MASTER: So let me be clear. I think you should read the custodian interviews. They would probably be useful for you, but where I'm a little let's say confused is Mr. Mumford told us that he was able to, in meetings, access the—

*44 MS. WITTY: Specifically what Mr. Mumford was referencing was the same as the SEIU negotiations. That was the only time that he was using those, because they had to have—

THE SPECIAL MASTER: So he had his personal—I'm just trying—

MS. WITTY: His off campus negotiations, he would take his personal computer and connect via TS Web [RPTR NOTE: it's TS Web].

Actually one of the e-mails that was referenced in Mr. Pixley's declaration is from that time period, has his notes from those negotiations.

THE SPECIAL MASTER: Right. So that leads me into—do you have a question?

MR. TOSTRUD: Plaintiffs would make the same request with respect to Mr. Mumford's laptop that we did with respect to Mr. Spring.

THE SPECIAL MASTER: I order UMC to preserve it until we can make a determination if it was indeed used.

If he used it in relevance to or potentially used it during that time period or was it using it during the time period in question, he may or may not have been using it.

MS. WITTY: Prior to the time period that was relevant—if he was using the laptop prior to the relevant time period, it's his personal laptop and it has now elapsed five years.

THE SPECIAL MASTER: I'm sure he doesn't have it.

MS. WITTY: I'm just trying to establish what type of chain of custody information we're going to need to gather. I can't guarantee that he has the same laptop.

THE SPECIAL MASTER: I hope he doesn't have the same laptop.

MR. TOSTRUD: Again, defendants relied extensively on the CBA as a defense in this matter. Plaintiffs and defendants have both briefed—

THE SPECIAL MASTER: What's the time period?

MR. TOSTRUD: I don't know the time period of his laptop.

THE SPECIAL MASTER: No, you are referring to, when you say—

MR. TOSTRUD: The topic I'm referring to is the 2008 collective bargaining agreement which was then I believe amended in 2012, but defendant has maintained that the 2008 collective bargaining agreement represents a defense for them to this collective action.

THE SPECIAL MASTER: Let me try this differently. Is the defense using the collective bargaining agreement in any way in their arguments in this case?

MS. FOLEY: They did several months ago, yes, filing a motion to dismiss, I believe prior counsel did.

MR. TOSTRUD: If they are waiving their argument, we will on the CBA—

THE SPECIAL MASTER: I'm not the judge—strike it from the record. Off the record.

THE SPECIAL MASTER: I'm going to order you guys to preserve it because it falls within the time period.

MS. WITTY: I would actually like to counter that issue. What Mr. Tostrud is specifically mentioning is that that information that is relevant to the SEIU negotiations is relevant to the larger issues.

However, at the time period the statute of limitations relevant to this case starts in July of 2009. All of this information was prior to that. We have collected through the ESI information from that time period, information that was either e-mailed or was in their custodian's home files or profiles, but that time period, is SEIU negotiations actually fall outside the statute of limitations in this case.

*45 THE SPECIAL MASTER: But just so I get it, are you using the negotiation, whatever—

MS. WITTY: It's not the negotiations that are relevant to the defense. The defense is the terms of the CBA with the plaintiffs in this suit control certain procedures for timekeeping.

MS. FOLEY: The document itself ...

MR. TOSTRUD: Very simple. They have asserted it as a defense. They brought a motion to dismiss on its basis. There is no rule that requires relevant evidence to be limited to the statute of limitations for the claim. That's just not the way preservation of evidence works.

MS. WITTY: But the negotiation of the CBA is not pertinent to the actual allegations of this suit.

THE SPECIAL MASTER: I feel in some sense there is more about the merits and I'm not qualified to rule on anything to do with the merits.

What I can speak to is that you believe there is relevant information that could consist on the personal laptop.

MR. TOSTRUD: Correct.

THE SPECIAL MASTER: Distill it down to what I need. You believe in your perspective that there is no relevant information on the laptop relating to this dispute?

MS. WITTY: Not locally. It was all accessed through TSY.

THE SPECIAL MASTER: Just on the laptop. We're not doing it locally. Just on that laptop?

MS. WITTY: No, at this point.

MR. TOSTRUD: Plaintiffs would simply ask it be preserved—

THE SPECIAL MASTER: I'm just thinking. Give me two seconds.

I'm going to order the preservation and finding the laptop for purposes of waiting for the Court to make a finding as to whether or not as to the merits of what you are talking about, because based upon what's been presented to me and the system has been designed and built, he could have accessed it and cashed the copies, set up his e-mail account on his local laptop using the IMAP server and the SMPT to send and receive from that local laptop.

There is no way to actually know with certainty it was or was not happening, but we do know he was using it at the time in negotiations off site, and I have to assume that he was e-mailing or having communications with people while he was off site using some device.

And since we don't have any of his mobile devices, it's near impossible for me to make a determination as to whether or not that may or may not have information, but the real possibility does exist that if he was working offsite in negotiations at the time that he configured the laptop to send and receive e-mails and that the only place that those e-mails may exist today would sit on that computer, because of the way UMC's backup policies and other procedures operate today that that is literally—and there is no back-up tape, the only potential source of that information and it's a practical perspective that it could have that information if he was working offsite and he didn't have—if you read his custodian interview he says that he didn't have a smart phone at the time to communicate, and I'm assuming that he was sending e-mails back and forth somehow. I mean, maybe I'm wrong, but ...

*46 Maybe I got it wrong, but you were going to provide me that information and you gave it as a supplement, and if you look at your supplement—

MS. WITTY: Only had a cellphone at that time.

THE SPECIAL MASTER: So the only way he could have been sending and receiving e-mail, as far as I know from the information that has been given to me, would be using that laptop.

So that's why I'm going to order the preservation today that the judge make a ruling as to whether or not—I don't understand the intricacies of labor law, unfortunately, enough to participate in any dispositive action that I feel the remotest sense of comfort level.

So I'm going to order the preservation. I'm going to sit on it, look at the transcript, but I just want to understand. My reasoning is very simple and I want to spell it out so there is no confusion.

He had a laptop. He did have a smart phone that could send e-mails and communicate at the time. He was working offsite using this laptop.

And I'm assuming if he was in negotiations he was sending back and forth documents. If he wasn't then it's a core assumption but I have to assume if he was negotiating he most likely was having some way of communicating back and forth with individuals.

Since UMC's system itself requires a users it was possible for them to configure their e-mail account to be used by a personal laptop at that time, and it's also possible and likely that the only place that those e-mail messages could sit today would be in one of three places, in his sent mail folder items on the script that was run, but if he deleted them or purged them or any one of a number of things could have happened, they are not there. There is no backup tapes from that time period. So the only possible source today that we could use to validate if it turns out the judge rules that indeed this is within—before I go too far, strike the judge piece, but that's the reason why I'm ordering the preservation. I want a forensic image created, E 01, I want a change of custody form filled out, and I want it preserved. I'm making no ruling or determination at this stage until we actually see when the e-mails starts flowing to your side you'll be able to make a much—like, for example, if he was actually e-mailing when he was supposedly in negotiations, then we know fairly definitively he was using his laptop at the time because that was the only mobile device he had that could have possibly be sending e-mails. So we just need to get a little more information and then we can make a more educated determination as to whether or not it's appropriate, but I think we can all agree that there were e-mails sent during the time when he was negotiating, using his personal laptop, then in all likelihood, there probably needs to be searched. But I'm going to reserve any judgment on that until—and I also recognize that UMC's counsel relied upon prior counsel to have done this and that the time has elapsed, but with the utmost speed and urgency they should do this.

*47 MR. TOSTRUD: Special Master Garrie, plaintiffs initial presentation letter August 6, 2012, directed to Mr. Brandon specifically identifies and I quote from page 3 this preservation notice pertains to all documents as defined herein which have been written or generated from July 2008, 2008 through the present, and I'd like to enter—

THE SPECIAL MASTER: Can we enter that just so I have a record because there was several preservation letters provided to me and then there were the same letters were attached to multiple arguments and I got inherently confused.

MR. TOSTRUD: That's the initial preservation letter.

THE SPECIAL MASTER: And I'm going to reserve judgment until we actually go down a little bit.

Just for purposes of the IT security piece of the puzzle, when someone wants to use a personal laptop to access, they don't need to ask if they use the TS Web; right?

MR. SCHAIBLEY: They have to be a member of the TS Web group, so they do have to get authorization to use TS Web. Now, once they have been approved to use it, then they don't need to ask any time they go in.

THE SPECIAL MASTER: Is there a client?

MR. SCHAIBLEY: It is, it is a remote desktop server.

THE SPECIAL MASTER: Oh, it is?

MR. SCHAIBLEY: Yes.

THE SPECIAL MASTER: Do you have server logs?

A. We do have the server log and with regard to Mr. Mumford part of his collection that was done for him was his local profile on that server.

THE SPECIAL MASTER: Let's look at that. So does everybody understand what was just said?

MR. TOSTRUD: Yes.

THE SPECIAL MASTER: Checking. I think now we're at a decent breaking point. We still have several points—

MR. GODINO: Before we break, with a huge caveat that we have a limited ability to search the ESI that was produced and a limited ability to view. We were able to do a search for the phrase “sent from my iPhone” and came up with about 100 hits.

THE SPECIAL MASTER: Usually that's how—let's go off the record.

(LUNCH RECESS.)

Las Vegas, Nevada; Friday, April 4, 2014

1:09 P.M.

Afternoon Session

THE SPECIAL MASTER: Without further ado, I'm going to continue forward.

One thing I wanted to go forward, revisit that I wrote down and I want to touch on the production schedule, is I want to go through the mobile devices. I want to put—I want to resolve what we've actually done to date, what we understand we have, what we understand is no longer with us in our possession, custody, or control.

So based on the custodian interviews and information I've provided. I think what I'm going to do is let counsel walk us through. Would you mind, Counsel, walking us through the mobile devices with the information.

MS. WITTY: Specific to the UMC issue directly?

THE SPECIAL MASTER: Yes. We're going to sort out—let me write that down. Par.

MS. WITTY: There are only three of the custodians and that also is including the newly added Claudette Myers and Cindy Dwyer, only three St. Louis UMC issued phones. John Espinoza, James Mumford, and the former CEO Brian Brannman.

*48 Mr. Espinoza has had the same BlackBerry curve 8530 for the entire relevant time period.

THE SPECIAL MASTER: Can I ask, when did he get it?

MS. WITTY: That I do not have, but that can be obtained. It was prior to September of 2008, because the first update to the BlackBerry was in September, was on September 22nd of 2008.

THE SPECIAL MASTER: That's what I thought.

MS. WITTY: Yes. It was also updated a second time on January 20th of 2011.

THE SPECIAL MASTER: When you mean updated, specifically updating as the way we have already discussed where it's wiped, where they push a clean bill of—and we're going to talk to the BlackBerry administrator on Monday to understand, if you preserve—I want to understand how the BlackBerry—

MS. WITTY: How it backs up.

THE SPECIAL MASTER: How backs it up before he wipes it, the other pieces that we'll clear up on Monday.

MS. WITTY: Yes. The next custodian was James Mumford. He originally had a UMC flip phone. It was non text enabled, non data enabled. He received that when he started with UMC, so it's been 13 years. He was upgraded to a BlackBerry 9330 on April 1st of 2011. Since then he's had the same phone. It was update again on September 15th, 2011, and a second time February 6th of 2012.

THE SPECIAL MASTER: Just again, when we say upgraded here, we're referring to the UMC protocol of upgrade where they wipe and push a new build?

MS. WITTY: Correct. The final custodian was Brian Brannman. His initial phone, when he was hired in February of 2011 was a BlackBerry curve 8530. It was updated—excuse me—

THE SPECIAL MASTER: Got a new one.

MS. WITTY: He received a new device, a BlackBerry curve 4 on July 19th of 2013. Mr. Brannman is no longer with UMC, so both of those phones have been wiped. But the devices are sometime held by UMC. So if there was anything that could be recoverable, they still have those devices.

THE SPECIAL MASTER: Joseph, you created forensic images of them?

MR. EDMONDSON: Yes, the three that were presented to me.

THE SPECIAL MASTER: There's more than ...

MS. WITTY: I believe the forensic images were of the BlackBerry curve for Mr. Brannman.

THE SPECIAL MASTER: The 4?

MS. WITTY: The 4, yes. The BlackBerry curve 8530 for Mr. Brannman was not imaged.

THE SPECIAL MASTER: But you have it?

MS. WITTY: Yes.

THE SPECIAL MASTER: And, yeah, that's all I wanted to—and with regards to in the custodian interviews we had further there was inquiries to whether or not they had personal devices that they worked for work, they all had different personal devices but none of them were actually, as far as to the best of their recollection besides—

MS. WITTY: Mr. Mumford did not have a personal device.

THE SPECIAL MASTER: He did not have a personal device. He only had a work device, but everybody else had a personal and a work that was separated by church and state as one set.

I'm going to request that—well, again, we need to talk to the BlackBerry administrator because if it was—I mean, you have in your possession, custody, and control right now, so before we create a forensic image of it, let's make sure that there is something that can actually be recovered from the wipe.

*49 I don't know. Wipe ask like an esoteric concept from a technology perspective it means one thing and to everybody it might mean something else, so I would rather have the available on Monday and we can quickly figure out what is or isn't necessary.

With the mobile phone piece, I was also thinking you might want to do iPhone, I pad or powered by. Because they have the Droid, I forget, like—I don't have T–Mobile but they have some of the Android bases have power—

MR. TOSTRUD: That's their signature line.

THE SPECIAL MASTER: Signature powered by something or other. Just as a search phrase just to make sure.

Theoretically it should be a fairly trivial exercise to look at this. It should be “powered by colon,” and you should—the only hits you should be looking for or seeing are iPhone or iPad or Android-related devices, which you will figure out they whether or not they were or were not being used at the time.

Does anybody have anything they want to add there?

MR. TOSTRUD: Just a question. Will the custodian interviews identify the dates that those so-called wipes occurred?

MS. WITTY: Yes.

THE SPECIAL MASTER: Just want to check in on Kronos. Are we good with Kronos from the plaintiff's side?

MR. FORREST: So far so good we've gotten our information and we have made calculations on that. Now we're working on linking it up to the wage data. I'm not sure there is going to be an outstanding question in terms of wage data in Kronos not reflecting modifications made in the SAP system.

THE SPECIAL MASTER: The SAP system I believe is only—this is something I'd like clarity on as well. I'm not sure what the SAP system was used for. I understood from your papers that you believe it was used in some fashion relating to your complaint or your claim. No? Is that incorrect?

MR. TOSTRUD: I think our position is that the defendants represented to us that there is some electronic interface between Kronos and SAP. They've provided us, defendant provided us with the SAP or with the Kronos database, but apparently that database won't necessarily allow us to compute all of the—

THE SPECIAL MASTER: I got it. You don't have full visibility into how it was configured.

MR. TOSTRUD: Correct.

THE SPECIAL MASTER: Does anybody on the UMC side most.

MS. WITTY: We're not exactly sure what information they are wanting. It's our understanding—

THE SPECIAL MASTER: Before we get to what they are wanting, I want to understand, does the SAP system actually have data relating to this dispute? Because does it—is it employee data relate or the—like what data is in the SAP system.

MS. WITTY: It's personnel information.

THE SPECIAL MASTER: So personal files.

MS. WITTY: Yes. So it would be if you were looking for someone's contact information or someone's title, you wanted the SAP—

THE SPECIAL MASTER: But to be clear, that system is actually run not by UMC but by the pseudo-state organization.

*50 MS. WITTY: Correct, because Clark County actually runs.

THE SPECIAL MASTER: The SAP platform.

MS. WITTY: The SAP platform.

THE SPECIAL MASTER: Is there somebody within UMC that actually does SAP based work technically?

MS. WITTY: I don't believe so.

THE SPECIAL MASTER: So before we get into—I'm just trying to understand the big picture because I got a little confused with it.

So who configures the SAP system to work with Kronos. Is it an individual at UMC or an individual with Clark County?

MS. WITTY: I believe it's with Clark County.

THE SPECIAL MASTER: So we would, then taking me to my next question, does anybody actually know from the UMC side how the Kronos and the SAP are interacting?

A. So SAP, the reason why it interacts is once that timekeeping information—

THE SPECIAL MASTER: Let's say I'm an employee. There is worker A who goes to work, Kronos SAP, what happens?

A. Just a regular employee.

THE SPECIAL MASTER: Regular person.

A. When they clock in, so when they call into the system, that is captured by Kronos. When they clock out, that is captured by Kronos. Similarly when they have a missed lunch or some other adjustment to their time that is made, that is made in Kronos.

THE SPECIAL MASTER: Because Kronos and SAP can capture the very same data, you realize?

MS. WITTY: Yes.

THE SPECIAL MASTER: So that's why I'm asking, and I haven't seen any of your database field screen, so I have no knowledge to which one does what.

So your Kronos system is used internally to track basically hours?

MS. WITTY: Yes.

THE SPECIAL MASTER: For lack of a better term.

How does SAP plug into that?

MS. WITTY: So in order to generate—so from Kronos they generate essentially a report that says this is how much time is worked. That would include your calculated enrollee, that would include—

THE SPECIAL MASTER: Kronos stores all of this data about me and my work performance and generates a report?

MS. WITTY: If it includes over time, if it includes all the other information. It has to interact with SAP because the payroll goes through SAP.

THE SPECIAL MASTER: Got it now. SAP is a payroll system?

MS. WITTY: Yes.

THE SPECIAL MASTER: Is that what we're talking about here? Okay. We need to figure out if—because it makes a difference as to whether or not, A, I assume it's being preserved because SAP is fairly hard to delete data out of it, believe it or not. Most people can't figure out to delete the data out of SAP most of the time, which is a blessing, I guess, for everybody.

The question then becomes, you guys are then taking Kronos data collectively, whatever it is, some hourly reporting, provide some data a scheme a to SAP, Clark County, SAP platform, which then cuts payroll, is that how that works?

A. Yes.

THE SPECIAL MASTER: So then the wage piece—I just want to understand the systems and then I'll entertain everything.

*51 So then—so if there is a problem with my wage, I talk to the person that runs SAP, the person who runs Kronos?

A. You talk to someone in payroll because they would be the ones that would interact with the SAP.

THE SPECIAL MASTER: So the payroll people internally use the client system, that's the Jackie Panzeri, she uses a client based system to input her work with the SAP Clark County system to resolve payroll issues?

A. Yes.

THE SPECIAL MASTER: But that data doesn't actually sit on your systems, it sits on their systems?

A. Correct, it is on their system.

THE SPECIAL MASTER: All right. So now at least I have a decent understanding, which then would explain when they run the script that everybody has the same exact set of files.

MR. FORREST: Also my understanding is from earlier conversations it may be possible to make adjustments in the wage data and the payment data over on the SAP side.

THE SPECIAL MASTER: Just to be clear, the issue of your question is, I call up UMC and I'm like I'm getting—pretending a hypothetical here, I am an employee and I worked 90 hours this week but you only paid me for 50 of them and you shortchanged me 40 hours of my time in my paycheck. The paycheck comes from Clark County's SAP division, but I call UMC's payroll person. The question you have is so I call her and I'm like here's my hours, whatever, she's oh, you're right, she updates the system on her side, amended that feeds into the SAP side, or your question is, does she actually directly update the SAP and that feedback into Kronos.

MR. FORREST: Or not back into Kronos.

THE SPECIAL MASTER: Either it does feedback in or it doesn't feedback in, the fact that my 40 hours weren't documented. That's your concern?

MR. FORREST: Yes, or specific numeric adjustments made in response thereto.

THE SPECIAL MASTER: Just basically if I call somebody up and I call up payroll and where are my 40 hours and they are what 40 hours are you talking about, the question is when I fix it is it being fixed in Kronos and SAP or just SAP or just Kronos, and that's the question, as I understand it. Is that right.

MR. GODINO: SAP and—

MR. FORREST: Or there could be something applied on a general basis. There could be some sort of adjustment rule that's applied or something. We don't know.

THE SPECIAL MASTER: When you say adjustment rule, let's stick with my 90–hour week and I was shorted 40 hours. Help me understand. When you say a adjustment—we're talking payroll. So the payroll person would have to do what to the SAP—I just want to understand what an adjustment means from your perspective, because a SAP adjustment is you write a rule and it runs and the SAP has their own language.

MR. FORREST: I'm just talking about any situation where the data that's retained in Kronos would not reflect what was actually paid.

THE SPECIAL MASTER just want to make sure that cash and timeline up.

MS. WITTY: All of that information has been provided in the packets. Because we don't have access to the SAP—

*52 THE SPECIAL MASTER: Whether it's provided or not, I just want to make sure I understand it and you understand it, and then we can talk about a solution or whether it's been provided..

Okay. So you understand what they are saying. I get it. So we're all on the same page here. Basically the amount I got paid, minus the number of hours I worked. And if it doesn't—

MR. FORREST: Have the right.

THE SPECIAL MASTER: Yeah, but if my amount has to be—

MS. WITTY: Based on—

THE SPECIAL MASTER: Forget we're on the record. So yes, correct. Off the record.

THE SPECIAL MASTER: Back on the record.

Opt-in packets, I've steered clear of these because there's 600 things I don't want to read.

And the Court, there was a whole discussion. I had the fortune and opportunity to read the great lawyering work that was done around this, and there was zealous advocacy, and packets were provided in a staggered fashion, I think 50, 100—but they all eventually made it over.

The packets, as I understand it, as you believe as UMC believes has this information in it. Is that accurate.

MS. WITTY: Yes, and that's how UMC accesses that information. That's exactly how they would have access to it.

THE SPECIAL MASTER: When you say they have access to, so the data—did you get the packets.

MR. GODINO: Plaintiffs received them.

THE SPECIAL MASTER: But have you guys processed the packets and ingested the data from the packets.

MR. TOSTRUD: No.

MR. GODINO: Well ...

THE SPECIAL MASTER: If they are saying the data is in the packets, I'm just trying to figure it out.

MR. TOSTRUD: The issue with Kronos is that we believed—and I'm not looking to reargue this. I just would like to provide some background.

We believed that they could export some information from Kronos and generate spreadsheets for all the people. This is routinely done in these cases, litigated several of them, and that's what we had hoped to do, but UMC, and this has been litigated—I'm not looking to re-litigate it—UMC represented that it either couldn't or wouldn't do that, and that we all the information in these opt-in packets, which can be somewhat unwieldy to try to, you know, distill.

So the judge in the case said, okay, fine, you don't—you can't do it, I'm not going to force you to do it, but what I am going to force you to do is to give the plaintiffs the Kronos data in its raw native form.

THE SPECIAL MASTER: I read that ruling.

MR. TOSTRUD: So that was provided to us sometime in early February, I believe, and we are now working with it. We believe that all of the lines are there and those things are there, but what we are a little unclear about is how this interacts with SAP.

THE SPECIAL MASTER: At least I get what the issue is now.

So here's what I'm going to suggest.

Why don't you figure out from the Kronos perspective and take a dozen packets that they provided and see—and I don't particularly wanting to see them. I am hoping this solves the problem. If it doesn't, I'll revisit the issue.

*53 Why don't we reexamine to see whether the data in the packets they gave you have the requisite data that you need out of SAP, because the problem we're going to run into is they don't control the SAP system, and because they don't control the SAP system, to get a export out of SAP is going to take—it's a state-run organization.

MS. WITTY: Local government.

THE SPECIAL MASTER: Local government organization—let's go off the record for a second.

THE SPECIAL MASTER: On the record.

MR. TOSTRUD: With respect to the issue of the Kronos database and in the interest of cooperation and the spirit of trying to be efficient, we would again extend to the defendant an opportunity to try to meet and resolve this together collectively if for no other reason than we both need this information and having an agreed-upon set of data that we can proceed with moving forward is absolutely in both parties' interest. I say that based on personal experience having litigated many of these cases that—

THE SPECIAL MASTER: It just makes sense that you both need the same data so you can talk to the Court.

MR. TOSTRUD: Correct. That's what we would offer to go and sit with them, Mr. Schaibley or whatever.

THE SPECIAL MASTER: Before we get UMC involved here, what I would like to suggest, if the packets don't work or you need other pieces, come back to me to the parties, say, hey, look, the packets don't provide this like X, Y, and Z that we need. As soon as we have we can have intelligible conversation and we can move across the finish line quickly.

MR. TOSTRUD: Certainly.

THE SPECIAL MASTER: I want to talk about storage devices. Now, I'm going to talk about removal storage devices and I want to talk about storage servers, Hitachi—like big storage. I first want to talk about storage devices.

When somebody has a computer, a desktop and we'll get to the desktops shortly, but when someone has a computer, do they have the ability to burn a disc of information?

MR. SCHAIBLEY: A generally user, no, they would have to go through somebody in the IT department first.

THE SPECIAL MASTER: When you say general user is that a non IT user?

A. Yes.

THE SPECIAL MASTER: So all of the six custodians, they would be general users and would have to go to IT?

A. Correct.

THE SPECIAL MASTER: To be clear, because in some of the custodian interviews it was brought to my attention that—counsel witty correct me if I'm wrong—that discs of scanned information were created. I'm not exactly sure what's on the discs. But one thing that I would like counsel to do is at least for the time period in question, since, as I understand it; correct me if I'm wrong, Counsel witty—where are they stored?

MS. WITTY: Coordinate with iron mountain. It's a third party storage, both physical and electronic.

THE SPECIAL MASTER: Just so I understand, from your perspective, I come in, I have to talk to IT. IT says okay, you can burn—I'm going to give you permission to cut a disc of information.

*54 MR. SCHAIBLEY: Correct. It's coordinated through IT for the users to be able to do that. It would typically be done through our ticketing service, ticketing system.

THE SPECIAL MASTER: Here's the situation. We have custodian interviews where people have said they made discs. The problem is they didn't tell us when they made the discs.

Counsel Witty?

MS. WITTY: So the only person who actually physically burns disc is Ms. Myers. It's her interpretation the discs she burns are related to grievances hearings, however. Mr. Espinoza, in the previous recruitment and search for a CEO, believed that there had been documentation that he had sent to iron mountain and some of that was scanned, and he felt some of that scanning had been burned to the disc and submitted to iron mountain.

THE SPECIAL MASTER: Can you please check—how far back does your help IT ticketing system go.

MR. SCHAIBLEY: I'd have to check on that.

THE SPECIAL MASTER: I'm hoping you come back and tell me 2008 and we're good.

MR. SCHAIBLEY: I would honestly have to check on that.

THE SPECIAL MASTER: First I'm going to ask quote order you to get me an answer. It does go back to the time period in question and if your IT systems are built so that a user has to go to you with a ticket, just run me a report for the custodians of interest that have been identified to see if discs have been burned during those time periods, and then we'll go forward from there. I would like that by next Friday, if possible.

And the obvious reason is I want to make sure if there are discs, that they are identified properly and accordingly.

Now, what about USB sticks?

MR. SCHAIBLEY: USBs are current little denied by policy. If an end-user needs to use USB flashes they 22 have to come through IT security and they would get one similar to this one here.

THE SPECIAL MASTER: I use just old school cardboard and super glue.

MR. SCHAIBLEY: Just regular USBs are not allowed. If you plug it in and we get it, access to them is disabled.

THE SPECIAL MASTER: Was that during the time period in question or now?

MR. SCHAIBLEY: During the time period in question we were set up in passive mode. I do not know when it began. We turned off passive mode and turned on active blocking in October of 2012.

THE SPECIAL MASTER: I'm not terribly concerned because none of the custodians stated they were using USB storage devices, and I will take them on their word at this point. I believe none of them said they were.

But if you could figure that out, that would be helpful, for the USB devices, when it was switched from passive.

MR. SCHAIBLEY: Switched from passive to active was October 2012. What I don't know is when it first got turned onto passive.

Passive means if a USB stick was plugged in, the system was recognized it was plugged in, IT security would get an alert it was plugged in, but it wouldn't stop it from being accessible.

THE SPECIAL MASTER: But there would be a log of it?

*55 MR. SCHAIBLEY: I would have to see if that log is still maintained, because we have recently upgraded the database.

THE SPECIAL MASTER: That's fine. Nobody said they were using it. It's just me being diligent. I don't actually foresee—it's just the scanned discs that are really of interest.

The one other thing—well, there are several other things, but I want to talk about the department of labor. I'm a little confused, and I now apologize up front. I tried to be diligent and it took way more than 70 hours to read the 2500–plus pages and make my data map.

In the course of reading everything I got somewhat confused as to—can someone start with the investigation of the department of labor, when it started from—just when was UMC notified? Like when did that conversation start? That started with prior counsel, I assume.

MS. WITTY: Prior counsel on this suit was not actually involved in the D.O. L investigation.

THE SPECIAL MASTER: Who was attorney or in-house or otherwise that was—or was it just

Mr. Spring involved?

MS. WITTY: It was John Espinoza was the main contact within UMC for the department of labor investigation. Doug Spring, as Mr. Espinoza's subordinate, assisted but not in direct contact. There was limited interaction with county counsel, so not in-house but supervisor counsel through the county.

THE SPECIAL MASTER: And what was the time period there?

MS. WITTY: It was in—correct me if I'm wrong. I'm thinking it would have been early—

THE SPECIAL MASTER: Plaintiffs you must know. When was it? Do you know?

MR. TOSTRUD: We believe, based on discovery, that it was in the fall of 2012.

MS. WITTY: I think the initial contact was made during the summer, because it was prior to—most of the investigation prior to the filing of this lawsuit. It would have occurred in the late Spring or early summer of 2012. I can absolutely—

THE SPECIAL MASTER: We definitely need to know when.

MR. TOSTRUD: We plaintiffs have not received that notice if there is a document that indicated that there was a notice.

THE SPECIAL MASTER: We haven't received any electronic documents.

MR. TOSTRUD: No. That's right. But we've received some documents between the department of labor and UMC, but we are not aware of this notice.

THE SPECIAL MASTER: Well, let's add that to the notes that you guys are covering so we can make sure that the—

Returning back to—

MS. WITTY: I just want to make sure we'll coordinate with the plaintiffs to make sure we have a firm timeline on that.

THE SPECIAL MASTER: Yes, firm timeline, and if the notice letter is discoverable and there is no objection by UMC, produced accordingly. If there is, then we can have a conversation about privilege, etc.

I need to understand something, I don't mean to sound a bit slow here, but you had supervisor counsel, were you aware of the department of labor investigation?

MR. SCHAIBLEY: No, I was not.

*56 THE SPECIAL MASTER: And you would be the person who would be responsible for running any sort of collection or etc., for UMC if there was?

A. Yes, if it was brought to us, yes, if it happened prior to my starting at UMC.

THE SPECIAL MASTER: This was when?

A. I started in June of 2012.

THE SPECIAL MASTER: Wow, this date is going to come down to being really important. The department of labor investigation, did that involve, as far as UMC's involved the collection of any data or documents.

MS. WITTY: No.

THE SPECIAL MASTER: Plaintiffs, do you have any idea, from what you have been able to figure out?

MR. TOSTRUD: Maybe I misunderstood the question or misheard it.

THE SPECIAL MASTER: Department of labor ran an investigation and I asked UMC did they provide any—collect any information, electronically and provide it to the department of labor.

And UMC said no, right, as far as you know?

MS. WITTY: Right.

THE SPECIAL MASTER: Do you know—I mean—

MR. TOSTRUD: We deposed Mr. Espinoza, who was directly involved. He indicated that he provided information—

THE SPECIAL MASTER: No, I read that. If you wanted to provide me the transcript, that would be useful. You have it. You provided it in one of your filings that you gave me.

MR. TOSTRUD: Yes. He testified about having I believe e-mailed with them.

THE SPECIAL MASTER: If we could put it in the record, that might be useful.

MR. TOSTRUD: I'll attempt to find that. Furthermore, there are several documents that have been produced to us, including e-mails related to the department of labor investigation as well as what looked to be spreadsheets relating to calculations of over time paid that—of pay—of time worked that was not compensated, uncompensated time, calculations of uncompensated time.

THE SPECIAL MASTER: Who provided you the spreadsheets? Can you provide them so we can put them on the record?

MR. TOSTRUD: They were produced in discovery in this matter.

THE SPECIAL MASTER: While you are looking for that, UMC, are you aware of these spreadsheets?

MS. WITTY: Yes. They were produced.

THE SPECIAL MASTER: I mean, but who made them? Like how—if you guys didn't collect anything, that would imply that you made these spreadsheets specific for them because that would imply you didn't collect any information.

MS. WITTY: They were created within John Espinoza's office.

THE SPECIAL MASTER: And they were created specifically in response to the department of labor investigation?

MS. WITTY: Yes.

THE SPECIAL MASTER: Did he create any data to prepare the spreadsheets.

MS. WITTY: I believe there was information collected from Kronos.

THE SPECIAL MASTER: I'm not trying to—all I am trying to figure out is the way I understand the situation—off the record.

THE SPECIAL MASTER: Back on the record. I'm going to request that UMC just verify via through their IT—I need somebody within UMC's IT Department to verify that there was no internal collection in relation to the department of labor investigation. If you weren't there at the time when this was done, I would prefer to hear firsthand from the person that was involved and say I did not do anything. I understand you didn't, which makes total sense, but it would be—I mean—and I would like that by next Thursday.

*57 MR. TOSTRUD: And I was able to identify some documents relating to the department of labor investigation, and we'll have to look through the depo transcript on this, Special Master Garrie, but certainly UMC 100001 and 10003 plus some additional documents that are attached, these are calculations that were made in spreadsheet form and we don't know who made them, I don't believe, but they were provided to UMC or UMC provided them to the department of labor. Clearly that was created electronically. We would like to put those into the record.

THE SPECIAL MASTER: Counsel, do you want to look at them?

MS. WITTY: Yes, if you wouldn't mind. I didn't hear the Bates numbers.

THE SPECIAL MASTER: So then, the question I guess that remains to be resolved is did they create information specifically for the department of labor investigation, meaning did—or did he collect information and then use that information he collected to create the reports.

So basically did he use Kronos beyond just typing a key button the keyboard and create the spreadsheet, or did he actually collect data and information and then use that to do his whatever you were provided.

MR. TOSTRUD: Okay.

THE SPECIAL MASTER: According to as far as UMC knows, as far as Dean knows, and they are going to verify by next Thursday, there was no internal collection done in relation to the department of labor investigation. Right, Counsel Witty?

MS. WITTY: Correct.

THE SPECIAL MASTER: Do you have any objection to this?

MS. WITTY: No.

THE SPECIAL MASTER: Enter this.

THE SPECIAL MASTER: Just for my own education from an UMC perspective, from timing, departments of labor contacted you. As far as you know, they didn't do anything. I mean, UMC didn't collect anything or collect any information to provide. They just provided summary or whatever to the department of labor in relation to the investigation?

MS. WITTY: And it's purely upon the request of the department of labor investigator the information was collected or the spreadsheet was created.

THE SPECIAL MASTER: Created. Not collected. Created.

MS. WITTY: Right.

THE SPECIAL MASTER: Much different.

MS. WITTY: Yes.

THE SPECIAL MASTER: So okay. I'd like you to talk to UMC's former IT individual to make sure that there is no initial—that that is indeed the case.

The department of labor didn't request for any records?

MS. FOLEY: No, it was a very odd, informal—

THE SPECIAL MASTER: I'm not trying to imply or impute anything of any nature.

MS. FOLEY: I have to be careful what I'm saying too because—

THE SPECIAL MASTER: Let's go off the record for a second please.

THE SPECIAL MASTER: Back on the record. As I understand it, was there any informal or otherwise collection done by UMC to collect information in relation to the department of labor investigation?

MS. FOLEY: My understanding is there was some sort of chart assembled with some kind of wage information entered into a spreadsheet by hand, a little bit of data entry. That's it.

*58 THE SPECIAL MASTER: No, I get the data entry piece. Who collected the data that went into the data entry? The data had to come from somewhere.

MS. FOLEY: It was payroll data.

THE SPECIAL MASTER: So if he wasn't doing the collection—let's try it differently. You are right about the terminology.

The department of labor ran an investigation, formal or informal or otherwise. UMC—all i'm trying to establish whether any information was collected, formal or otherwise in connection with this department of labor informal or formal investigation that was via e-mail, spreadsheets, data entry, that was not data created but data that was collected. The difference being they didn't—they made a spreadsheet, because when I read all the information that was provided to me, I didn't see any requests and I didn't see any data being provided.

What I'm trying to understand is was there any—did UMC ever collect any data, formal or informal, in relation to this department of labor investigation, because based on the information that I've been provided, all I'm trying to establish is, and I believe it directly relates to the scope of the preservation, which is what I'm really trying to get at here, is was this information collected, and if it was collected, was it preserved and was it included within the search and the etc. So we can go through each one of those. That's all I'm interested in. The first question is was there anything formally or otherwise collected?

MS. FOLEY: There was a chart made sort of—Kronos—

THE SPECIAL MASTER:—because there is no need for me to put you on the spot.

MS. WITTY: The problem is I think what you are asking for is a repository. Wherever we go to locate information that was collected. What we have street a spreadsheet that was created, and from my understanding in discussion with payroll, it was they were given a list of names to access information in Kronos in the database where the information is held and they manually input that information into the spreadsheet.

THE SPECIAL MASTER: So at the end of the day do you have the spreadsheets—I'm focused on I don't really—I don't know enough about labor litigation to actually participate here.

What I'm interested in is whatever data you've got, e-mail, spreadsheets, payroll, conversations, whatever, it was data that was collected and created in this process in some fashion or another?

MS. WITTY: Yes, and that's all been preserved.

THE SPECIAL MASTER: That's all I want to know. That's my only concern here. The extent I'll get to—yes?

MR. TOSTRUD: Two quick points. Number 1, Mr. Espinoza in sworn testimony in the deposition provided to you and we'll pick out these points and provide those specific pages and line numbers to you, but he testified that data was collected that he had multiple communications with the department of labor, that's number 1.

And number 2, a letter dated September 26, 2012, from Ybelka Hernandez of the U.S. Department of Labor, this is UMC 000006 to 000007, indicates at paragraph 4, this is a letter from Mr. Espinoza to Ms. Hernandez, “I am proposing the following based on our own evaluation and discussion with the supervisors of the department in question,” and then he proceeds to outline a proposed resolution of the department of labor investigation.

*59 But Mr. Espinoza clearly lays out in this document that there has been an evaluation and discussion with supervisors of the departments in question, and I'm happy to submit this for the record, but plaintiffs firmly believe, based on our experience in this case, that there is a tremendous amount of information that exists with respect to the department of labor investigation.

THE SPECIAL MASTER: Well, let's be—I think that they're not disputing that—

MR. TOSTRUD: So my understanding is that they are saying there is a spreadsheet?

THE SPECIAL MASTER: No, no. I think what they are saying—correct me if I'm wrong. One second. Just so—I'd like to enter this into evidence and we can go off the record once you enter it.

(OFF RECORD.)

THE SPECIAL MASTER: Back on the record.

I have a question for UMC that I'm a little confused about. When I read this letter that was entered as Exhibit Number 8. From UMC to Ybelka Hernandez, where it says:

To me, an evaluation implies that they looked at data or did something. I mean, am I misinterpreting what was meant by Mr. Espinoza? I'm trying to understand what did he—by evaluating, if no collection was done informally, what was he looking at, what was he evaluating?

MS. WITTY: I think it's more of a position evaluation. I cannot speak to Mr. Espinoza's—

THE SPECIAL MASTER: Can you do me a favor. Go back to Mr. Espinoza and ask him specifically what he is referring to in his letter to clarify this because it does in some sense to me suggest or indicate that there was data that was used and looked at and it could be of course you are correct, it is possible, Counsel, that that's not what was meant, but I do understand where plaintiff does seek further clarification.

I also want to know whether the prior IT person prior to Mr. Schaibley joining UMC was involved in any part of it, because for me, where this sort of in my head doesn't fully come together is that if they were able to use Kronos to gather data to then create the spreadsheet or data, who—I'd be very—I just want to understand what was done and to make sure that whatever was done was properly provided. All right? And then we'll see what he says. I mean, there's only so much that—I assume that like you ran—actually this is a returning from the department of labor, the next question I had, was when you actually responded to the document request, did you run searches? How did you respond to the document request? Because given the huge amount in generally. This is more for my own edification.

We established that there is probably likely repetitive—a great deal of—it's not 80 gigs of unique data. It's probably like 8 to 10 gigs of unique data or maybe 15, but the point I'm trying to make is, when you got these document requests, did you actually run—how did you search the data that was collected to identify what was responsive, given that the prior production effort that has been ongoing with—which we just cleared up with the EnCase, nothing—how did that happen? How did you actually find information, electronic or otherwise, and give it to them, just so I understand? Was it a concordance database. I'm just trying to determine what documents you actually determined to turn over. So they serve a document request. Document requests request information relating to UMC's—let's return back to my hypothetical of my 90–hour a week and I got stiffed 40 hours or 50 hours.

*60 How did UMC go about trying to identify that information? Because—off the record for a second.

THE SPECIAL MASTER: Back on the record. Let's clarify the record because plaintiff raises a very important point. In the prior hearing it was represented by—what's his name again?

MS. WITTY: Ernie McKinley.

THE SPECIAL MASTER: McKinley that all that had been collected to date was e-mail.

MR. GODINO: That was all he was asked to collect.

THE SPECIAL MASTER: It turns out Mr. McKinley was completely not involved or wrong, because what I received, just to be clear, from UMC was 1500 pages that identifies every file that was collected, and the e-mails came—are in containers called PST and OST. So theoretically the e-mails should be at the most three pages, and I have 1500 pages of files that were collected. There were Word documents, spreadsheets, e-mails.

MR. GODINO: Were those attachments to e-mails, though?

THE SPECIAL MASTER: No, these are in addition to e-mails. I was sitting here and looking at this the whole time and I probably missed one of the big pieces at the beginning. So let me rewind to offer a great deal of clarity.

It turns out that gentleman was completely wrong in every—well, there are additional things that should have been collected and the BlackBerry server and there were other additional issues we have identified.

But with regards to what was collected, they collected, by my estimation, for example, for B Brannman, they collected for OST files, right, which have in them e-mails with attachments and etc., okay? They are embedded within this file—3 OST files, so that probably has hundreds if not thousands of attachments in those OST files. Some of them are pretty big.

Then we have one PST file on top of that. So you have those four files, and then you have upwards of about I think I counted about 400 or 500 Word documents and spreadsheets, in addition to, and on top of that you have his entire Internet history, which was—the I might be able to realize people record everything, and probably I should realize that.

And we also have all the Adobe PSTs, every PDF document. On top of that—I want you look into if it can read SAP data, because there are SAP data files. I'm assuming it can at least be searched because it's a binary file, but there's actual DAT files for the SAP as well.

Then there are like lots of encrypted files, which takes me to a question I have for Dean.

What do you do with the encryption files if you don't have a key? How is he going to read them?

MR. SCHAIBLEY: To be honest with you, I didn't know that there were any encryption files.

THE SPECIAL MASTER: There are encryption files.

MR. EDMONDSON: I believe so.

MR. SCHAIBLEY: If there were encrypted files, those were encrypted by each of—

THE SPECIAL MASTER: Okay. Well, then I want UMC to figure out every one of those files and get an encryption key so they can be searched. I mean—I don't know any other—I'm sorry that they were—I fully recognize that this will be work but at the end of the day there is a responsibility to collect the information. If the user decides to encrypt the files it doesn't mean that they are not entitled to have them searched, and so we need—what he can do to speed this up, you can run an end case, a report to identify every encrypted file, give him that report as an exported Excel spreadsheet so that way he doesn't have to waste his time to find them.

*61 Then you can go figure out—because you have Kryptos systems in there.

MS. WITTY: I apologize. Could we take a short break? I just need to run to the restroom.

THE SPECIAL MASTER: Is it okay if we keep going for like two minutes?

MS. WITTY: Thank you.

THE SPECIAL MASTER: So I want to make—first returning back to what we were talking about, that is what was collected.

MR. GODINO: Do we have an idea when?

THE SPECIAL MASTER: What you are going to get on the chain-of-custody paperwork when you get the new one, it will say on this day, on this time, these many files. You will find it to be—I think all that's really happened, there has been some communication errors, but we're going to create change of custody for each custodian. It actually says these are how many files were copied, this is the day, this is the time. Everything was done properly with the right switches and everything in Robocopy.

Unfortunately, the gentleman that was at the last hearing, he was just wrong in every way, shape or form as to—anyway, the point being that that was collected, but in their collection there were additional issues that we've identified which are there is encrypted files, there were error files in the encryption. So they are going to work to figure out—I should have done this at the beginning and I do apologize. That's why in the beginning I spoke to them about the errors I found in their collection.

Because I don't want to turn over their collection because it has every filename and every piece of detail, so I would rather them give you this is what was collected rather than the filenames etc. They collected word perfect documents, RAR files, ZIP files, but my point is, the other issue with the collection is in this collection they created ask that they encrypted these files, and you can't actually search it until they are decrypted. Right?

The rolling production on a going forward basis that we will establish will be a search of the universe for that custodian. Are you with me?

MR. GODINO: Yes.

THE SPECIAL MASTER: Which will include their e-mails. One custodian had 25 e-mail. And e-mail archives. Which each one probably had hundreds if not thousands of files and attachments in e-mails which is what my point is from earlier I wanted them to de-dup it so they didn't end up—well, two reasons. One, I'm sure they don't want to do a doc review of the exact same files 20 times, and you don't want to read 20 of the exact same file.

So that is going to happen, but before that can happen, I need to get the encryption keys.

MR. GODINO: I understand.

THE SPECIAL MASTER: That turns back to what we were originally talking about which was the department of labor informal investigation. So now you understand the universe of what we have for Mr. Espinoza, which includes all of his e-mail, his WordPerfect documents, his Word documents, whatever they have his script went and grabbed, and he did more than that. That script, I have several questions—

*62 MR. GODINO: If he created those documents before they did the actual collection—

THE SPECIAL MASTER: I can tell you exactly when—

MR. GODINO:—some of those documents may be done.

THE SPECIAL MASTER: That's a separate—that's an issue for Monday, and you will get—

MR. GODINO: Because we requested documents back in January of 2013. I would be interested in knowing when they actually started collecting—

THE SPECIAL MASTER: Wait for counsel. I suspect in chain of custody that information is included because it is only reasonable to state when you acquired the information.

THE SPECIAL MASTER: Counsel Witty, great timing. One of the questions or concerns which I told them we're tabling to Monday is when the collection occurred.

So when did you serve your document?

MR. GODINO: January 23rd.

THE SPECIAL MASTER: So plaintiff served it January 23rd, and—

MR. SCHAIBLEY: We received an e-mail on April 9th to—with the list of custodians to collect and the collection began on April 10th.

THE SPECIAL MASTER: This was the August one that was done, that's the one I got.

MS. FOLEY: Yes.

MR. SCHAIBLEY: Yes.

THE SPECIAL MASTER: But you did two, April and August, right?

MR. SCHAIBLEY: Yes.

THE SPECIAL MASTER: So I'd like—

MR. SCHAIBLEY: The August one was only the 5.

THE SPECIAL MASTER: The 5 which will now be the 6. Now, I would like you to provide me the text files, the output—now that I've within the script myself, for all 26 that were done in April so I can see the actual outputs.

But the point is that you will get all that in the chain of custody form once it's updated. To be clear, I expect it to say we collected these custodians information on two occasions, once here on this day we acquired this many files, in August, this many files, and we got them—I was provided by counsel witty with a spreadsheet that was extremely helpful in figuring out what actually the names meant. Do you remember the name of that file, Counsel?

MS. WITTY: The full directory listing.

THE SPECIAL MASTER: So if that wasn't clear, the actual scope of what was collect dead was much more extensive than what was represented. It is all of their e-mail as it was at the time I believe both in April and in August. Is that correct?

MR. SCHAIBLEY: That's correct.

THE SPECIAL MASTER: I've only verified August but based on what I've seen in August and I'm assuming April will be the same, it is literally all the way down to what is in the person's Internet cache.

It's not a forensic duplicate copy, but it was whatever was in their local profile.

MR. TOSTRUD: May I turn to another big-picture question relating to Mr. McKinley's testimony or statements.

Mr. McKinley stated there were no backups at the March 10 hearing.

THE SPECIAL MASTER: Let me be clear. Dean's specialty ask in the collection and the enterprise mail server, not the BlackBerry or the backups. That person will be here on Monday.

*63 MR. TOSTRUD: Okay.

THE SPECIAL MASTER: We've gotten and you've received and you'll review, if you look, he was also completely wrong there, but you will review and I believe it was entered as Exhibit Number—

MR. TOSTRUD: Is this the backup policy?

THE SPECIAL MASTER: Yes. If you turn to page number—I don't know. Just turn—and you will see they give you an example of whether is actually backed up and the time is actually included as well and the cycles and all of the details.

MR. TOSTRUD: Okay.

THE SPECIAL MASTER: Counsel, you wanted—

MS. WITTY: I think part of my confusion was with regard to archiving of e-mails, not necessarily backup of the system.

THE SPECIAL MASTER: But you don't actually—sorry.

MS. WITTY: There is no archiving system.

THE SPECIAL MASTER: Mr. Schaibley, he established earlier that there is no archiving platform at UMC currently. They are deploying or in the process of deploying I believe is it's called Simpana or CommVault they are in the process of doing that but at the time of question there was no archiving of e-mail.

But turning back to our original premise, which is, if the collection—so they collected these users like the executive assistants, I don't know if they collected all of them or not, but if they didn't collect them all, there is—which we'll all hopefully figure out by Monday can you get us that information as to whether or not you collected the executive assistant's that are for Doug Spring—

MR. SCHAIBLEY: Yes, I did. They were in the original 26, Claudette.

THE SPECIAL MASTER: We'll just double-check so that way we don't have any—so if there are custodians who didn't fall within that group, based on their backup policies as I read it then they weren't necessarily—the data might not be there today basically based on the way their backup system is set up, as I understand it, but I only got it a day and a half ago, so I was writing it out this morning.

MR. TOSTRUD: Are the policies that you put in place from this point forward?

THE SPECIAL MASTER: Thank you. So with regards to preservation going forward, he was also wrong. So thank you.

So as to preservation, the way the script was actually written wasn't at all as he described it. What happened is he ran Robocopy for everything in this person's profile, then they created on the server a separate stand-alone server that they still have today for each user this directory.

So the evidence still exists for each one of them. Does that make sense?

MR. TOSTRUD: Uh-huh.

MR. GODINO: (Nodded head up and down.)

THE SPECIAL MASTER: So the only issue we have and then to put it in context and again I apologize for—because I spent so much time with this and I apologize there was a huge oversight on my part. When we were having the conversation earlier on about the e-mail trimming with the e-mails themselves, the PST OST that had to be scanned and repaired. Remember that whole conversation earlier on?

*64 MR. GODINO: Yes.

THE SPECIAL MASTER: That was within the collection, and my point was if the collection for that information wasn't done or had problems, right, it might mean that the material isn't available anymore.

MR. GODINO: Right.

THE SPECIAL MASTER: You are going to get a copy of the error logs, which you have already been provided, which will detail out exactly what happened for each one of those. Does that make sense?

MR. GODINO: Yes.

THE SPECIAL MASTER: So you will have a chance to look at it and then on Monday we'll be able to speak about it if you have questions after you have had a chance to analyze the information. Does that make sentence?

MR. GODINO: Yes, sure.

THE SPECIAL MASTER: You will get the error logs. The error logs represent—so why don't you recap just one more time what you did for the e-mail.

MR. EDMONDSON: For the e-mail itself?

THE SPECIAL MASTER: Scan and repair.

MR. EDMONDSON: I ran the scan on all of the PST and OST files.

THE SPECIAL MASTER: All being everything that was collected for the five custodians.

MS. FOLEY: In August.

THE SPECIAL MASTER: In August.

MR. EDMONDSON: Correct.

THE SPECIAL MASTER: On August 24th?

MR. EDMONDSON: Yes.

THE SPECIAL MASTER: Just those, okay.

MR. EDMONDSON: Just those.

THE SPECIAL MASTER: And then what happened.

MR. EDMONDSON: And all of them generated log files during the repair process. Two of them could not be repaired and required that additional data be removed from them before they could be repaired correctly.

THE SPECIAL MASTER: And that project is called trimming.

Mr. Pixley, are you there?

MR. PIXLEY: No, I'm here.

THE SPECIAL MASTER: Mr. Pixley, did you get the log?

MR. PIXLEY: I did.

THE SPECIAL MASTER: So you'll be able to analyze that and if you have any issues or questions we can discuss it on Monday?

MR. PIXLEY: Yes.

THE SPECIAL MASTER: Good. The whole point is, what that details out, my concern and what I'm getting at is because it was the collection was done in a way that may or may not be forensically sound enough because of the number of errors in the log file, there could be an issue because there are no backup tapes as to whether the material is available.

MR. GODINO: Notwithstanding the preservation letters there is some material that may be gone.

THE SPECIAL MASTER: Yes, possibly, which is the whole scan and repair log files, which we're going to discuss on Monday once Mr. Pixley and you guys have had a chance to look at it, we can have a more cogent conversation as a group. Does that make sense?

MR. GODINO: Yes.

THE SPECIAL MASTER: Before I can have that conversation, I want to also have a conversation with their backup person, there BlackBerry server, because if they have the backup tapes, then at least if we know that it didn't work or there are issues, we have another source we can look at.

MR. GODINO: Right.

*65 THE SPECIAL MASTER: As a back-up if necessary. And if reasonable. It's a function of figuring out how much information, how much had to be trimmed, and what the whole—understanding what the data set looks like as a composite, and according to whatever your ESI experts determine, and then I will also weigh in at that point as well as to what would be appropriate or not.

My concern is, and I will let the record reflect this, is that there was a lot of trimming and it is a bit of—and trimming being as was just explained cutting the e-mail file down so it can be actually used and processed and ingested, and for some of the e-mails PST OST files. I haven't extensively reviewed the log files, which is some exciting work for the weekend, but that is a point of concern for me, but that is just the e-mail piece as I mentioned before, everything else is there, the Word documents, the Excel spreadsheets, the Word documents, the WordPerfect documents, the Lotus notes, you name it, they collected it.

MR. TOSTRUD: And all of that in addition to the e-mail will be part of the rolling production?

THE SPECIAL MASTER: Yes, of course. The rolling production for an individual custodian will represent the composite of their entire collection that at least for the six that I reviewed for the five that I reviewed from August and I assume that they will provide me the April and you'll remove or de duplicate whatever at the very least the duplicative files between the collections, right?

MR. EDMONDSON: I believe was that actually (inaudible)—(asked for clarification.)

THE SPECIAL MASTER: Off the record.

THE SPECIAL MASTER: Back on the record—off the record.

THE SPECIAL MASTER: Back on the record. In the custodian interviews you will receive hopefully before Monday there is repeated dialogue about iron mountain by all the custodians. What isn't clear to me is from a security and exchange and that perspective, who handles iron mountain within UMC?

MR. SCHAIBLEY: It does not come through the IT security department.

THE SPECIAL MASTER: Does it come through IT?

MR. SCHAIBLEY: I believe it does.

MS. WITTY: From my understanding, the backup tapes, so the individuals within the server team that participate in the backup go through iron mountain. The custodian—

THE SPECIAL MASTER: But that person will be here on Monday?

MS. WITTY: Yes. We'll have that information, yes.

THE SPECIAL MASTER: But we'll be able to call somebody on Monday?

MS. WITTY: Yes. The actual custodians that were interviewed don't send any electronic information other than Claudette—electronic information other than Claudette, who did the discs. The other files, the grievance files, those are all—

THE SPECIAL MASTER: Did any of the paper documents that they referenced were being stored there have any—it's good first that they are being preserved. Lets recognize that they are being preserved. The next questioning I obviously want to know is is there any—have you been able to discern what—since I couldn't tell from what you told me, if it had anything to do with—there's no date ranges, so I have no idea what dates they are storing data or files or paperwork from. I have no understanding of what—the scope of the paperwork they are actually storing there, if it's copies or originals or—so if you could kindly go back and inquire as to when they say that they are using iron mountain, say when or whether you are putting iron mountain because all I'm interesting in is—

*66 MS. WITTY: That that information was reviewed—

THE SPECIAL MASTER: That it was reviewed accordingly and that they are destroying the originals and you saw copies or vice versa or that it wasn't, but I need more than we sent it to iron mountain, for multiple reasons.

MR. TOSTRUD: For purposes of efficiency from plaintiffs standpoint I think it would be very helpful to know if schedules and things like that are stored at iron mountain—

THE SPECIAL MASTER: We'll go off the record really quick.

THE SPECIAL MASTER: So on the record really quickly, our objective and intent is by Monday that plaintiffs will be provided the custodian interviews, will have had the chance to look at them and review them, counsel for UMC will have a chance to circle the wagons to identify what was stored in iron mountain and how it was stored and give further parameters to that. If they are able to, on Monday, we will answer the questions that counsel for the plaintiff raise, which were specific to—what was the substance of what they were sticking in iron mountain and is that or has that been collected or reviewed by counsel for UMC and if it has just to clarify that.

So if necessary we'll come up with a list of questions and that will be presented to each of the custodians if necessary.

Furthermore, we are now talking about the amended stipulated ESI protocol and I wanted to discuss with the parties different pieces of this to understand now that I have a much firmer grasp of everything that's moving, I wanted to just touch on a couple of things.

The first being number 4, document image formats, it says, “The parties shall meet and confer to the extent reasonably necessary to facilitate the import and use of the produced materials,” which would be, hopefully, they will come in the rolling production, “with commercially available document management or litigation software such as Summation or Concordance.”

I was under the impression you were using something else. Is that—plaintiffs, am I wrong?

MR. FORREST: We're—our review platform is IConnect, but we are perfectly happy with the Concordance stat file.

THE SPECIAL MASTER: Okay. So you are—I just want to make sure—

MR. FORREST: Stat file, OST file.

THE SPECIAL MASTER: And you provided—let's be clear. You don't specify what fields you want for a Concordance file. You just say a “load” file.

MR. FORREST: I believe those fields are specified in paragraph 13.

THE SPECIAL MASTER: So everybody is okay with that? Yes?

MR. GODINO: Yes.

THE SPECIAL MASTER: I want to make sure because now that we've actually figured out what we're going to get to, the encryption hand the other pieces.

MR. FORREST: We would definitely prefer single-page tiffs. Here it says single or multi. Single would be our preference.

THE SPECIAL MASTER: There might be some give-and-take here.

MS. WITTY: We had previously discussed not doing tiffs as it's—

*67 THE SPECIAL MASTER: So this is my question: What if they just—are you wed to the tiffs?

MR. FORREST: Well, to the extent they are producing natives, I think we need a placeholder with a Bates stamp.

MS. WITTY: We have previously with the attempted production I'm not going to argue about on compliance, we had agreed to doing the placeholder image.

THE SPECIAL MASTER: Right, but it's not in here. That's why I'm talking to you about it now.

MS. WITTY: Right. That's what we are trying to iron out. There is no need for the tiff as long as there is a place holder, the native.

THE SPECIAL MASTER: That is fantastic, but that is not what you guys submitted to the judge. So what I need to happen is plaintiffs—

MR. FORREST: Amended.

THE SPECIAL MASTER: So what I do need to happen is that I do need you to change this so that we then have complete agreement about—and we will finalize the language on Monday but I would like you to adjust this so it is reflective of what is—

MR. FORREST: That's fine.

THE SPECIAL MASTER: Because that will also—takes me to my question—the next one, filename and conventions. Obviously that needs to be changed as well. Any thoughts?

MR. FORREST: I don't think we have Bates numbers that can't be included in the filename, and I think the convention looks all right. It's basically going to be for the first page.

THE SPECIAL MASTER: I think so too. So can you adjust that.

MR. FORREST: Yes.

THE SPECIAL MASTER: I'm just asking because we had a whole conversation last time when you guys submitted this and I was like maybe I missed—maybe you guys couldn't agree but I thought when we left everybody had agreed.

So then presentations, decks, spreadsheets, pictures and images, that needs to be adjusted as well because they are coming in native.

MR. FORREST: Everything is coming in native, is my understanding.

THE SPECIAL MASTER: Right. The only reason I'm asking is this is what was submitted to the Court. Go off the record for a second.

THE SPECIAL MASTER: Back on the record. Then obviously 7 A, part of 7 A should be adjusted.

MR. FORREST: Yes.

THE SPECIAL MASTER: Unless either party has an objection, speak up, please, and adjust it to reflect what we have agreed upon with the natives. This will also allow both sides to save some time and, more importantly, money.

With regards to the hard copy documents, I thought that was fine. Anybody have any issue with this? I don't know why you didn't want them OCR'ed.

MR. TOSTRUD: Can you give us just a second on that.

THE SPECIAL MASTER: I don't know if you guys are getting a lot of discovery. If you are, you should speak as well.

MS. WITTY: We would ask it be in the same form we produce it.

MR. FORREST: Everything should come with a text file and if it's hard copy it should be OST CR, if it's electronic it should be slack Ted.

*68 MR. GODINO: If defendants don't object, we can add the OCR.

THE SPECIAL MASTER: I'm writing it down.

MS. WITTY: That's not an issue, yes.

THE SPECIAL MASTER: I mean, if they are scanning it, they can just click another button and it's OCR, so ...

For color, I'll leave that as is.

MR. FORREST: It's superfluous at this point.

THE SPECIAL MASTER: I assumed there was some reason you left it in. If it's not, I would recommend removing it.

There is one thing I want to make clear. This protocol will apply to both parties now. Counsel, this is important. This protocol I'm going to request applies to both parties. So if you end up producing, you are going to have to provide OCR—

MR. GODINO: That's fine.

THE SPECIAL MASTER: Because if you are turning over information and receiving it—duplicates, this is a question that I have. This comes down to—this is really for plaintiffs. You need only to have produced a single copy of that document. I need to understand something. Does document mean e-mail too?

MR. FORREST: Well, it does go on and talk about multiple inconsistent electronic. Also on pages—on 16 to 17.

THE SPECIAL MASTER: I scratched those already, but yes.

MS. WITTY: Our druthers would be to de-duplicate on a custodian basis, and we actually came to an agreement earlier that's not reflected here, but this is an e-mail agreement as to what fields would be used for de-duplication of e-mail.

THE SPECIAL MASTER: That was not included—

MS. WITTY: Yes.

THE SPECIAL MASTER: But it wasn't included in this. So again I got confused.

So there is an e-mail that I read that you guys were agreeing as to how de duplication was going to happen. That is not in here.

MR. FORREST: That is correct on both counts.

THE SPECIAL MASTER: So plaintiff I'm going to look to you guys to make these changes.

Don't forget this is an FYI for number 12 to make sure the reference is right, paragraph 2.

MR. GODINO: Paragraphs.

THE SPECIAL MASTER: Yes. I didn't have any problem with the production media, the only question I have you say if the producing party encrypts or locks the production, I'm going to require now the scope—just to be clear, what they have collected is expensive and I would rather err on the side of caution and just have them provide you, unless there is any objection, put it on an encrypted disc and ship it that way because it is literally—either that or they are going to have to search it for—it's your call?

MR. FORREST: You mean they encrypt the production media?

THE SPECIAL MASTER: Yes.

MR. FORREST: That's fine.

THE SPECIAL MASTER: Because we're dealing with healthcare, better safe than sorry.

Do you have any objection to that?

MR. EDMONDSON: No.

THE SPECIAL MASTER: So then can you adjust the—so just be like all production will be done on encrypted discs unless both parties agree and concept in writing or something or you could say that might contain—however you want to phrase it. Just we'll go through—now metadata.

*69 MR. FORREST: I guess there should also be an LP T file.

THE SPECIAL MASTER: Do you have any—do you want to raise that again?

MR. FORREST: There should be an LP T file. I mean, it's going to be a fairly simple LP T file. There's only one image per ...

THE SPECIAL MASTER: Do you have any problem?

MR. FORREST: Producing an LP T file for the tiffs?

THE SPECIAL MASTER: Explain exactly what you want in the LP T.

MR. FORREST: We'll furnish it.

THE SPECIAL MASTER: He will furnish you the LP T how street that.

MR. EDMONDSON:

MR. FORREST: ECapture and crank it out it is a check box.

THE SPECIAL MASTER: We'll revisit—once plaintiffs give it to both side the amended protocol, we'll then review it again on Monday. I just got very confused, so I wanted to literally go through it with your guys, so that way—

Now metadata, anybody—the met data?

MR. FORREST: It should be the new order, yes.

THE SPECIAL MASTER: I see it all, but you are getting the native files; right? Like began attach, began doc.

MR. FORREST: If they're—those metadata fields were suggested by Mr. Edmondson, and we added a few more. They are going to extract them anyway.

THE SPECIAL MASTER: Oh, they are? Okay. Fantastic.

The search terms, can someone please provide me a list of search terms?

MS. WITTY: We can do that, include the initial terms.

THE SPECIAL MASTER: So that way we have the new list locked and we're good, and if you could, just attach it to the order so there is no confusion at all, but I want to notice that it is the first as plaintiff pointed out this is the—actually don't attach it to the order, now I think about it.

I want to make it clear, though, that these search terms are the first in your discussion with the other side and based on what the results are you will have further conversations.

MS. FOLEY: Once the results are reviewed, yes.

THE SPECIAL MASTER: Privilege logs are made and conversations are had. We're just trying to get there.

Okay. Databases, this is fantastic because I almost forgot about it. Microsoft access.

MS. FOLEY: Uh-huh.

THE SPECIAL MASTER: Mr. Schaibley, can you please tell me how Mike soft access is handled to the best as you know how. If you don't know, say you don't know and let counsel—

MR. SCHAIBLEY: To the best of my knowledge, we no longer utilize any access databases, we no longer support any access databases.

THE SPECIAL MASTER: Counsel, with Mike soft access?

MS. WITTY: Yes.

THE SPECIAL MASTER: Did you get any further clarification?

MS. WITTY: I did. James Mumford is the only custodian who mentioned Access. He has not used it similar as it's reported at UMC during the relevant time frame he literally said he hadn't used it in the past seven years.

THE SPECIAL MASTER: And the custodian interview someone mentioned they used MS Access.

MS. WITTY: He likes it.

THE SPECIAL MASTER: He likes it.

*70 MR. FORREST: Well, that's one person.

THE SPECIAL MASTER: Getting past personal biases.

(RECESS TAKEN 3:10 P.M. TO 3:18 P.M.)

THE SPECIAL MASTER: Back on the record. Databases, I understand the databases. This takes me to my—when we finish this, I'm going to ask UMC to provide a list of all the file types because there is a litany of file types that you may not even be interested in getting hits on, like DOL believe it or not might also trigger on a lot of nonresponsive stuff given what a lot of people are looking at on the websites. You can be surprised. You never know what words are embedded, like American Idol, I-d-o-l. So you just don't think about it and then all of a sudden you are reading like 15,000 American idol webpages because you asked for DOL. So, you know, it's—

On Monday I want a list of all the file types provided and we're going to enter it as an exhibit as well, so print a copy. So that way you understand when you are going to get a custodian these are all the different file types that sit within that universe.

So and then that will sort of take care of the database thing because you will see the—there is not really that many database applications or files.

So unless anybody has any comments for database or wants to and it at all? Plaintiff, are you okay with it?

MR. FORREST: With some—

THE SPECIAL MASTER: Speak now or forever hold your piece. What part? Is it okay?

MR. FORREST: I'm not crazy about it. I think what they are doing with Kronos, if they could produce an adequate report in electronic format that's fine. To the extent they can't.

MR. GODINO: I think we've already litigated that issue. This would have applied to Kronos.

THE SPECIAL MASTER: That was my whole question. You are going to get a list of all the file types. Let's assume none of them are Kronos. According to this you get the entire database or report.

So when you get the list of file types, if you can also please identify the applications, I think it does it for you automatically, I think it does.

MR. FORREST: Some of them.

THE SPECIAL MASTER: Some of them. At least enough that you can Google the rest if you need to. We'll talk about it on Monday. I want you to look at it.

MR. FORREST: We're not going to have gone through that by Monday.

THE SPECIAL MASTER: You won't get it until Monday. You can think about do I really want the whole database.

MR. FORREST: Normally I'm happy with an extract, depending upon how it can be normalized and so forth.

THE SPECIAL MASTER: For databases why don't you put a question mark staying to be determined on Monday.

MR. FORREST: Meets and confer.

THE SPECIAL MASTER: We're not going to meet and confer. We're going to have a conversation on Monday and make some decisions. If not we will have a phone conference, because I don't think UMC, they are going to evaluate the cost benefit ratio for their client as well.

Production of other electronic documents, it says you guys are going to meet and confer to agree on the form of any production of electronic documents other than the foregoing, which are databases, e-mails, word-processing documents, spreadsheets, presentations, image documents, and construction documents. I don't know how construction has to do with it, but I'll leave it in.

*71 Is there other documents that might—like filings maybe, electronic filings that are done? Records?

MR. FORREST: PDF should probably be in there.

THE SPECIAL MASTER: You would think. But I don't know. Do you want to meet and confer about each file type or do you want to add more file—because right now—

MR. FORREST: I mean, since everything is being produced as native, I think—

THE SPECIAL MASTER: I thought it was a moot point.

MS. WITTY: Yes.

MR. FORREST: Yes, I agree. I mean, the only conceivable thing I can think about if it's not precisely covered here, it's some form of native data or aggregated data this you cannot in fact read without—

THE SPECIAL MASTER: The reader.

MR. FORREST: Without the original application.

THE SPECIAL MASTER: So that might be the only situation you would want to address rather than all the other things, and I think it saves both sides money and time.

Okay. Acceptance of the protocol, I don't have any problem with that.

Redaction, I assume you guys covered how you want it.

Use of documents, “extract detection not be used in any proceeding as a substitute for the image of any document.” Since we're doing native, is that an issue?

MR. FORREST: Well, I think, with the exception of impeachment material and cross-examination material, probably would be furnished as Bates stamped tiffs, right.

THE SPECIAL MASTER: Yes, but you would then produce them and enter them into evidence.

MR. FORREST: Enter the tiffs into evidence?

THE SPECIAL MASTER: Yes, you would do that in court, you would make a motion to the Court and provide it to the Court. They are not going to object to you turning over paper documents to the judge. Maybe they would, but the judge would say that's fine. Give it to me on a memory stick? And the judge will be like I don't have a USB reader on my computer, and the jury won't be able to see it, so I'll take it as a paper document, and the judge will be, oh, that's a great idea, and then everybody will be happy.

But I agree, you should put it in just to be safe.

Privilege logs, I assume you guys had a conversation about privilege logs. Is that an accurate assumption.

MR. GODINO: Yes. I mean, we've been having ongoing discussions.

MR. TOSTRUD: We've met and conferred and we have an amended privilege log already.

THE SPECIAL MASTER: But as this production starts going, I need to know that you guys have some mechanism upon which a privilege log is being created request sufficient data from both sides that's not too unwieldy or burdensome and sufficiently substantive for you to make a motion if necessary.

MR. TOSTRUD: If not there already we're very close to reaching an agreement on that. Is that fair?

MS. WITTY: Yes.

THE SPECIAL MASTER: It would be good if we got across the finish line by Monday or Tuesday, at least before the production starts.

Cost service, I don't have any problems with the rest of it. I didn't know if anybody has any issues, please let me know.

*72 MR. FORREST: You mentioned Tuesday. Are you contemplating Monday may run over?

THE SPECIAL MASTER: We seem to be a pretty good power group. We seem to have made decent progress. I'm thinking after Monday there will be enough work that we will meet again in a week and a half. My goal is that first production. Off the record.

THE SPECIAL MASTER: On the record. I do commend counsel from both sides for both being cooperative and moving the ball forward which is actually good and nice. I'm not used to such civility. So it's a pleasant change. I know that might sound odd, but it is true.

The next thing that I wanted to touch upon now we've gone through this is I want to make sure we will crystal-clear—and I want to make sure that you work here with Mr. Schaibley that you include the April and August file types. Are we clear? Because all I've seen is the August? You understand?

MR. EDMONDSON: I'll make sure that's what's on—

THE SPECIAL MASTER: And I will get the text files for the collection from April for myself. And what that allows me to do is validate everything that's coming through. Okay? Any questions there? Either side? Okay.

Mr. Pixley, do you have any questions?

MR. PIXLEY: No.

THE SPECIAL MASTER: Moving to what is the last group of questions that I have, this is mainly for Mr. Schaibley, are there any third party services that UMC uses to store documents or access documents or provide services that UMC doesn't store or control themselves at the time period in question.

MR. SCHAIBLEY: I don't believe so, no.

THE SPECIAL MASTER: Are you the person responsible for these? Would you be the person responsible or are there other people within the organization as well?

MR. SCHAIBLEY: To my knowledge, we don't have any. If we did have any, it would come through the security team.

THE SPECIAL MASTER: I would assume that you would have to approve them?

MR. SCHAIBLEY: Uh-huh.

THE SPECIAL MASTER: Okay.

To be clear, you do not allow Dropbox?

MR. SCHAIBLEY: No.

THE SPECIAL MASTER: You should then redo custodian interviews.

MR. SCHAIBLEY: Awesome.

THE SPECIAL MASTER: Counsel, you will make the BlackBerry person either available on the phone or in person?

MS. WITTY: Uh-huh.

THE SPECIAL MASTER: Can an UMC user save their documents to a local user computer outside of their profile?

MR. SCHAIBLEY: Not outside of their profile, no. They would be under their—the desktop.

THE SPECIAL MASTER: So if I log in and I go to “save as” I select “C colon/,” can I do that?

MR. SCHAIBLEY: During the time frame in question, it may have been possible.

THE SPECIAL MASTER: But it was not the practice or—

MR. SCHAIBLEY: Correct; correct. By default, whenever it opens up it goes to My Documents, and the My Documents will—is auto redirected to their home folder on a faster.

THE SPECIAL MASTER: Do you have this policy written anywhere so I could read it and understand it? Because when I read the custodian interviews and your collection script, sometimes I get a little confused. So if you have how it works or how it was working, that would be very helpful.

*73 MR. SCHAIBLEY: Yes.

THE SPECIAL MASTER: So, as we mentioned before, the collection was fairly large and broad, and I'm just verifying right now that the way a user logged in to to use their computer, it wasn't that it automatically defaulted to save to the local drive, but it defaulted to save to the network file server or whatever. So that basically they couldn't store data on their local computer that wasn't being collected. Is that clear?

MR. GODINO: Uh-huh.

THE SPECIAL MASTER: So that was the purpose of the questioning.

Counsel, with regard to Mr. Mumford and his use of personal texting—

MS. WITTY: Yes.

THE SPECIAL MASTER: I'm a little perplexed as to—I know we've established that there was wiping, they call it pushing a new image, but effectively deletion of everything that was there before. Did that also wipe his text messages that he sent to his wife?

MS. WITTY: He—

THE SPECIAL MASTER: Because I got a little confused when I read over how he handled text messages. Any light you could shed there?

MS. WITTY: I don't believe that the something out would have deleted the text messages. But he stated that he personally deleted his wife's text messages.

THE SPECIAL MASTER: Which is what led me to the question of besides why he was deleting them is that if it was being wiped, hopefully the BlackBerry person if you can just let them know this is something I'm going to want to understand in detail and if you could bring additional materials or exhibits to clarify these things or policies or anything, even of a technical nature, it would be very useful, because multiple custodians indicated that they used text infrequently but if they were wiping or how it was stored and pushed, and based on what was provided I wasn't really able to discern outside of what was imaged, and please also provide Mr. Brannman his first mobile device, the first smart phone to—for imaging and inclusion as a—if it was used during that time period, which I believe it was, and include that in your—and I'd like that by next—next week is getting a little busy—how about the week after Monday? The result. That means I want it imaged and I want the messages pulled and also returning back to the mobile devices, were there any e-mail messages on the mobile devices when you looked at them?

MR. EDMONDSON: I would want to double-check but I am fairly certain there were.

THE SPECIAL MASTER: Can you get me the date ranges.

MR. EDMONDSON: Yes.

THE SPECIAL MASTER: You can tell the BlackBerry person that's coming I'm going to want to know what's synched and how it's synched, push-pull, how it works.

Is there anything you want to add, plaintiff?

MR. FORREST: Just wondered between the interaction between that—

THE SPECIAL MASTER: How about mobile? They are going to image it, look at the text messages for his other mobile device. Is there anything that you believe you would like to see included on his first mobile phone that's yet to be imaged.

*74 MR. FORREST: Bruce.

MR. PIXLEY: Yes, I couldn't hear the question.

THE SPECIAL MASTER: The question was, we're going to image—actually it won't happen till next week so if plaintiff will just write it down I can ask Mr. Pixley on Monday when he's here.

MR. TOSTRUD: Are we referring to Mr. Brannman's first phone?

THE SPECIAL MASTER: Yes. The image, the second phone.

You imaged the second phone; is that correct.

MR. EDMONDSON: Yes.

THE SPECIAL MASTER: They didn't image the first phone.

MR. TOSTRUD: Okay.

THE SPECIAL MASTER: And when the BlackBerry person comes he'll explain if there is each anything on it, but we'll image it anyway because maybe that's fragments and we'll re-touch on this with Mr. Pixley here on Monday quickly just to make sure.

Now, with regards to Mr. Spring, Mr. Schaibley I have a question for you:

In his custodian interview he references he had two computers. I've got really confused as to how—the way I read it was terminal, but I don't know. So I was hoping you could clear up what constitutes a computer device for a custodian at UMC to start.

MR. SCHAIBLEY: Depending on their job—

THE SPECIAL MASTER: I'm taking about Mr. Spring.

MR. SCHAIBLEY: As far as Mr. Spring, he would have a computer sitting at his desk in his office.

THE SPECIAL MASTER: And that would be his computer?

MR. SCHAIBLEY: That would be his computer that he uses. It's an UMC-issued computer assigned to him that he uses.

Because human resources has two different offices, we've get human resources in one building and human resources in a separate building, he would have an office in both locations, so he would need a computer in both locations.

THE SPECIAL MASTER: And your collection included both locations?

MR. SCHAIBLEY: Yes.

THE SPECIAL MASTER: And you will put in the chain of custody which ones they are?

MR. SCHAIBLEY: Yes.

THE SPECIAL MASTER: So that was also collected, both—

Now what about the profiles at the terminals? Someone mentioned that you have terminals, dummy terminals, Doug Spring referenced dummy terminals. Do you have dummy terminals?

MR. SCHAIBLEY: I'm not sure why he would use the term “dummy” terminal.

THE SPECIAL MASTER: But dummy terminal in technical terms means a very—

MR. SCHAIBLEY: We have Dropbox and Workstations on Wheels, which is basically a computer that's attached to a cart that can be rolled in from one hospital room to another and around on the floor. Those terminals are used with a kiosk account which is an individual account.

THE SPECIAL MASTER: Is it separate from their user account?

MR. SCHAIBLEY: Yes, it's not a computer that they log into. This is a computer that's already logged into and sitting on the desktop.

THE SPECIAL MASTER: Just so I understand, they have a user account, Doug Spring logs into the computer; that's his desktop. Does he have a different log-in password for the other device?

*75 MR. SCHAIBLEY: No, there is no login for that device. It is already logged into a domain account. The end-user does not actually have a password that they put into it. When they get on that machine at that time when they would log in would be when they are logging into our Citrix environment.

THE SPECIAL MASTER: Because when he described it, I got a little confused. As I understand it, it is a free-floating station that I can bring up Citrix and log into my own terminal?

MR. SCHAIBLEY: Correct. He would use his own log in and the password at Citrix, not on the machines.

THE SPECIAL MASTER: Right, not on the dummy terminal?

MR. SCHAIBLEY: Correct. The machine is already logged into—

THE SPECIAL MASTER: I've got it. So it's not a dummy terminal. It's a computer where he was able to use Citrix to access his user profile and account.

MR. SCHAIBLEY: Yes.

THE SPECIAL MASTER: Can you make sure and include that clarification and question in the custodian interview?

MS. WITTY: Yes.

THE SPECIAL MASTER: What's SEIU? Just everybody said several times.

MR. TOSTRUD: Service Employees International Union.

THE SPECIAL MASTER: Now, mobile storage, that's another concept that I spoke with counsel—do you allow mobile storage?

MR. SCHAIBLEY: What do you mean by mobile storage?

THE SPECIAL MASTER: “ So Mr.—it says UMC does not allow personal mobile storage.” Does that mean on your mobile device?

MR. SCHAIBLEY: To me, that would be referencing one of two things, either referencing your personal mobile phone or referencing your personal thumb drive.

THE SPECIAL MASTER: Thumb drive?

A. Yes.

THE SPECIAL MASTER: Does each one of UMC employees have?

A. No, we do not allow personal USB sticks. If an individual user requires having a mobile USB stick they can request one from IT security, or an iron key.

THE SPECIAL MASTER: Was that included in the collection?

A. It was not, because none of the custodians had an iron key other than one, and the user who had an iron key in the initial, he accessed it the day it was given to him when he said his password and has not accessed it since then.

THE SPECIAL MASTER: We'll just work with counsel to make sure that if necessary that you preserve it accordingly because I don't have any details as to who the custodian is or anything. So I just ask that counsel works with you by next Friday to make sure that whatever—I want you to physical ill verify this list, Counsel, that you look at what has been granted and what is in our custodian list and if there is duplicate or if there are such individuals, that you inquire further and just make as was just explained because we've added more people. Okay? Any questions there?

MS. WITTY: No.

THE SPECIAL MASTER: Plaintiff, any questions?

MR. TOSTRUD: (Shakes head side to side.)

THE SPECIAL MASTER: Intranet, when you see the custodian interviews, I apologize, see them now but—can you explain to me what is your intranet.

*76 A. It is our internal website.

THE SPECIAL MASTER: Is it possible to store and load documents?

A. No, not for our users. We do provide on the intranet, it's general information for our users, our policies and procedures are accessible from this.

THE SPECIAL MASTER: What about messages to employees?

A. We utilize it only as a notification period for current and ongoing issues with the medical record system.

THE SPECIAL MASTER: Counsel for UMC, I just need you to verify that you reviewed the intranet to make sure it doesn't contain any responsive information or relevant information to what is at issue here? For example, I could see that it could be used as a way—is the mailing list tied to that at all?

A. No.

THE SPECIAL MASTER: So just double-check what data is there and verify.

MR. TOSTRUD: I do believe that policies and procedures that are available on the intranet are definitely responsive to our recognizes and our RFPs.

THE SPECIAL MASTER: Practice policies and procedures.

MR. TOSTRUD: Timekeeping policies and procedures, orientations for new employees.

THE SPECIAL MASTER: Can you bulletin that out for me?

MR. TOSTRUD: Sure.

THE SPECIAL MASTER: I see that counsel for UMC will also make—because one of the issues is when I read over what's on the intranet, I wasn't actually based on the description that was provided to me to actually able to figure out what they were actually using it for, so before I go and spend the time looking at their intranet myself, if you are storing such policies on there, I'd like a full list of them and I'd like to—we can then—

MR. TOSTRUD: We'll bullet point those for you.

THE SPECIAL MASTER: I do agree with plaintiff from my perspective that it would seem that the intranet would logically be the place to store a large number of policies that people do or do not read and the versions of those policies and they may or may not be relevant. So I'm going to also to encourage you that you talk to the webmaster of the intranet to see if they have an archive of the policies. What's the infrastructure for the intranet? Is it an I SS?

A. Yes.

THE SPECIAL MASTER: It has built-in archiving capabilities?

A. I'm fairly certain the archiving backup is running on it.

THE SPECIAL MASTER: Just double-check for the relevant time periods and see if you can look at what it was there just to make sure.

This is for my own edification. I'm a little confused as to how these mobile phones, especially in 2013, ended up being wiped. I'd like you to make an inquiry within UMC, giving the litigational letters that I read, which were multiple copies of the same one, actually, attached to different briefs, I would look further clarification and explanation as to how at least for the key custodians how that message—how is such a communication failure break down after two letters had been sent and you have gone into court on multiple occasions attaching these letters that the IT people weren't actually—I'd like to understand where the breakdown happened to see from UMC's side where that actually did or did not occur.

*77 Are there any third party consultants that you worked with were involved in the collection, the physical collection, not the forensics, I'm talking about the on-site collection?

A. No.

THE SPECIAL MASTER: Your efforts to collect the data.

A. No, it was just myself.

THE SPECIAL MASTER: I'd like to get the formal configuration policies for your exchange server particularly because Mr. Espinoza says that—are there default Outlook settings?

A. What do you mean Outlook settings?

THE SPECIAL MASTER: You said only folders within the inbox have default Outlook settings? I don't even really care what he said. What I really understand is, when I log into Outlook, how is your mailbox configured, how does it actually work? I log into my computer. I assume that synchs all the way through. So then I open up Outlook. Can you walk me through that point.

A. Well, you open up Outlook for the first time—and I'm referring to how it worked in 2003 during this time period—I'm sorry 2012 during this time period, on the 2003 exchange, when you open Outlook for the first time, it will automatically take your credentials from windows and—

THE SPECIAL MASTER: Store them.

A.—configure your Outlook client directly for you. By default, when Outlook configures, it will creat your internal OST file based on your profile on the local drive.

Whenever a user is setting up their archive, they typically go through the desktop support and desktop support will walk them through creating a PST archive and the policy was for the desktop individuals to have them create their PST drives on the home drive and not on the local C drive, on your local profile, which is where it defaults. Some individuals still end up creating it under their profile because they didn't create the instruction correctly and didn't go through the help desk to get it set up—

THE SPECIAL MASTER: So then it won't sync for them?

A. No, it still syncs. It's just for that reason is why we make sure when we do data pulls that we go through and find whatever computers they have locally logged into and we have added their local profile from those computers so we can make sure we recover any local PSTs that were stored there, but as far as the folder structure and everything like that, the very first time that they log in, it creates just one individual folder of the inbox, the sent folder, the default things there. Anything beyond that that they create, the very first time it stores that into their mailbox on the server.

So if user signs into computer A for the very first time in Outlook, creates 10 folders beneath their inbox, and then they end up going and signing into computer B, create, open Outlook for the first time. It will automatically pull down their mailbox based off of whatever structure they had from computer A.

THE SPECIAL MASTER: That happens with the Citrix too. So they are caching it?

A. Yes.

THE SPECIAL MASTER: So when you ran your collection script—and just for purposes of the record I'm referring to the collection that UMC actually did, not the erroneous one that was represented in the last hearing but the actual one that was done. When that script is run, that would explain why then for some custodians 20 plus OST files because obviously they have several computers they are sitting at?

*78 A. Correct.

THE SPECIAL MASTER: And that 22 also then explain why there was over 500 or 1,000–plus PST OST files. For the record for the five custodians I looked at I came up with over 70 or 80 different PST OST files, because the way their scripts run, if you log into a local computer on your profile, it automatically creates a local OST, and he will log in and look at it, when you do the collection.

A. That's correct. And for that reason, that's why we have a policy in place and direct users to store their PST archives on their home folder, so that way, no matter what computer they log into, they have access to the same PST files and they are not creating duplicates and multiples.

THE SPECIAL MASTER: Right, so anytime I lot in somewheres on the file share rather than the local device, the archive will work.

A. Correct.

THE SPECIAL MASTER: Okay. And in the case of Mr. Espinoza, he didn't have any archives. Is that normal? I believe he was two two. Was that the two two?

MR. EDMONDSON: Yes, that's the two two.

THE SPECIAL MASTER: He had no archive. He had no PST or OST files on the August—unless in the April there was an archive, I didn't see one. Based on what you are telling me, there would be an automatic default of an archive created.

A. No, it does not automatically create a PST archive. That is a step that you have to take individually.

THE SPECIAL MASTER: Did he have unlimited storage?

A. He did not. At the time he was on 600 megabyte storage limit.

THE SPECIAL MASTER: I'm just thinking—just reviewing everything that was said ...

When someone writes an e-mail message on their BlackBerry and it's stored in their sent folder but let's say that it's not stored on the local profile, so Mr. Espinoza wrote a message on his BlackBerry, he wrote his e-mail message and given that it was wiped, whatever day it was that e-mail message doesn't exist anywhere if you deleted it out of the sent folder, right? It wouldn't be in the sent folder, so where would it—

A. With regard to the BlackBerries I do not recall if it would go into the sent folder or not with the way the BlackBerry server syncs with the exchange server.

THE SPECIAL MASTER: Because on January 20th, he got—8530 was updated, and based on the way you are describing the e-mail system, if I extend an e-mail to somebody from my BlackBerry, where does it sit?

A. Where does the—

THE SPECIAL MASTER: Mr. Espinoza wrote me an e-mail saying Daniel you're doing a fantastic job, hypothetically speaking, thank you very much, I like you a lot, you're my best friend and I wrote him back you are my BFF too, okay? Hypothetical. Where would that sit within UMC's environment.

A. Well, it would sit in—

THE SPECIAL MASTER: Message 1 and message 2? A. Message 2 would sit in his inbox which still has message 1 attached to it. The original message 1, it would sit in his sent folders definitely on his BlackBerry and I do not have an answer for if that would actually sit in the sent folder on his mailbox as well.

*79 THE SPECIAL MASTER: We are going to have to quickly figure that part out.

So then add to the search term BlackBerry—how does it go for BlackBerry? This message was sent—who—anybody remember back in—off the record.

THE SPECIAL MASTER: Back on the record. I want to record we are adding several search terms. One will be—plaintiff is going to provide a list of the different linguistic lingua franca of the mobile messaging that we will then—it's not approved yet, but I want to look at it, and then what we've agreed ask that if it's a reasonable hit response within that meaning under let's say 500 responsive hits—not hits, files, 500 files, not hits, and people understand the difference between a hit and a file, a file can have 100 hits, right, you know when your parents used to make you swear I will not swear, I will not swear, you could have 100 hits on I will not swear in one file. So we'll keep it at 500 files. And if it's over 500 files, we'll sample it and I'll log in remotely and look at it and I'm sample—and if more than 50 percent are responsive then we'll go through the whole exercise of producing otherwise we will refine the search. Is that okay? Because what I didn't want to do is end up spending hours at looking at the new iPad case.

MR. GODINO: Right.

THE SPECIAL MASTER: So I just want to add the right colon or by or whatever it may be just to limit it. I don't want to ignore it as well. So we'll try it in this fashion. Is that acceptable to plaintiffs?

MR. TOSTRUD: Yes.

THE SPECIAL MASTER: UMC, is that acceptable?

MS. WITTY: Yes.

THE SPECIAL MASTER: Let the record reflect both parties agree.

Okay. So now we've cleared those hurdles, the last thing that I have a question about, Mr. Espinoza again. He printed a weekly calendar.

MS. WITTY: Yes.

THE SPECIAL MASTER: What happened to it? Because he says he has a weekly calendar printed for him.

MS. WITTY: Yes.

THE SPECIAL MASTER: And it's a duplicate of Outlook and it's discarded weekly.

MS. WITTY: Yes, it's shredded at the end of every week.

THE SPECIAL MASTER: I just want to make sure I understood that. On Monday he comes to the office, it's printed out, at the end of the week it's gone.

MR. TOSTRUD: Is this in the custodian interviews?

THE SPECIAL MASTER: Yes.

MR. TOSTRUD: Is he currently shredding these or has he been?

MS. WITTY: Yes.

THE SPECIAL MASTER: He is? Let me go—make this very, very simple. If he is actively currently shredding his schedules.

MR. TOSTRUD: I just want to confirm we're on the record here?

THE SPECIAL MASTER: We're on the record.

MS. WITTY: Let me clarify. I'm not certain that's what was understood. I will clarify and make sure that we know exactly what is happening.

THE SPECIAL MASTER: I just want to know because I thought it was—I just want to know—because the reason I ask is that the calendaring, he says it's a duplicate of Outlook. So if that's the case, fantastic, but because of his executive assistant and the way that she can use his calendar as well—

*80 MS. WITTY: Right, she's the one printing it out for him.

THE SPECIAL MASTER: I need to figure out is she printing out his calendar or her calendar on her—theoretically she could be printing up her version of his calendar and giving it to him, and he doesn't know. Right? She could have a view—some executive assistants, they have their boss's calendar fully available to them, and then they have their calendar, and all they are doing is printing out their boss's calendar, because their boss doesn't know how to print their calendar; right, but there's nothing actually changing in it. Other times they are adding and working on the boss's calendar and the printed schedule is of relevance and of value.

MR. GODINO: Of course, that calendar could contain his notes, the printed calendar, so differently, obviously—

THE SPECIAL MASTER: I just need to understand what and how the print calendar—like just ask him what—and if he is actively, I would encourage him, that you advise him to cease until we resolve—I don't think it matters at this stage. How does shredding today have any responsive information on it?

MS. FOLEY: The time period is over for the opt-ins.

THE SPECIAL MASTER: The way I read it, is there still an ongoing need to preserve his calendar?

MR. TOSTRUD: Yes, absolutely.

MS. FOLEY: What is that—

THE SPECIAL MASTER: It's Friday and I'm happy to entertain the argument, but on Monday. So what I'm going to encourage you to do is tell him on Monday morning don't—today, tell him don't shred your schedule from this week, if you've been shredding it. Maybe we misread the whole thing. And on Monday we'll work our way through it, because I'm equally—I want to hear from both sides, but I'm not ready to jump into that at this moment. I'm going to order just for the moment make sure that it's not being shredded until at least we have a hearing on Monday morning if it is indeed being shredded.

MS. FOLEY: And we'll check with him.

THE SPECIAL MASTER: It might not be being shredded. Get the clarification. It is please stop and I'll hear further about it. When you have the chance to read the custodian interviews I'm sure on Monday we'll have a litany of other issues to dialogue about at length.

One other reason why I didn't have them circulated so I could have my questions answered first. Not that I don't appreciate your interaction and contribution.

The other person obviously for the DOL on piece that would be relevant is Claudette Myers and her device, and so you might want to revisit that because in her custodian interview she indicates that she was assisting both—I'm going to show it to counsel because she's going to clean it up for you, and if it's not in there, then I will—on Monday we can discuss it. I just want to point something out to you. Go off the record for a second.

THE SPECIAL MASTER: On the record. And this is for Mr. Schaibley. I had a general question. When you have scanners and copiers and all of these other—do you have a document management system?

*81 A. No.

THE SPECIAL MASTER: Okay. How do people actually—how does it work, then?

A. Well, are you—I'm just trying to understand the scope of your question. As far as—

THE SPECIAL MASTER: We asked them what do you use in your daily course of business to do your work, what systems do you use, and I found it a little odd given the size of your organization that nobody actually—there is no document management, there is no standard header, footer, there is no document controls for like—like I asked one of the questions we asked was—maybe this will shed some light, so John Espinoza, he's involved in HR; right?

A. Yes.

THE SPECIAL MASTER: And we discussed him what systems does he use on a daily basis, and he didn't mention a single document management system. I'm not saying that he's wrong, but he might not know that he's using, is what I'm saying. I'm not saying that—from his perspective, he might be just opening Microsoft Word, but you might have a back-end document management system, and all I want to make sure is that your script, when it ran, hit those documents. If there is. If there is not—I just found it a bid odd the guy that's running all of HR doesn't have a standard template—

MR. SCHAIBLEY: We have—

THE SPECIAL MASTER:—system.

A. We have a central file server, UMC–FS01.

THE SPECIAL MASTER: So I read that as your—what I couldn't figure out, is there a document management letter in there, or is it? Are there folders?

A. There is a folder structure, yes. That is—that file server is where the home folders are stored under a shared comp home, h-o-m-e, and each individual user has their local, not local, but their home folder underneath that share. We have an additional share called shared.

THE SPECIAL MASTER: My question is, when you run your script, does it pull from—do you get all of the shared files? Because one other question I have for you about your script, this is probably one of the last questions for the day and I'll separate and talk to both sides.

One thing I couldn't figure out, if user permissions give me access to, let's say, shared HR folders—

A. Yes.

THE SPECIAL MASTER: The script, when I looked at the script, it didn't pull from any of the—I don't know, which is why I'm asking you—any of the shared work like HR—

A. Correct, it did not pull from there.

THE SPECIAL MASTER: I need you to immediately make sure that you are preserving from there and a copy is made.

A. Okay.

THE SPECIAL MASTER: Obviously—and then I need you to look at their user permissions, and whatever they do touch, obviously, for the six custodians to include that in the ambit of what to search—to be clear to UMC's counsel, what I'm referring to is when I read the script—and the script is very thorough and it is much better than what your other colleague made, but that still doesn't—there are still several large issues with it, and one of the big issues I have is that I assume there are file servers just like at a law firm they have like shared files, etc., but none of those were copied, and so—or collected. And so I need that to happen immediately.

*82 A. Okay.

THE SPECIAL MASTER: And just run the same script, copy it over, Robocopy them over, and look at the user permissions and Robocopy it over.

MR. SCHAIBLEY: Yes.

THE SPECIAL MASTER: And then chain of custody, and then give it to our colleague there.

MS. WITTY: You are asking to include anything that might be within the files and have access to?

THE SPECIAL MASTER: Yes, he took literally—what I assume when you collected is you collect everything that is responsive or could be—a source where they are holding that information. I would assume the shared HR folders and the shared accounting folders and the shared other directory structures that exist, that they have—are members of like—let's go off the record.

THE SPECIAL MASTER: Back on the record.

Just for purposes of clarity, I'm asking UMC to go identify each users, what they had access to in a network file share environment, specifically UMC–FS 01 and I think there are several other file servers.

A. It's just the one.

THE SPECIAL MASTER: Just the one. Whatever ones may or may not that they have access to. I mean, your user profile will say this person has permissions to these network file-sharings. Whichever file, whatever server is there, I need a list generated, I need you to provide it to counsel, I need counsel for UMC to look at it say okay this is responsive and we need to—I want to see it. I want counsel for UMC to see it. I need them to look at it and say this is responsive, this is not responsive for whatever the network file shares are. Once that is done, I want a chain of custody declaration added to it to document what you collected; right? And that is if there are such network file share sorts of operations. Are we clear?

A. Yes.

THE SPECIAL MASTER: So if you have a shared folder for HR, a shared folder for payroll, a shared folder for whatever that these key custodians have access to, I want counsel to know what they were, I want them to know what was in it, and I want them to make a decision, and I want to be provided with the same information. Okay?

Any questions, counsel for UMC? Any questions, plaintiff? Okay.

I think that's all we're going to get through today because the next set of the effort is a little bit more detail oriented and I would like Mr. Pixley and the plaintiffs to digest the scan and repair issues and the too things that were covered before I take the time to discuss them with the parties. So I have nothing further to add.

MR. TOSTRUD: You asked us to just make sure a couple of things were covered by the end of the day.

THE SPECIAL MASTER: Yes.

MR. TOSTRUD: The first one was to set the schedule for production, and I think you covered that about a half-hour ago where early next week we'll set—

THE SPECIAL MASTER: On Monday we will set a production schedule. So that means over the weekend you need to figure out how long it's going to take. I need answers to the encryption. I need answers to the scan repair PST and I need answers—I think whatever the other issues were.

*83 MR. TOSTRUD: The second issue you asked us to make sure was covered was a major cut in e-mail files.

THE SPECIAL MASTER: Monday Mr. Pixley we're going to have.

MR. TOSTRUD: Can I preview one issue for Monday?

THE SPECIAL MASTER: I have finished my need to discuss things with you about the custodian interviews.

MR. TOSTRUD: This case revolves around UMC policies and practices at UMC. UMC which is about five minutes from here is sort of centrally located on one campus, but there are multiple so-called quick cares that are around the city, around Clark County, it's my understanding, approximately a dozen, and I don't know how that IT system is set up or whether that's been searched or its different.

THE SPECIAL MASTER: What would be on those systems, from your perspective?

MR. TOSTRUD: Well, from our perspective—and we have people who joined our case from many of those different quick-care facilities. I believe there are computers at those facilities—

THE SPECIAL MASTER: There are definitely computers at the facilities. What is on them? Are you looking—from your perspective what data would they have there? Would it be their time records? What is specifically at the facility that you think—because what—I think you are right, but I want to know specifically what you believe would be stored locally at the facilities, and then we have a conversation with UMC's IT department to make sure it is stored locally, we get it, and if it's not stored locally that—because the way I understood it, that everything is set up through network file server, but they don't have an enterprise architecture diagram, so one of the very exciting things we will do on Monday is we are going to make an enterprise architecture diagram so we can make sure that we have covered the systems, because I don't actually—I'm fully aware—

MR. TOSTRUD: So I know there are timekeeping practices that are kept there, orientation and—orientation manuals, policies and procedures, I think some clients have drafted grievances that may exist on those terminals, scheduling.

THE SPECIAL MASTER: Why don't you come up with a bullet list. You don't have to share it. We can preview it and have a live conversation.

MR. TOSTRUD: That's fine.

THE SPECIAL MASTER: So I can come up—and share with co-counsel, so we can—I want to understand. One thing that will be covered on Monday just for counsel for UMC, is that one thing—the only other thing that I can't quite figure out is I get how what was collected, but because there is no diagrams and it's not a reflection of counsel here, okay, but because there is literally—can I call him Mr. Schaibley, that it's no reflection upon him, but frankly there is no documentation as to this is how it works for a satellite office and this is what systems are stored here. So that inherently is—besides taking way more hours than what I estimated, it's going to inherently require us to identify and understand how it works. So if UMC, Mr. Schaibley, has anywhere something that could provide—save me the time of what exactly systems do you have operating at a local—what's local, what's server, and how is it stored, because what's going to have to happen is that they are going to come up with a list, and we're going to have to make sure that you collected it all and provided it to counsel. Does that make sense?

*84 A. Yes.

THE SPECIAL MASTER: My focus is I need to make sure that you properly collected from those locations anything that is stored locally if it is and provide it to counsel so that counsel can then properly comply with their obligations. So if you have anything that you could provide, that would be extremely helpful, because otherwise we will have to get out a Sharpie pen and paper and draw it, because I need to understand to make sure that you are preserving everything that we have everything that if grievances are stored locally at the offices I need to make sure that when the supervisor leaves that the grievances aren't going to go just as a hypothetical example. That may or may not have any merit. Okay? Does that make sense?

MS. FOLEY: (Nodded head up and down.)

THE SPECIAL MASTER: Just off the record.

DANIEL SMALL, CAROLYN SMALL, WILLIAM CURTIN, DAVID COHEN, LANETTE LAWRENCE, and LOUISE COLLARD, Individually, and on Behalf of All Other Persons Similarly Situated, Plaintiff,

vs.

UNIVERSITY MEDICAL CENTER OF SOUTHERN NEVADA, Defendant.

Case No. 2:13–cv–0298–APG–PAL

REPORTER'S TRANSCRIPT OF SPECIAL MASTER'S HEARING

Volume II

BEFORE SPECIAL MASTER PRESIDING, DANIEL GARRIE, ESQ.

Taken on Monday, April 7, 2014

At 9:12 a.m.

At 333 South Las Vegas Boulevard

Courtroom 3C

Las Vegas, Nevada

REPORTED BY: Janet C. Trimmer, CRR, CCR No. 864

APPEARANCES:

For the Plaintiffs:

For the Defendant University Medical Center of Southern Nevada:

Also Present:

INDEX OF EXHIBITS

*85 THE SPECIAL MASTER: Let's go on the record. I've got the seating charts. I have some housekeeping issues to go through.

First, I would like to recognize and thank both sides for going the distance over the weekend, getting and turning around the revised order for the Court and also getting the custodian interviews and circulating them, because believe it or not, they were a lot of different pieces of paper that needed to all be combined into one, and so I appreciate that effort.

I'm going to today do this in two ways. I wanted to just try to get right into the scan and repair, but I did review—

Off the record.

THE SPECIAL MASTER: Back on the record.

I want to make clear to all parties that when you offer testimony here, it is under the same auspices of it being under oath. I don't make people formally swear in for anybody that's a member of the bar. I extend everybody that courtesy because you are a member of the profession. I'm an attorney. I don't believe it's ever necessary.

I want the technology people—I'm not going to—unless Plaintiff objects, I want—I don't see the need to have them swear—like bring them in as a formal depo.

But I want you to understand you are making statements to an Officer of the Court. So forthrightness and truth is the utmost importance.

Saying “I don't know” is completely acceptable. Telling me something that then turns out to be not true is not the right path. Right? So I just—and so I have no problems with anybody saying, “I do not know, I need to get back to you and I will provide you a written response.” We'll preserve it in the record, and we'll go forward from there.

But making a statement that then—I then have to go back and when I'm reviewing my notes turns out not to be true, based on the very materials you provided to me, ends up being a problem downstream.

Is that crystal-clear to all parties? Plaintiff? Defense? Sorry.

Plaintiff? “Yes”?

MR. GODINO: Yes, yes.

THE SPECIAL MASTER: Defense?

MR. SCHAIBLEY: Yes.

THE SPECIAL MASTER: IT people in the back?

MR. LATTIN: Yes.

THE SPECIAL MASTER: And that would be Shane Lattin and Jason Clark.

Okay. So now, I'm going to do a couple of things today. First thing I want to do is I want to go through the hearing transcript from Friday to make sure we all understand everything that's being expected to be provided and the dates and the times, because there were a lot of things covered.

I don't expect that to take us more than 45 minutes, but I think that's very important because that way we'll also have a clean record, and we'll also have, if Plaintiff wants to add or I forgot things or Defense wants to respond or whatever, but we can discuss that and it will all be clear, because we covered a huge amount, and I'd like to just make it all clear.

Is that okay to both sides?

MR. TOSTRUD: Absolutely.

THE SPECIAL MASTER: Okay. So the first thing we have is from the—is that we were going to—for Mr. Espinoza, we were going to verify how the two PSTs and OSTs came about. You were going to verify that.

*86 I'd like to actually see—I went through the other—the additional Excel spreadsheet that I got that is the entire serving sitting piece, and I ran that as well. I didn't see the PST and OST files sitting in it for him.

So what I want to know is where are they sitting, and I would like to have a screen shot of where they are sitting; I would like to know that, right, because I'm trying to figure out how the materials that I have—I can't actually find the e-mail files in the scan and repair—where they are sitting.

If Mr. Edmondson could be so kind as to verify that for me as well within his collection, okay, because I can't actually figure out what the source was of Mr. Espinoza's e-mail.

The other thing I would like to happen is, now that we've all had a chance to—on Friday, we are going to identify the different e-mail clients.

Mr. Edmondson, I need you to go through and, for each custodian, identify the different mailboxes that you find so—for the six or seven that we have. For—to be clear as an example, Joe Espinoza—sorry, not Joe—is it John?

MS. WITTY: Yes, John.

THE SPECIAL MASTER: Mr. Espinoza has used Outlook, and we have OST and PST files.

Next person, they had Outlook Express because, based on the custodial interviews I got, nobody—like the Outlook Express wasn't captured anywhere. And I understand that people don't know the difference, but I need to have—I need to know, right, if they are using Outlook and Outlook Express; I believe that we need to understand who is using what.

Is that clear?

MR. EDMONDSON: Yes.

THE SPECIAL MASTER: Now, the scan/repair PST issue. And to be clear, I ordered you to produce, and it was produced, the scan/repair PST logs, right, and you received it.

There was also—you provided me the—and I forgot to order you to produce it, if there is no objection, the other repair—I'm blanking right now—I got from you—give me one second.

I'm just looking for the e-mail that was sent to me with those attachments, Outlook Express. Do you know what I'm referring to, Counsel for UMC?

MS. WITTY: I'm not clear exactly what you are requesting.

THE SPECIAL MASTER: There was—you sent me when it came with the scan/repair logs.

MS. WITTY: The full directory listing?

THE SPECIAL MASTER: No, not the full directory listing. There was another repair.

Mr. Edmondson, do you know what I'm referring to?

MR. EDMONDSON: Yes.

THE SPECIAL MASTER: What's the name of that file again?

MR. EDMONDSON: Let me check.

THE SPECIAL MASTER: There we go.

MR. EDMONDSON: Found it?

THE SPECIAL MASTER: Yes. “Test e-mail eCapture export.”

MR. EDMONDSON: Yes.

THE SPECIAL MASTER: Thank you. I was trying to remember because—the “test” part.

I would like to provide that to the other side. Is there any objection to that?

MS. WITTY: No. We've reviewed it.

THE SPECIAL MASTER: Okay. So I'd like you to provide that to—I'm ordering that to be produced as well.

*87 So we can actually review that.

I'm going to—let's go through this. I'm going to—go off the record for a sec.

THE SPECIAL MASTER: Let's go back on the record.

I'm going to first defer to Plaintiffs since you've had a chance to refer the scan/repair logs. I'm going to let you—do you have any issues with them?

MR. PIXLEY: No.

THE SPECIAL MASTER: Do you have any concerns about the way it was done or the results?

MR. PIXLEY: Not with the scan and repair tool itself. My concern is the other issue that you raised with the truncating of the PST files.

THE SPECIAL MASTER: So—okay. I had the similar concern. I just wanted to wait for you to have the same chance to review it before I weighed in.

Do you have any other concerns based on the repair logs themselves for particular custodians?

MR. PIXLEY: No. It just acknowledges that he completed the task, but it's not like—I don't have access to the actual file, so it's just evidence that he used the tool to complete the task.

THE SPECIAL MASTER: Right. And so I have—I'm going to want to know the—in the results it didn't actually detail out the files that were repaired, did it?

MR. PIXLEY: Well, it's the name of the file itself.

THE SPECIAL MASTER: Right.

MR. PIXLEY: So that was the question that I had. He—I've used the tool before. So it basically just takes the name of the PST file and it just appends .log.

THE SPECIAL MASTER: Right. Right. So I just wanted to make sure. But those were the only ones that had problems or those were the only ones—that was all the PST and OST files in the entire collection today?

MR. EDMONDSON: That was all of the de-duplicated PST and OST files in the population—

THE SPECIAL MASTER: De-duplicated by hash?

MR. EDMONDSON: Hash value, yes, 75.

THE SPECIAL MASTER: All right. Now, I have a similar concern, if Plaintiff has none, about the scan and repair log files. I would like to know, from the containers that were created, I'd like to actually know, once you have repaired them, how many e-mail messages were logged.

So you have a repaired file and you had the original, you should be able to right-click, get a message count, right-click, get a message count, and I should know. So I would like a table created detailing that out so I have some knowledge of the specific messages and the total amount of loss values.

Now, as to the tools, I think first the real solution here is we need a better tool, unless you disagree, because the solution that was provided with the trimming that happened isn't going to—it doesn't work. I mean, the trimming is really so dramatic that we have no real idea of how much is lost.

And, Mr. Schaibley, I do have—you're the—among your peers here today, you are the Exchange person I can go to today, or is there someone else?

MR. SCHAIBLEY: Yes.

THE SPECIAL MASTER: Okay. With regards to the Exchange environment itself and those PST and OST files, those two particular ones, I want the hash values run for those two PST/OSTs. I want them compared against what he has. I want to make sure there was no issue with the—the multiple people that the image was made and another image was made, that nothing—that those two files are indeed the best possible source we have.

*88 Once that's verified, which I don't expect it not to be, I'm not—I don't think anybody here—I'm just double-checking to—to the easiest possible solution first.

If that doesn't work, I'm going—I'm open to suggestions from Plaintiff before I go down another path.

Do you have alternative solutions to the trimming?

MR. PIXLEY: Yes. One, I—I guess my first thought is were those files able to be mounted within EnCase in the first place, are they actually viewable, or are they just corrupt?

MR. EDMONDSON: I haven't tried, but I can check right here, if that would help.

MR. PIXLEY: So that would be the first stage.

Then the second thing was, if it cannot be opened, then we need to look at the idea of splitting them.

THE SPECIAL MASTER: Well, I agree—I mean, I don't—I mean—yes, I think that that would be the most logical if they can't be actually opened, full stop. If they can be opened—so there's two paths; right? First, see—can they be mounted? I assume they could be. If they can't be—and it's a—thank you for pointing that out.

With the assumption they can be mounted, what would you—the path—let's say they can be mounted. What would you want to do next?

MR. PIXLEY: Well, if they can be mounted, then we can just go ahead run the search terms against them and just produce the responsive MSG files.

THE SPECIAL MASTER: Right. So the way I saw it is that similarly, rather than do anything more, the simplest solution is often the easiest and best solution, which is just do the manual effort of loading those specific files and running the search terms through those specific files. And if it works, great, we can move forward. If it doesn't work, we can further address the issue.

If it can't be mounted—so I'm going to order you to run the search—mount—well, you want to let us know the results?

MR. EDMONDSON: Yes, I'm about to turn over them right now. It may take a couple of minutes.

THE SPECIAL MASTER: Well, obviously, if there were—any error logs that come up, be provided to—with the error logs that are generated, if any are.

The alternative, if they can't be mounted, I'm going to suggest that we use an alternative tool to try and repair it, unless you have some other ...

MR. PIXLEY: I agree. I guess my other thought is, I don't know the date range, like, what's the last run date of these PST files? So, I mean, are they—do we even know what those are?

THE SPECIAL MASTER: And what are the—yeah, what are the date time stamps? I have them written down. I just ...

MR. EDMONDSON: There's—one of them is 8–23–2013.

THE SPECIAL MASTER: I mean, that's why I pick—I didn't—yes.

MR. EDMONDSON: Yes, 8–23–2013. So if you—

MR. PIXLEY: We do care what—

THE SPECIAL MASTER: Yes, I mean, that's—so let's assume that I have enough common sense, generally speaking, that I—if we're having—yes, 100 percent, and I apologize for not stating what I had already done, myself, because I had received all of the PST and OST files in a file listing.

*89 So assuming it's relevant—

MR. PIXLEY: The other step, just a simple thing, would be if it can't be mounted, we can still run the raw search terms. We just have to set the search expression to make sure that we're using Outlook compressed—

THE SPECIAL MASTER: Could be one of the issues.

MR. PIXLEY:—as—make sure that our search parameters are run as Outlook compressed. So we'll just see if any of our search terms hit. If our search terms are not hitting within this PST file, really going—

THE SPECIAL MASTER: Going any further?

MR. PIXLEY: Right. So I have kind of a phased approach, but I guess the first thing is—

THE SPECIAL MASTER: I mean, so I agree. I thought before you would that, I mean, what I would do is try to run maybe a different repair tool on it. Maybe it might be more effective, just ...

I mean, I've had different results with different tools, and it really depends on the type of error, because I can't exactly—given that we can't even figure out what the error was, because it wasn't even repairable, I think maybe looking or trying a different tool might at least give me some more information before I go down the path of running the search terms, seeing what hit, seeing if there are any archive frag–––whatever, fragments.

The other thing I would like to verify is, that wasn't the live collection; right? Just to be clear, Mr. Schaibley, did you have a chance to look at it?

MR. SCHAIBLEY: Which one?

THE SPECIAL MASTER: The PST and OSTs that we're talking about. Those aren't not from the live—you did tag them with the right—

MR. SCHAIBLEY: Yes, anything in the home drive was not live.

THE SPECIAL MASTER: Right.

MR. SCHAIBLEY: The one that was live was actually labeled—

THE SPECIAL MASTER: Well, yes, I know. I just—because that's what I ran in—my search on the other one. Have you actually just searched the spreadsheet you gave me for the word “live”? You will see ...

The—so you weren't here on Friday, but they ran it on the live mailboxes, as well as their home drives themselves. So what we are talking about, what's stored in the user's home drive.

So what I suggest is we run a tool, there are three or four tools out there, just to understand what—if any tool can actually do it before we spend a great deal of time with the more detailed and nuanced approach of—assuming—well, could it be loaded?

MR. EDMONDSON: It's still attempting to map the file structure.

THE SPECIAL MASTER: So this is all assuming it can't be done.

Well, what was your proposed—I mean, the only thing I would like to suggest before we go down the path of a more refined, iterative approach is that we just try—you know, there's—if my memory serves me, I've used DateNumen before—DataNumen before when I've had some problems here and there.

Each one has—I believe, fixes a different issue. I've never—I mean, I have all four tools. So I mean, I'm not going to recommend—order you to use all four tools, but is there a particular tool you like, Phoenix—is there a tool that you find ...

*90 MR. PIXLEY: No, no. I mean, I would go through the same, just trying different ones just to see what we get.

THE SPECIAL MASTER: So I would like you to go through—if they can't be mounted, we're talking, I would like you to just try the different tools. Pick—I can suggest—we could do Phoenix, I've used—and DataNumen, or can you—there are other ones, but I think those two are good as any of the others.

MR. PIXLEY: That's fine.

THE SPECIAL MASTER: So I would like you to just try it on those because it is within the relevant date range and that the trimming was so big, it is fairly important we, at the very least, try a way to some extent to be able to search them for the search terms.

What were you going to suggest for the more nuanced iterative approach?

MR. PIXLEY: If—one was just using EnCase if it saw it as a raw file. If it couldn't be mounted, it's just running the search terms. But when you run the search terms and you set up your search expression, you have to set your code page to Outlook compressible and—because that's how the data is stored.

THE SPECIAL MASTER: Right. But I'm assuming that's—I assume that's how it was. Fair point.

Mr. Edmondson, I just want to confirm, when you are doing it, you are setting the file type and the—like to—to the Outlook compression?

MR. EDMONDSON: In doing keyword searching, right now I'm using the index because it's fully processed in EnCase 7 and automatically identifies the code page as the processes.

THE SPECIAL MASTER: That'll work. That does it automatically. That's fine.

So then what was the next—Mr. Edmondson, I just need you to make sure you are listening because this is what we are proposing and your counsel is going to be relying on you to help them here.

What was the next step?

MR. PIXLEY: Well, if—once we know that something is there and if—again, using Outlook, it's—Outlook compressible encryption is the code page to use, then we would have to look at either those tools that you just mentioned or splitting them.

THE SPECIAL MASTER: Yes, I'm going to suggest if the tools don't work, we split. I don't know how else to do it. I genuinely don't think there is a viable alternative. You could use fragment carver and go into X–Ways and look at the—

MR. PIXLEY: No, I'm not—

THE SPECIAL MASTER:—and decompress.

I mean, I agree with you. I think the most practical solution here from a practical level is to, if it doesn't work, split them and then go from there.

MR. PIXLEY: Agreed.

THE SPECIAL MASTER: On what size would you like to see it at?

MR. PIXLEY: Well, if we are going to split them, I would probably split them just a little bit under the 2–gig mark there, just so they will actually function.

THE SPECIAL MASTER: I think you—did you try that last time?

MR. EDMONDSON: I didn't try splitting them. I just used the trim for Microsoft's knowledge.

THE SPECIAL MASTER: All right. So the—okay. So what should happen is that you will try splitting them, and then usually if splitting doesn't work, you then trim. But you can—I guess some people do trim first then split, but usually splitting allows you to preserve more of the data, so you utilize trim as the last resort.

*91 So when you trimmed, I assume that you had tried splitting. But if splitting hasn't been tried, that is always the first approach before trimming.

Is that an acceptable path to go down there for you guys?

MR. PIXLEY: Yes.

THE SPECIAL MASTER: I don't have any problems with that. I actually—and to be clear, I actually assumed that you had tried splitting. But if you haven't tried splitting, you should try splitting them and to cut it as fine as possible. At that point, we'll go from there.

Is it mountable?

MR. EDMONDSON: One is creating the cache files, so it does look like at least one of them has finished viewing. It should be visible—

THE SPECIAL MASTER: Which one? I mean, its filename would be useful.

MR. EDMONDSON: I don't know yet until it's done.

THE SPECIAL MASTER: So once it's done, let the Court know.

MR. EDMONDSON: Yes.

THE SPECIAL MASTER: Okay. Any other concerns about the scan/repair issue?

MR. PIXLEY: No.

THE SPECIAL MASTER: I will tell you one general concern I have, and this is more directed towards UMC's—I guess not the—unfortunately, you guys are here, but it's more the people that were making the decisions and asking you to do the work.

I'm a little shocked and surprised that they didn't actually ask you to verify what was—like you did it perfect when you did your live collection. You got the live collection, you loaded it, you made sure it worked, and you gave it to—you know.

And I'm surprised that they didn't ask or expect you to do the same for the mailboxes you were providing. Because at the end of the day, that would have prevented nearly all or a large number of these issues, I believe, from actually ever happening in the first place. I'm a little surprised that that didn't happen.

I'm also—you know, Mr. Edmondson, I do think best practices sort of dictate that you make sure that when—that all of the e-mail PST and OST files you are looking at are usable and loadable and operational and can be used before you run anything. You need to make sure the evidence you are bringing in is actually usable evidence. We shouldn't end up going all the way downstream to now to find out that, “Oh, yes, the PST and OSTs were corrupted.” Right? This is, like, very late in the game, and it's proving to be fairly costly for all sides.

I mean, standard practice would be that when you import the evidence, you make sure that if there are any issues, you tell counsel, counsel then can raise it to opposing counsel, and there can be a conversation, and they can act—if they believe it's necessary, if they believe it's in—like we did. I checked the date range. Is it in a responsive date range? Yes, it is.

Okay. I need to tell counsel that they have two PST and OST files that have an issue or problem, and then have a conversation with them so that the counsel for UMC can then have an educated conversation about what's next to do.

Without that information, it's very hard for them—while I appreciate Plaintiffs' frustration, but I think UMC's—I think you need to recognize that—you need to make sure the information is bubbling up to the lawyers; right?

*92 And it's not, and it can't—this must change, like, immediately this must change. Like, your lawyers must be brought into the loop and explain. Like, you must check the evidence as you import it to make sure they are valid evidence files; right? And you must tell the lawyers that, “Hey, look the collection we've got has these issues.” Right? So we don't end up here.

Okay. Moving right along, I don't have anything else on scan and repair. I actually thought splitting had happened. If it hasn't happened, you will let us know the results, and we'll revisit that.

Moving forward, I did order you, just to be clear, for—you to process, unless—the Plaintiffs, if you have any objection to having the entire everything processed through EnCase 7. Is there any objection from Plaintiffs' side?

MR. PIXLEY: No.

THE SPECIAL MASTER: Okay. And that's to process everything, and the chain of custody should, you know, obviously, map to the other side.

MR. EDMONDSON: Uh-huh.

THE SPECIAL MASTER: Okay. We didn't set a date for the rolling production, but we will shortly.

Encryption, did anybody make a—I ordered you to look into the encryption. Did you look into it?

MR. EDMONDSON: Yes.

THE SPECIAL MASTER: Can you shed any further light to Microsoft Crypto being run?

MR. EDMONDSON: The actual—let me pull up the list that I sent this morning.

THE SPECIAL MASTER: And, again, you're—you need to check on a going-forward basis this information so that your lawyers know this.

And, UMC, you must tell outside—your outside IT people—well, I think you don't allow encryption. But if you do allow encryption of any shape or form, you need to—you need to tell them, “We do not allow encryption.” Right?

But if you do allow encryption, you need to say, “We allow encryption of X, Y, and Z,” so that that information gets passed forward; because otherwise, again, we end up with me looking at all the paths.

MR. EDMONDSON: The actual files identified by EnCase as encryption included two DMG files for Macintosh, four PGP ciphertexts, and two certificates, Internet security certificates. That was all.

There were additional password-protected files which were password protected with varying levels of encryption which were exported to Passware and processed.

THE SPECIAL MASTER: Without issue?

MR. EDMONDSON: Without issue. There were some—

MS. WITTY: For the court reporter, could you repeat?

MR. EDMONDSON: They were exported from EnCase and processed with Passware to break the passwords.

Some files that were identified by EnCase as having a signature of WordPerfect but did not have WordPerfect extensions could not be broken. They do not appear to be actual WordPerfect files. I have not been able to identify what they are yet.

THE SPECIAL MASTER: Can you provide counsel with those filenames?

MR. EDMONDSON: Yes.

THE SPECIAL MASTER: Counsel, have you received those?

MS. WITTY: Yes.

*93 THE SPECIAL MASTER: And when did they receive it? Yesterday?

MR. EDMONDSON: This morning.

THE SPECIAL MASTER: This morning? Okay.

How many files?

MR. EDMONDSON: There were unidentified that it believes was WordPerfect.

THE SPECIAL MASTER: How many total files do we have at issue with this problem?

MR. EDMONDSON: I would have to count them. I exported the entire report from—

THE SPECIAL MASTER: If you have an Excel spreadsheet, just—sum it for you at the bottom.

While you are doing that, I have a question for Mr. Schaibley, or your colleagues, actually.

DMG file, any ideas? It's in Mac OSX file, in case you don't know.

That's actually an image, Mac image.

MR. LATTIN: We can install—

THE REPORTER: I cannot hear you.

THE SPECIAL MASTER: Yes, it's a Mac install file used—or a load—it's a—any idea as to how that ended up there?

MR. CLARK: (Shakes head side to side.)

THE SPECIAL MASTER: Is it allowed to be there? Because based on what I was told and what I've read, that a Mac OSX DMG file should not be sitting on anyone's device, unless I misread your policies myself.

MR. LATTIN: I don't know.

MR. SCHAIBLEY: I have no answer to that.

THE SPECIAL MASTER: All right. I'm going to go off the record.

THE SPECIAL MASTER: Let's get back on the record.

Once we get the total number of encrypted files that we're dealing with, I'm going to carve—what I'm going to suggest is—and, Plaintiff, if you have no objection, because I want to get this rolling production—you will document all of these files in a spreadsheet, and a Word doc attached.

You will say you are dealing with these issues relating to these custodians for encrypted files; we recognize that we're not running the search terms on these files until we can do it for these custodians.

But I'd like to start running search terms on custodians and turning data over. And once we fix the encryption issue for these files, we will run the search terms and produce anything that's responsive.

Does anybody have any objection to that?

MR. GODINO: No.

THE SPECIAL MASTER: UMC?

MS. WITTY: No.

THE SPECIAL MASTER: So that takes care of one big problem for rolling production, encrypted files. I'm ordering you by Friday to come to me with a solution; otherwise I will use a forensic neutral myself who I know can give me a solution.

So you have until this coming Friday to give me a solution, or I will appoint somebody, a third-party neutral, to get me a solution; right? Because I don't want to look at all of your data. I just don't have the desire. I mean, I can, and I will remotely log in and verify results, myself.

We—let's—I was going to save it for later today, but I intend to, with UMC, remotely log in and verify and look at the different things that I have and that certain things were done. Okay?

You have till Friday to figure it out; right? There should be no reason why at least the custodians don't know the passwords to the encrypted files that they have.

*94 MR. EDMONDSON: For the counts, there were a total of 779 files with passwords of some type. 107 of them are the ones that appear to be WordPerfect but cannot be broken and cannot be opened by WordPerfect. They don't have WordPerfect extensions either.

THE SPECIAL MASTER: And as far as—is there anybody with—besides yourself, Mr. Schaibley—Mr. Schaibley, your two peers, does any of you have any knowledge about the encryption?

THE SPECIAL MASTER: Do you have users that use WordPerfect?

MR. CLARK: WordPerfect, we never use it now. It was taken out when they went to Word. If somebody left a WordPerfect file there years ago.

THE SPECIAL MASTER: You have WordPerfect installed on the computers now?

MR. CLARK: No.

THE SPECIAL MASTER: Okay. What about Lotus, just out of curiosity?

MR. LATTIN: No.

THE SPECIAL MASTER: Just thought I'd ask.

So then if it's not supposed to be a WordPerfect-recognized file by EnCase—I've seen this once or twice, but I'm going to leave it for you to figure out internally. They are not supposed to be encrypted. There's 700 files. We're carving them out.

Do you have any objection to any of this?

MR. GODINO: No.

THE SPECIAL MASTER: All right. Okay. The chain of custody forms and the server mappings, is that in progress?

MR. SCHAIBLEY: Yes.

THE SPECIAL MASTER: Okay. When—I can—do you want to suggest a date or do you want me to pick one?

MR. SCHAIBLEY: I can have them to you before the end of the week, sir.

THE SPECIAL MASTER: Okay. So we'll give you the following Monday to have them in my hands, so you will have till the 14th.

Go off the record.

THE SPECIAL MASTER: Back on the record.

BlackBerry, yes.

MR. EDMONDSON: A quick note: It has finished mounting both of those PSTs successfully.

THE SPECIAL MASTER: And what about the OSTs?

MR. EDMONDSON: The OSTs, there were no OSTs that needed trimming, so those have mounted successfully as well.

THE SPECIAL MASTER: So those two—and they mounted?

MR. EDMONDSON: Yes.

THE SPECIAL MASTER: Okay. Perfect. Run the search terms. Fantastic. Scan and repair finished hopefully.

I want the log file, though, of any issues you run into in that process. And I also want the file comparison counts for what—for the PST—

MR. EDMONDSON: (Inaudible.)

THE REPORTER: I didn't hear that.

MR. EDMONDSON: Just the counts before and after for the repairs.

THE SPECIAL MASTER: And we are going to break every hour and a half for five minutes this time, because I realize, reading the transcript, that people were running out of steam. I apologize. I'm going to cognitively just make a break, just five minutes, though, but that way everybody wins.

Let's talk about BlackBerry. Who does BlackBerry here?

MR. CLARK: I do some BlackBerries.

THE SPECIAL MASTER: Off the record for a second.

THE SPECIAL MASTER: I'm going to bring you up to speed on the record so you are fully in the loop, and then I'll ask you my questions.

MR. CLARK: Okay.

THE SPECIAL MASTER: Before I do that, I'm going to let—Plaintiff, do you want to share your concerns for the record around the BlackBerry before I—

MR. TOSTRUD: I'd like to just summarize, if I can.

THE SPECIAL MASTER: Go for it.

MR. TOSTRUD: We're on the record?

THE SPECIAL MASTER: Yes, on the record.

MR. TOSTRUD: So without getting into the extensive background of preservation notices—

THE SPECIAL MASTER: Curbing all of that, BlackBerry.

MR. TOSTRUD:—carving all that out, Plaintiffs expected to receive several months, if not years, of BlackBerry messages between UMC executives and others relating to the substance of our lawsuit.

This is a meal break class action. We allege that UMC employees didn't receive all their meal breaks and weren't compensated when they missed those meal breaks.

So we expect that any discussion relating to that lawsuit that was done by messaging on BlackBerries and other personal digital assistants or mobile communication devices would be turned over to us so that we could review them in relation to our lawsuit.

When messages ultimately were produced to us on January 31, 2014, we only received approximately one month—a one-month snapshot of BlackBerry messages. And we were informed by UMC's counsel several times, verbally and in writing, that there would be no more BlackBerry messages and that we had received everything that was there.

So we expect that there would be much more than simply one month's worth of BlackBerry messages, and we're hoping you can help us work through the issue.

THE SPECIAL MASTER: I'm going to supplement that because I've had the fortunate opportunity of reading over vast amounts of documents.

A BlackBerry server has more than just text messages; right? It has the BlackBerry messaging. It has the e-mail on it. It has the BBM messages. It can have all the files that are actually downloaded, depending on how it's configured.

The part that perplexes me—and I read your backup policies, and I don't know if they're all followed. But assuming that in some relative sense that—off the record.

THE SPECIAL MASTER: Okay. Back on the record.

BlackBerry's server, were you ever asked to preserve the BlackBerry server by anyone for specific users?

MR. CLARK: Yes, recently.

THE SPECIAL MASTER: How recently?

MR. CLARK: I want to say within two weeks or three weeks.

THE SPECIAL MASTER: Before that, had your IT people—within your organization of UMC, does your CIO understand that you have a BlackBerry server?

MR. CLARK: Yes.

THE SPECIAL MASTER: Does he understand relatively how it works?

MR. CLARK: I don't know.

THE SPECIAL MASTER: Okay. Let's try this differently. Does he know what your preservation policy is supposed to be for the BlackBerry server and the communications stored on it? Have you been told that policy?

*96 MR. CLARK: No.

THE SPECIAL MASTER: Okay. Is there any written policy, Counsel, for UMC that you're aware of as to what the preservation of records for BlackBerry servers should be at UMC?

MS. WITTY: Specifically for the BlackBerry server, no.

THE SPECIAL MASTER: What about for e-mail communication?

MS. WITTY: There should be, yes.

THE SPECIAL MASTER: Okay. What about for instant message communications through the BlackBerry server? Not text messages. Instant message communication, their communication backup policy, so to speak.

MS. WITTY: I don't know of anything that specifically touches on instant messaging.

THE SPECIAL MASTER: You just ask UMC—okay. I assume, since your CIO knew that you had a BlackBerry server and that he understands the basics of how a BlackBerry server operates, how—what did—can you explain to me, at a high level and then we will go down, how is your BlackBerry server—what version are you running, how is it configured. Like start me at the beginning.

MR. CLARK: At the beginning of all the BlackBerries involved, or the current?

THE SPECIAL MASTER: Start with 2011.

MR. CLARK: 2011, probably running the old version of BlackBerry 5.0.3—

THE SPECIAL MASTER: 5?

THE REPORTER: 5.

THE SPECIAL MASTER: .0.3.

MR. CLARK:—Service Pack 3—

THE SPECIAL MASTER: Service Pack 3, okay.

MR. CLARK:—talking to Exchange 2003. That was running on a vertical environment.

THE SPECIAL MASTER: What?

THE REPORTER: What?

MR. CLARK: Running on a vertical environment on a VM.

THE SPECIAL MASTER: On a dedicated VM or a—

MR. CLARK: Dedicated VM. The database was on (inaudible) cluster for the BlackBerry.

THE REPORTER: I didn't hear that. “Was on a” what?

MR. SCHAIBLEY: Database was running on an SQL cluster.

THE SPECIAL MASTER: Was it a dedicated cluster?

MR. CLARK: No. It's a cluster throughout a lot of databases in the archives.

THE SPECIAL MASTER: So it's got—when you back up the—when this cluster backs, does it back everything?

MR. CLARK: What, now?

THE SPECIAL MASTER: When the SQL server backs up, does the cluster back up everything?

MR. LATTIN: It would be all the database on the cluster.

MR. CLARK: Yes.

THE SPECIAL MASTER: So everything in there? There's no carve-outs?

MR. CLARK: Yes, it doesn't—it's all in a suite. And then once it's on the server (inaudible)—

THE SPECIAL MASTER: Sorry, one sec. You've just got to talk slowly.

THE REPORTER: I'm sorry. I'm having trouble understanding you.

THE SPECIAL MASTER: Why don't you come up and switch seats.

THE REPORTER: Yes, if you could come closer, that might help.

MR. CLARK: Okay. It talks to Exchange 2003. I'm responsible for the server up and running, the infrastructure, and to make sure the application is running. That's pretty much it.

In terms of connecting to Exchange, I do not set policies on it.

*97 THE SPECIAL MASTER: Who does?

MR. CLARK: That would be security's purview, I believe.

MR. SCHAIBLEY: The policies that were set on it were set by our predecessors, and that's how they were running.

THE SPECIAL MASTER: Do we know what those policies are?

MR. SCHAIBLEY: I can pull them up and tell you what they are, but primarily the policies, looking at them, were strictly password-related and update-related.

THE SPECIAL MASTER: So there was no specific data enforcement policy?

MR. SCHAIBLEY: No.

THE SPECIAL MASTER: Well, just pull them up for my own edification and send them to myself and to counsel.

Returning to BlackBerry, BlackBerry Messaging Agent, is that included?

MR. CLARK: BlackBerry Messaging Agent?

THE SPECIAL MASTER: Yes.

MR. CLARK: Is that like the PIN messages?

THE SPECIAL MASTER: Yes.

MR. CLARK: I did not do any configuration on the server for that.

THE SPECIAL MASTER: But is it—I mean, it comes installed and running. Did you let it run?

MR. CLARK: Yes. I would imagine that the PIN messages for—between RIM NOCs and the Blackberries themselves. I don't think it touched our server.

THE SPECIAL MASTER: And what about BlackBerry messaging itself, the BBM messaging?

MR. CLARK: The BBM messaging, I don't think there was anything—I don't know.

THE SPECIAL MASTER: Best to stick with “I don't know” and “I'll go check.”

I'm going to repeat myself. If you do not know, I have no qualms with, “I do not know. I need to go check.” I realize you're not sitting in front of your terminal and that I am asking you about server configurations, and I'd rather you go check rather than you make a statement and then we come up with a theory and it doesn't work.

MR. CLARK: Sure.

THE SPECIAL MASTER: Okay. So in 2011, you were running SQL cluster 2003. Was it push or pull?

MR. CLARK: Push or pull?

THE SPECIAL MASTER: To the Exchange environment.

MR. CLARK: I don't know.

THE SPECIAL MASTER: Can you check, or who would know if you don't?

MR. CLARK: I would have to check.

THE SPECIAL MASTER: All right. So then, please check. I want to know—and what I'm talking about specifically is, was it pulling the e-mail message—how was it synchronizing with your Exchange environment?

MR. CLARK: My understanding is that with the RIM NOC being involved, when you register to the BES, any messages come off of the handheld, goes to the Sprint, which connects to the RIM NOC.

(The reporter requested clarification of. Mr. Clark by way of repeating his last comment as follows:)

MR. CLARK: The Sprint network, which would connect to the RIM NOC. So the phone, being on Sprint, would receive and send messages through Sprint, then talk to RIM NOC, which would talk to our BlackBerry server back and forth, two-way communication.

THE SPECIAL MASTER: Is that for messages or e-mails?

MR. CLARK: E-mails.

THE SPECIAL MASTER: Did you get all of that?

*98 THE REPORTER: Yes.

THE SPECIAL MASTER: So I need to know what BlackBerry server components you have up and running.

MR. CLARK: Okay.

THE SPECIAL MASTER: Okay. From 2011 through present, I want to know the components. Okay?

Now I want to understand something.

Mr. Espinoza—oh, wait. Let's go—let me go through a—so then a user, I mean, sends an e-mail message from their BlackBerry. Walk me through how that works within the way your current—in 2011, with the 2003 configuration, which you are going to figure out was push or pull, how that works.

MR. CLARK: You want me to explain that?

THE SPECIAL MASTER: Yes. Walk me through that example. I write an e-mail message, and I'm a UMC employee with a UMC BlackBerry.

MR. CLARK: My understanding is that the handheld, being BlackBerry, if you write a message, and you hit send, it sends it out, and it goes—

THE SPECIAL MASTER: To the BlackBerry server?

MR. CLARK: To the BlackBerry server and passes it through to the Outlook.

THE SPECIAL MASTER: It stores a copy of it.

My question is, is your BlackBerry server configured to store a copy of that message—well, by default, it stores it. So if you haven't touched it, it stored it.

MR. CLARK: I don't know, but I'll try.

THE SPECIAL MASTER: So they send the—Iwrite an e-mail—let's just—for hypothetical, a UMC employee writes an e-mail to his wife. That e-mail goes to your BlackBerry server. You are going to check to figure out if the BlackBerry stores a copy of that message and how long it's—the policy of how long it's storing it and the other related data.

We'll get to the backup piece of this, by the way, in a second.

It then is hanging out in the BlackBerry server, saying come (inaudible)—

(Reporter requesting clarification.)

THE SPECIAL MASTER: It's hanging out in the BlackBerry server, my message to my wife. Okay. But it needs to get to her. So where does it go next?

MR. CLARK: The BlackBerry server passes through a connection to the Exchange Outlook.

THE SPECIAL MASTER: Okay. And then on the Outlook, that's where Mr.—you—your duties—is it your duties or his duties? So then—and that's when you explained what happened last time.

MR. SCHAIBLEY: Yes.

THE SPECIAL MASTER: So then do you just want, for the record, to explain how it gets to my wife from—explain how it gets out of UMC.

MR. SCHAIBLEY: When it goes from UMC's Exchange server, if it is destined for outside the network—

THE SPECIAL MASTER: Outside, that's the point.

MR. SCHAIBLEY:—it will pass through to our external mail filter and, from there, make a connection out to whatever destination mail server it's going to.

THE SPECIAL MASTER: So now, the mail culture, do you use Postini?

MR. SCHAIBLEY: We currently use McAfee Ironmail.

THE SPECIAL MASTER: How long have you been using McAfee Iron?

MR. SCHAIBLEY: I don't know the date that it was installed. It was before I got there.

*99 THE SPECIAL MASTER: So we can say May of 2012?

MR. SCHAIBLEY: Yes—June of 2012.

THE SPECIAL MASTER: June, thank you. June, not May. June of 2012. I would like to know what was there prior. So counsel, please.

The reason why I'm asking is, Postini, for example, archives every e-mail—

I am supposed to speak slowly. I apologize to the court reporter.

Postini archive can be configured to archive every e-mail that goes in and out, and it just keeps a copy sitting there. Law firms particularly love that feature. All right.

And the e-mail just sits there and accumulates for 365 days, and then they get a bill and they have to pay more money and they are like, “No way, purge it.” And then, day 366, whatever was there from day 1, first in, first out.

I want to know how McAfee is set up, and I want to know how it existed prior to you joining.

MR. SCHAIBLEY: I will find out prior configurations before—and what we had before I arrived.

Currently, the Ironmail does not archive anything. It passes it and goes. If it is unable to make the initial connection, it will retry for a week's period and purge.

THE SPECIAL MASTER: Okay. Fair enough.

Figure out where it was in 2011, just for my own edification.

Okay. And then it goes outside and theoretically hits another mail server, then another mail server, then ends up at my wife?

MR. SCHAIBLEY: Yes.

THE SPECIAL MASTER: Unless you're at Google and you own the network, and then you don't have a problem.

Okay. What if it's internal? So from—I'm sending it, pretend my wife hypothetically works at UMC.

MR. SCHAIBLEY: If it is an internal e-mail, once it hits—

THE SPECIAL MASTER: Once it hits his. So we hit your BlackBerry—I'm assuming—sorry.

Mr. Clark, I'm assuming that if it's an internal communication and I wrote an e-mail message, not a message but an e-mail message as a UMC employee to another UMC employee, there is no difference; is that correct?

MR. CLARK: If you are running an e-mail, it depends on where you are running it from. If you're not on the—

THE SPECIAL MASTER: The BlackBerry.

MR. CLARK: If you are running it from the BlackBerry, it should be no different; that's correct.

THE SPECIAL MASTER: So I'm running a BlackBerry to send to my wife, who is an employee at UMC, and she get—and I'm sending her an e-mail from my BlackBerry within your domain. Okay? Are you with me with my hypothetical so far?

MR. CLARK: Yes.

THE SPECIAL MASTER: It is the exact same, just so we are clear. Now, what about once it hits the Exchange?

MR. SCHAIBLEY: Once it hits the Exchange server, if it is an internal mailbox, it will pass it to the—whichever database the mailbox is located on and deliver it to the inbox.

THE SPECIAL MASTER: And that's e-mail message?

MR. SCHAIBLEY: Correct.

THE SPECIAL MASTER: If you have—if Plaintiff has any question at any point, feel free to speak, because now is the time to ask.

*100 Okay. And that's—now, it's still storing the SQL—the whole SQL thing. It's still all the same for the BlackBerry. For Exchange, internal, external, is there any difference, servers?

MR. SCHAIBLEY: What do you mean?

THE SPECIAL MASTER: Sometimes people, when they route—so I have an Exchange environment, and I look at the sender. Sometimes they'll put additional levels of filtering on it before it goes outbound versus inbound—I mean, internal. I'm sorry.

MR. SCHAIBLEY: We had a single bridgehead Exchange server that all messages were tracked—were passed to, whether it was—

THE SPECIAL MASTER: Okay. So no gateway or anything like that?

MR. SCHAIBLEY:—whether it was inside or outside, and that bridgehead would then either forward it outside to the mail filter, external mail filter, or internally to the—whichever server hosted the database to mailbox.

THE SPECIAL MASTER: And there are no gateways?

MR. SCHAIBLEY: No.

THE SPECIAL MASTER: Okay. All right. So I then delete my e-mail message I wrote on my BlackBerry to my internal—there's two situations, here; right? I delete the e-mail message that I just wrote to the external-facing employee, to external third party from my BlackBerry.

Would it—I'm assuming no—we'll get to back up in a second.

If it's not backed up, there is nowhere else it would sit once it's purged from the Exchange server, which is on the two-week cycle.

I write the e-mail message on my phone to whoever, “Let's go to lunch,” hit send. It goes through the BlackBerry environment, gets to the Exchange, gets sent out. I then delete it from my BlackBerry for whatever reason I wanted.

It doesn't—what happens? Where does it—what happens to that deleted message, in your environment, on the BlackBerry level, with the BlackBerry server, when I delete it?

MR. CLARK: BlackBerry?

THE SPECIAL MASTER: When I delete that message, that e-mail message I just wrote, on my BlackBerry.

MR. CLARK: If you delete it on your BlackBerry, it depends on how the BlackBerry device is set up to sync. It may either leave it on the Outlook Exchange mailbox ...

THE SPECIAL MASTER: But your BlackBerry server would have a copy of it?

MR. CLARK: I don't know how it's set.

THE SPECIAL MASTER: I mean, the default is to store a copy.

MR. CLARK: I don't know if the default is set that way. I'd have to check.

THE SPECIAL MASTER: So—and then it hits Exchange, and does Exchange keep—cache a copy, or what's—

MR. SCHAIBLEY: If it is synced to sync the folders, it will sync into the sent items of the mailbox.

THE SPECIAL MASTER: I—fair point. I'm making an assumption. Are the folders set to sync? MR. SCHAIBLEY: I don't know the default on that.

THE SPECIAL MASTER: Do you know the default on that?

MR. CLARK: I don't know the default on that. Handheld can override the Exchange mailbox. It depends on how the handheld device is set up.

THE SPECIAL MASTER: I'm not talking about the phone. I'm talking about the syncing between the servers.

*101 MR. CLARK: Okay. I would have to check on the BB'd VM if—how it syncs with—

THE SPECIAL MASTER: I want to know if the Exchange folders sync to the BlackBerry server folders. I get the device piece of it. Do you understand my question as well? And you can check as well?

Now, returning back to the original question, which was you were asked two weeks ago—well, actually, I forgot. Internal employees, I sent it to an internal employee on my BlackBerry, and I delete it. What happens, once we figure out if they sync properly? Because what I'm trying to figure out is, if I write a message on my BlackBerry, does it end up in my sent folder in the Exchange environment? Can either one of you answer that question?

MR. SCHAIBLEY: If the handheld device is configured to sync folders correctly, yes, it would end up there in your sent items.

THE SPECIAL MASTER: But the BlackBerry server can also be configured to do the syncing itself?

MR. SCHAIBLEY: As we said, we would have to look into the configuration.

THE SPECIAL MASTER: Okay. I would like to know that by this Friday.

You understand the obvious problem here; right? If you are telling me that I can send and delete e-mails from my BlackBerry that exist nowhere else but in my BlackBerry environment, we have a problem.

MR. CLARK: I understand what you are saying.

THE SPECIAL MASTER: Okay. So, well, then, you got your—you need to figure out by Friday, convey it to counsel by Friday so they can convey it to me, because I need to know whether or not it is possible to write e-mail messages in your environment using a mobile device, the only place they exist in the whole world is on the mobile device, and then once they are deleted, they are gone. Does that make—and your lawyers definitely want to know.

So—and I'll be very frank. I need—maybe you guys aren't the right people, so I am just going to preserve it for the record and not necessarily leave it for you guys since you guys are the ones doing the work.

UMC's senior IT stakeholders need to figure out and start communicating with counsel immediately what's going on, because you've been before this Court on multiple occasions, and your lawyers have relied upon what you have told them.

And I understand you guys are doing your job, and you guys are doing a good job at it. But there is a huge disconnect behind what your senior IT stakeholders are telling the lawyers and what they are telling the Court.

And it needs to be remedied immediately, because it is wasting—as much as I'm sure everybody enjoys spending the day together and the weekends and everything else, it's not a really acceptable use of anyone's time. But more importantly, it's disrespectful to the Court, and the Court is entitled to the respect from UMC's senior IT stakeholders to know and to have a conversation with you guys and understand what's going on so that when they talk to their lawyers and UMC's counsel, they give them accurate information.

*102 Because your—both parties—and I keep—and I appreciate Plaintiff for keeping the—their frustrations and showing cooperative things, but I want to make it clear, there have been extensive conversations before the Court about the preservation of mobile communications. And I promise you that your lawyers would have loved to have been able to rely on what the senior IT stakeholders at UMC were telling them.

But the first time we're finding out that we don't even know if the e-mail messages—

THE REPORTER: Slow down a little.

THE SPECIAL MASTER:—we don't even know that if the e-mail messages that a senior executive writes on their mobile device are actually being stored anywhere in the enterprise besides those mobile devices, I promise you UMC's counsel has been nothing but ethical and up-front and honest, and they need to know that. We shouldn't be finding out now, today.

And so it's not directed towards you, but your senior IT stakeholders that have been passing this information on. It's not acceptable, and it must be fixed immediately.

Now, since you are sitting here before me and I can pick your brain myself and I actually know what you're talking about, I'm going to take full advantage of it, because I fully plan to get this done.

You'll check into those policies by Friday.

When you push a new—so I understand how it sort of works. Now, I want to talk about messaging.

For messaging, now there's two types. There's text messaging, right, which is SMS, which I assume you don't run an SMS—do you run or control the SMS text message? “No”; right?

MR. CLARK: No.

THE SPECIAL MASTER: You are not big enough. I would be surprised if you did. Some companies have their own relays at actual Sprint, they're that big, but you don't.

So I'm assuming that when someone writes a text message and sends it to someone else, the only place that sits, in all of UMC's world, the text message, the SMS text message, meaning the—that's getting sent over the network, right, is going through the telco network; right? Is that correct?

MR. CLARK: Yes.

MR. SCHAIBLEY: Yes.

THE SPECIAL MASTER: Okay. Now, an internal BBM message, be it PIN or otherwise, is going to hit your server because the telco—the PIN, maybe not. The PIN you are going to look into.

But the BBM message, if you have the BBM messaging server activated, and that module, it passes through the BBM server; that's how messaging works. That's why large businesses love BlackBerry; right? Because then nobody can actually see what you are messaging but the people within your enterprise; right?

So do you know how BBM messaging is, if it is, configured within UMC?

MR. CLARK: I don't know. I'd have to check.

THE SPECIAL MASTER: Can you please check and let counsel know by this Friday?

And, Counsel, I expect to hear from you on Friday as to how it's configured. I want you to be able to explain it to your lawyers so they know what is being said, so you might have to be a little patient. But it is very, very important.

*103 Are there any—do you lock down the BlackBerry devices at all from installing third-party apps or anything else?

MR. CLARK: I don't know because I'm not over the purview of the IT policies that you can set on the BlackBerry.

THE SPECIAL MASTER: Who is over that purview?

MS. WITTY: That would be Susie Kisner.

THE SPECIAL MASTER: And who is she? Sorry for my ignorance, but ...

MS. WITTY: I'm not sure her exact title.

MR. LATTIN: Manager. She's over the operations side managing.

THE SPECIAL MASTER: So she sets that policy?

MS. WITTY: Yes.

THE SPECIAL MASTER: Has she provided counsel with that policy?

MR. CLARK: My understanding is she's Dean's predecessor, and the predecessor of the IT director set the policy on the BlackBerry.

THE SPECIAL MASTER: Okay. But he's no longer there, so someone's got to be—either what he set is still in force or she's reset it. So if she hasn't reset it, she must have what it was beforehand.

Somewhere within your organization someone must know what the policy is; right?

MS. WITTY: And she would be available by phone, if you'd like to—

THE SPECIAL MASTER: Yes. Let's call her. Let's call her after our first break. Just let her know we'll be calling her.

Court Reporter, can you let me know when it's been an hour and a half, please?

THE REPORTER: Yes.

MR. TOSTRUD: Just one quick question.

THE SPECIAL MASTER: If Plaintiff has any questions, technical or otherwise, feel free to ask.

MR. TOSTRUD: Okay. I'd like to put on the record and have these gentlemen identify the senior IT stakeholders that you just mentioned.

THE SPECIAL MASTER: I thought they were identified for the record.

MR. TOSTRUD: I don't know that they have been.

THE SPECIAL MASTER: Well, yes, let's go through—

MR. TOSTRUD: And—according to them. They know who their bosses are and the people that are in charge of—

THE SPECIAL MASTER: Okay.

MS. WITTY: Would it be more efficient to provide an IT organizational chart?

THE SPECIAL MASTER: Org chart? Wouldn't that—would that suffice?

MR. TOSTRUD: I'd like that, but I mean, we're here and—

THE SPECIAL MASTER: I'm going to get—we're going to—I'm not going to go through the whole entire IT department, but we will get who is in charge of what within—relative, but I want to see the actual org chart because they might not actually—how big is your IT Department?

MR. SCHAIBLEY: Currently approximately 103 people.

THE SPECIAL MASTER: Yes. So they might not know all of the—I'd like to get an org chart.

But I want to quickly understand three quick things, which I think is what he's interested in.

CIO, how does the BlackBerry link up through your organization, the BlackBerry in Exchange environment? You have a NOC support? You have a—how does it work? Do you have a manager for enterprise services, manager for messaging? I'm just trying to understand basically if Susan is the one writing the policy and she didn't write the policy and it's from her predecessor, who is actually, at the end of the day, responsible for managing the BlackBerry in Exchange environment?

*104 MR. SCHAIBLEY: At the end of the day, it would be Susie.

THE SPECIAL MASTER: So if the CEO loses his BlackBerry one night because he's out doing whatever, and he wants it wiped, he goes, sees her?

MR. SCHAIBLEY: Does PBX handle the BlackBerry?

MR. CLARK: PBX is the first line of BlackBerry handheld, and they are the ones who add the people to the BlackBerry Enterprise Server.

My understanding is that I'm responsible for the infrastructure because I'm the storage VMware guy—

THE SPECIAL MASTER: Storage VMware guy.

MR. CLARK:—and that it's IT security that's responsible for the policy and the procedures on the BES.

THE SPECIAL MASTER: So let me rewind here.

PBX—we went over this last time. PBX, walk me through. I'm a new employee. Let's start at the beginning. We have two scenarios.

CEO or senior VP loses his phone, his BlackBerry. Who does he see about wiping it and getting a new one within your organization?

MR. SCHAIBLEY: Someone at that level would go through the IT director, which is Lund Richardson, or Susie Kisner, who is the manager over that area.

From there, they would work with PBX to—

THE SPECIAL MASTER: Who is the individual? You?

MR. SCHAIBLEY: Individual, Trina Burrage–Simon, B-u-r-r-a-g-e, hyphen, Simon.

And Trina would work on wiping the old BlackBerry and issuing the new BlackBerry.

THE SPECIAL MASTER: All right. I get it.

So then is Trina involved in syncing the BlackBerry data at all since she can wipe it?

MR. SCHAIBLEY: Yes, yes.

THE SPECIAL MASTER: What's her role?

MR. SCHAIBLEY: She's the PBX manager—supervisor.

THE SPECIAL MASTER: And so I get this—off the record for a second.

THE SPECIAL MASTER: Let's go back on the record to record that, because now it makes sense.

Okay. So I understand, can you please explain the different roles for the PBX team and the BlackBerry server team?

MR. SCHAIBLEY: The PBX team is the first line of support and manages the BlackBerry handheld distribution from an end-user perspective.

The server team, Jason Clark manages the functionality of the server itself to ensure that it is up and running.

THE SPECIAL MASTER: Okay. So let me understand something. If I want to get my messages and I want them ported over to my new phone, who does that?

MR. SCHAIBLEY: PBX.

THE SPECIAL MASTER: So then I need to also have PBX on the phone?

MS. WITTY: That would be Susie as well.

MR. SCHAIBLEY: Yes.

THE SPECIAL MASTER: Perfect. And so Susie has the ability, then, to port or whatever—however she has it configured, does she work with the BlackBerry server environment? She must.

MR. CLARK: She has access (inaudible)—

THE REPORTER: Didn't get that.

MR. CLARK:—and administers from the PBX perspective.

THE SPECIAL MASTER: Yes, but she must have admin rights. In order to port it over, I mean, someone's got to have admin rights to add a device and sync messages?

*105 MR. CLARK: Yes, they have admin rights to the handheld.

THE SPECIAL MASTER: And the BlackBerry server?

MR. CLARK: I don't know if there are admins on the server.

THE SPECIAL MASTER: Okay. And she would be—so then you didn't get any notification until two weeks ago that you needed to preserve or collect the BlackBerry, the data stored in the BlackBerry server, which you are going to figure out what that is by Friday?

MR. CLARK: Yes.

THE SPECIAL MASTER: And you are the right person to know what should be in there within UMC? You are the person responsible for the policy, for administering the policy, not setting it, but administering it?

MR. CLARK: No, I do not administer the policy on the BlackBerry Enterprise Server.

THE SPECIAL MASTER: Who does that? Susie?

MR. CLARK: It was Brandon and Susie in the past.

MR. SCHAIBLEY: So IT would be Susie at this point. The policy has not been—since I've been there, the policy has not—the IT policy that can be assigned on the BlackBerry server have not changed since their original configuration by our predecessors, with the exception of, as Jason said, a couple of weeks ago, of ensuring the continued collection of all material.

THE SPECIAL MASTER: Wait. So—yes. So you've—since you have heard of this, you have started preserving all of the materials, correct, on the BlackBerry server environment?

MR. CLARK: I was not told to preserve all materials from the BlackBerry—

THE SPECIAL MASTER: For the 26 custodians that are at issue. Let me make it simple. I'll ask you the question about what was told. Let me take care of the most important thing:

I'm ordering you to preserve all mobile device communications stored on any PBX, BlackBerry, or magical cloud that is within your ambit, purview, or control immediately relating to UMC in this litigation.

Is there any confusion?

MR. CLARK: No. I understood when the CIO called me, specific individuals had to be on the BlackBerry server today, they have been preserved since then.

THE SPECIAL MASTER: Has anybody provided you a list of these individuals?

MR. SCHAIBLEY: Do you have the full list?

MR. CLARK: I have an e-mail from the CIO of people who are on the BlackBerry, but I don't think it was 26.

THE SPECIAL MASTER: Okay. And Susie—could Susie collect e-mail or messages from the PBX environment that are on the BlackBerry?

MR. CLARK: (No response.)

THE SPECIAL MASTER: We'll ask Susie. Fair enough. Best say, “I don't know.” Remember, stick with the “I don't know” if you don't know.

Okay. Let's switch seats with backup, unless Plaintiff has any more questions about BlackBerry.

MR. TOSTRUD: I think I do. First of all, I have a comment for the record, and then I have a question, and then I'd like to put a document in as an exhibit.

THE SPECIAL MASTER: Okay. Can I see the document first? And show a copy to ...

MR. TOSTRUD: Yes. (Handed to counsel.)

*106 MR. GODINO: We think it's relevant to the retention of information on the BlackBerry.

THE SPECIAL MASTER: I got it.

MS. FOLEY: I'm not sure if I've seen it.

THE SPECIAL MASTER: I'm not saying that you haven't—I'm just asking if they have seen it. I'm going to ask you about the document, clearly.

But let's go off record for a second so you can look at it.

THE SPECIAL MASTER: Back on the record. Before I admit it in, do you have any questions, Counsel Witty?

MS. WITTY: There is no administrative approval listed on this. The policies and procedures identified by UMC generally have who is responsible for ...

THE SPECIAL MASTER: Can you provide any clarification as to this document?

MR. TOSTRUD: Sure.

THE SPECIAL MASTER: Was this provided to you or produced?

MR. TOSTRUD: It was a record that was not produced by defendant which we believe is clearly relevant.

THE SPECIAL MASTER: Well, I would agree with you.

MR. TOSTRUD: It was produced to us by our plaintiff, Daniel Small, who I believe identified that document or was provided it either via e-mail or it was available on the intranet, UMC intranet.

THE SPECIAL MASTER: Counsel Witty, can he authenticate that and provide ...

MR. TOSTRUD: Absolutely. I would hope that it's—

THE SPECIAL MASTER: I agree with you, but just—if he—I just want—Counsel Witty, if you think they have from Mr. Small and can authenticate the record—

MS. WITTY: We're not opposed, and we just would state our objection on the record that it does not follow the traditional form; that even its availability for review would not necessarily make it the binding policy.

THE SPECIAL MASTER: Okay. Do you have any objection or do you wish to respond?

MR. TOSTRUD: Well, I think we need to get an answer as to whether it is a binding policy or not. It appears to be a business record. It's available to an hourly paid employee of UMC. It directly addresses all employees; it relates to all business records; that's the purpose of the document.

Page 2 identifies that it relates to business records with respect to—

MS. WITTY: I would state that he's going to the content of this document.

MR. TOSTRUD:—with respect to all mediums—

THE SPECIAL MASTER: All right. One second. Before we get into the substance of the document, which is—I'm not quite yet there.

MS. FOLEY: This was not produced in the regular course of discovery, so we are entitled to say we don't know. We don't—

THE SPECIAL MASTER: I have no problem with you saying “I don't know”; I don't have any qualms with you saying “I don't know,” because I asked for the record retention policies and schedules, and this was not what I received.

*107 MS. FOLEY: Right.

THE SPECIAL MASTER: So I mean, I fully recognize there is an issue here.

MR. TOSTRUD: Just so I'm clear, this hasn't been produced to you either?

THE SPECIAL MASTER: This particular document has not. I did receive and request, I believe—I don't know if I received it yet, but if not, I'm requesting the like document, but I thought I had been provided it.

MS. FOLEY: Is—does that have a Bates stamp on it?

THE SPECIAL MASTER: There's no Bates stamp.

MS. FOLEY: Not on—I'm sorry. I thought you were at the other one. You were—

THE SPECIAL MASTER: Oh, the other one that you provided, you provided me—did you provide me the record retention?

MS. WITTY: No. They fall underneath County record retention policies. It's a 500–some–odd–page document.

THE SPECIAL MASTER: Can you do me a favor? Can you find that? And can you also—let's go off the record for a second.

THE SPECIAL MASTER: Okay. Let's go back on the record.

I'm going to request that you provide this in an affidavit, and I will take it right now as Exhibit 1, subject to the receipt of an affidavit provided by you. I would like the affidavit no later than this coming Friday, if at all possible.

MR. GODINO: Exhibit 9?

THE SPECIAL MASTER: Exhibit—thank you.

Will you please provide it to the court reporter? Just the—not the new document. Just the—with Appendix A, to the court reporter.

MR. TOSTRUD: I only have two copies, so I'll provide that to her.

THE SPECIAL MASTER: That's fine. And I'm noting for the record that this is subject to being provided an affidavit around the—the affidavit needs to speak to the following, so we're clear: Authenticity, how he got it, who he got it from, when he got it, where he got it from, and I think that would provide sufficient background. That's first.

Bear with me here.

Second, I'm going to ask UMC IT—I hate to put you guys on the spot, but you would theoretically be the ones responsible for this in some capacity, be it downstream or Susie—what's her name—Susie Kisner. Have you guys ever seen a document—this document or—on your intranet or otherwise?

MR. SCHAIBLEY: Prior to today, no.

THE SPECIAL MASTER: I might remind everybody here that if push comes to shove, we will be searching UMC's intranet ourselves for this document. So I'm just telling you.

Like, I just don't want there to be any confusion downstream that I didn't make it crystal-clear that saying—okay.

So let me understand next: I want to ask each of you. So Mr. Lattin, have you ever seen this document? Please look at it closely. It's entered as Exhibit Number 9.

MR. TOSTRUD: Exhibit 9.

THE SPECIAL MASTER: If you want to take a second to look at it, feel free. Off the record.

THE SPECIAL MASTER: Back on the record.

MR. LATTIN: Prior to today, I don't remember seeing this before.

*108 THE SPECIAL MASTER: Okay. For the record, Mr. Clark ...

MR. CLARK: (Examined document.) I'm saying the same. If I had seen it, I don't remember seeing it.

THE SPECIAL MASTER: Okay.

MR. SCHAIBLEY: (Examined document.) Prior to today, no.

THE SPECIAL MASTER: Now, my—I'm going to just—bear with me. I know we hit an hour and a half.

But do you have any such similar policy that you have seen that looks or covers the same that you have received, or have—

MR. LATTIN: As far as backups, I have a policy—

THE SPECIAL MASTER: No. I'm talking about—what's the title of that document?

MS. WITTY: This says, at the top under “Subject,” “Record Retention and Disposal.”

MR. LATTIN: No.

THE SPECIAL MASTER: Have you—do you have anything around record retention or disposal within your purview?

MR. CLARK: No, not that I know of.

THE SPECIAL MASTER: Who would—and then—

MR. SCHAIBLEY: No.

THE SPECIAL MASTER: I mean, somebody has got to be setting your record schedule somewhere for how long you are keeping stuff, and it's got to be in writing somewhere.

MR. GODINO: Or for any kind of legal hold.

THE SPECIAL MASTER: We'll get into legal holds in a second. I just—I just want to understand at a very basic level, when you get a litigation holder, you get a litigation destruction notice, or you get—you don't keep data forever; right—let's go off the record.

THE SPECIAL MASTER: I'm going to order UMC to find me somebody within the IT department that sets the record retention schedules for e-mails, for BlackBerry messaging, for the different documents that are being sought here in this case. I'm very confident that everybody here wants to get that done.

I'm a bit mystified—strike that.

What I need from you guys is to find out what they are and who set them and what you are currently doing. Okay? Is that crystal-clear, Counsel for UMC?

MS. WITTY: Yes.

THE SPECIAL MASTER: Now we will take a break, because I said we would take a break.

With BlackBerry, I actually don't have any more questions until I get the additional data.

Does Plaintiff have any more BlackBerry-specific questions? Until I know how they are configured, what you are syncing, and how you are doing it, I don't have any more particular questions. But you do understand the order I gave, which is preserve—talk to counsel, get the list of custodians, and make sure they are being preserved now.

We'll touch on backup in a second.

Plaintiff, anything about BlackBerry?

MR. TOSTRUD: I just have a comment about BlackBerry that's very quick, and that is, it's been represented to us many times by counsel that e-mail messages which were being sent or received to or from a BlackBerry were absolutely going to the server.

THE SPECIAL MASTER: Okay. And we have clearly established in this hearing that they are going to go and verify that that is indeed what is happening. I'm sure counsel is not forthright-telling you what is wrong. It is clearly like—their CIO of UMC clearly is not the person syncing the servers and sharing the information, because he just said he is going to go check, and he is the person responsible for knowing and making that happen. Okay?

*109 Now we will take a break.

I do have one more BlackBerry-based question, which is I want to understand how new phones are put on and images are set and how the—why they need to be wiped and if you make a copy. So it's a purview—I'm giving you a preview of what my next questions are.

Let's go off the record.

THE SPECIAL MASTER: Back on the record. I have six questions for—Mr. Clark, I have six questions for you. They pertain to the BlackBerry images that get pushed.

Are you with me?

MR. CLARK: Yes.

THE SPECIAL MASTER: Have you had a chance to read the custodian interview forms?

Can Counsel Witty show him any one of the custodian interview forms where what I'm talking about comes up.

MR. CLARK: Okay. So I'm seeing something about BlackBerry updates.

THE SPECIAL MASTER: Okay. According to my understanding, when you push a BlackBerry update, what happens?

MR. CLARK: Push a BlackBerry update?

THE SPECIAL MASTER: Right there, the BlackBerry—what are you looking—Counsel Witty, what did you give him? Which one?

MS. WITTY: These are the ones that were provided to the special master in camera. It's regarding the updates and the dates for those updates.

Are you going to look specifically at—

THE SPECIAL MASTER: I just want one of them. Was Mr. Mumford in the one you provided? Let me look.

MS. WITTY: Are you talking about the updates?

THE SPECIAL MASTER: Yes, when the update wipes the prior—oh, yes, here we go. I found one. Can you please point yourself to Mr. Espinoza's chain of custody. I'll bring it over.

MS. WITTY: The chain of custody?

THE SPECIAL MASTER: No, sorry. Custodial interview.

Here you go (indicating).

MR. CLARK: Okay.

MS. WITTY: Do you want this too (indicating)?

THE SPECIAL MASTER: Perfect. So my question—so we're talking about the BlackBerry Curve 8530 on January 20th, 2011.

Do you see that?

MR. CLARK: Yes.

THE SPECIAL MASTER: Then it sends the 8530 on September 22, 2008. Now, irrespective of his technical prowess and his understanding of how the BlackBerry syncs to the server, what I want to understand is, when you update the phone, do they get wiped? Does the BlackBerry device ever get wiped by you?

MR. CLARK: No.

THE SPECIAL MASTER: Who would ever wipe a BlackBerry device if it's not wiped by you?

MR. CLARK: PBX would handle the handhelds.

THE SPECIAL MASTER: So then when a new update comes out, and let's say a BlackBerry update to the OS happens, okay? So the BlackBerry OS updates. How—when—on multiple custodial interviews, the custodians say that their BlackBerries were updated and the data was wiped, right, Counsel Witty?

MS. WITTY: Correct.

THE SPECIAL MASTER: Explain to me how that happens or how that's possible, either one of those.

MR. CLARK: My understanding is that when—they get the handheld back to PBX and PBX wipes them and then they put the latest OS on them and then get them up on the BES. So they do the updates that way, they wipe it because—

*110 THE SPECIAL MASTER: Do they—so you wouldn't know if they backed them up or anything?

MR. CLARK: No.

THE SPECIAL MASTER: And it's at the physical device level?

MR. CLARK: I'm sorry?

THE SPECIAL MASTER: It's at the device level?

MR. CLARK: Yes.

THE SPECIAL MASTER: When they wipe it, does that remove the messages from the server?

MR. CLARK: It should not.

THE SPECIAL MASTER: I would think not, because it would re-sync.

MR. CLARK: That's right. Again, like I said, all the messages on the server—on the Exchange server would sync to the BlackBerry handheld.

THE SPECIAL MASTER: And you are going to figure out how it actually syncs and what policies?

MR. CLARK: (Nodded head up and down.)

THE SPECIAL MASTER: So when they say it was wiped, it was a physical wipe done by the PBX team?

MR. CLARK: (Nodded head up and down.)

THE SPECIAL MASTER: I just want to understand, because we're going to get on the phone with her and I want to—I want to understand when there is one in 2013—well, multiple wipes in 2013, I just want to make sure you weren't the person wiping.

Have you ever wiped a BlackBerry device?

MR. CLARK: I have wiped Blackberries.

THE SPECIAL MASTER: For UMC?

MR. CLARK: For myself at UMC.

THE SPECIAL MASTER: For UMC. Not for your personal—I know you are in IT. I know that IT people do all sorts of things for their own. Has an UMC employee ever come to you and said, “Wipe my BlackBerry”?

MR. CLARK: I don't recall wiping a BlackBerry for UMC.

THE SPECIAL MASTER: Employee.

MR. CLARK: Yes.

THE SPECIAL MASTER: Okay. And to be clear, for any of these six people—and can you please list the six people?

MS. WITTY: It would be Brian Brannman, John Espinoza, James Mumford, Doug Spring, Jackie Panzeri, or Claudette Myers.

THE SPECIAL MASTER: What about the—who is the other admin?

MS. WITTY: You mean administrative assistant?

THE SPECIAL MASTER: Yes.

MS. WITTY: Cindy Dwyer.

THE SPECIAL MASTER: Was there two or one?

MR. PIXLEY: There were two.

THE SPECIAL MASTER: Have any of those people ever come to you and said, “Wipe my BlackBerry”?

MR. CLARK: No.

THE SPECIAL MASTER: That's all I needed. Thank you very much—no, thank you. That's what I needed to know. Perfect. Let's call her.

So would she be the person who would know, as far as you guys know?

MS. FOLEY: Yes.

MR. CLARK: Susie Kisner is the manager over Trina. She's the PBX supervisor. I believe Trina is the one who does the wiping of the handheld.

(Marilyn Susan Kisner now present via telephone.)

MS. WITTY: You are on speakerphone here with counsel for UMC, counsel for plaintiffs, and the Special Master in the Small lawsuit.

The Special Master has some questions for you regarding PBX and the BlackBerry updates.

THE SPECIAL MASTER: Okay. So, hi, Susie, this is Special Master Garrie.

How are you?

MS. KISNER: I'm good. How are you?

*111 THE SPECIAL MASTER: I'm all right. I'm inside, and it's sunny outside, but besides that, okay.

I want to make sure before we go forward, I want you to understand you are—I'm speaking to you as an Officer of the Court. So anything you offer or you state is being recorded for the record, it's like testimony.

You understand that?

MS. KISNER: Yes, I do.

THE SPECIAL MASTER: Okay. For the record, what's your full name?

MS. KISNER: Marilyn Susan Kisner.

THE SPECIAL MASTER: Okay. And just for the record, what is your job title at UMC?

MS. KISNER: IT customer support manager.

THE SPECIAL MASTER: Okay. And within that, are you responsible for PBX systems within UMC?

MS. KISNER: Yes, I am.

THE SPECIAL MASTER: Does that also include supporting the handheld BlackBerry devices themselves?

MS. KISNER: Yes, it does.

THE SPECIAL MASTER: Does it—are you aware of this ongoing litigation?

MS. KISNER: I am.

THE SPECIAL MASTER: When were you made aware of it?

MS. KISNER: The first discussion I had was probably last week.

THE SPECIAL MASTER: Okay. Has anybody at UMC told you to preserve the mobile devices before last week?

MS. KISNER: I'm trying to remember when. We were told to have them available for three people, I believe, and I want to say maybe a month and a half, two months ago.

THE SPECIAL MASTER: Okay. Do you have a list of every individual that has a smartphone within UMC that you support?

MS. KISNER: I'm sorry. Say that again?

THE SPECIAL MASTER: Do you have a list of every smartphone that you support within UMC?

MS. KISNER: Yes, I do.

THE SPECIAL MASTER: Can you please provide that to Counsel Witty for UMC?

MS. KISNER: Okay.

THE SPECIAL MASTER: By end of day today?

MS. KISNER: Yes.

THE SPECIAL MASTER: Now, I want to understand, when a user—and have—did you ever receive a litigation hold or preservation notice from anybody at UMC?

MS. KISNER: I don't believe I have, but possibly it came in to someone who works for me. That's possible. I don't know.

THE SPECIAL MASTER: Okay. Please check within the people that work for you as well and please read it yourself.

Counsel, please send her a copy, so she has it.

Within the scope of your duties and responsibilities, if a user—there has been updates to BlackBerry devices. Are you responsible for those updates?

MS. KISNER: Yes.

THE SPECIAL MASTER: Okay. When you update a device, do you back it up before you update it?

MS. KISNER: No.

THE SPECIAL MASTER: When you update a device, you do not back it up?

MS. KISNER: No, I don't believe we have backed up any mobile devices to date.

THE SPECIAL MASTER: So if you lose a CEO, you update the CEO's BlackBerry device—I want to understand—it's just gone, and too bad for him?

MS. KISNER: We don't back them up. We never have.

THE SPECIAL MASTER: Okay. So when they bring you a phone and they ask you to update it, what do you do?

*112 MS. KISNER: We do the update on it.

THE SPECIAL MASTER: I need you to walk me—I'm a technical person. I need you to walk me through in a little more detail than “we do the update.” I need you to walk me through the steps. I bring you the phone, and what do you do?

MS. KISNER: I don't have one in front of me. I would follow the—I'd go into “Settings” and—

THE REPORTER: I can't hear.

THE SPECIAL MASTER: Sorry, can you speak slower?

MS. KISNER:—“Security Updates,” and then I would—

THE SPECIAL MASTER: No, no. Sorry, Susie, just for the court reporter, can you repeat yourself again.

MS. KISNER: I would go into the “Settings” on the device and then to “Security Updates,” and I would apply them.

THE SPECIAL MASTER: And what if that would wipe—and were you aware or have knowledge that could result in the deletion of the data or messages on the device?

MS. KISNER: If it did, it did. We do not back them up and we—

THE SPECIAL MASTER: No, no. I asked are you aware that that happened.

MS. KISNER: It hasn't happened to date that I know of. I don't know.

THE SPECIAL MASTER: No. Are you aware that when you update a BlackBerry device, that it could, depending on how you configure the update, wipe everything that's on the phone?

MS. KISNER: Yes, it could.

THE SPECIAL MASTER: So you are aware?

MS. KISNER: Yes, it could.

THE SPECIAL MASTER: So yes, you—meaning “yes,” you know, or “yes,” you—

MS. KISNER: Yes.

THE SPECIAL MASTER:—what I just told you you heard?

MS. KISNER: What you just told me I heard, and I am aware that it could.

THE SPECIAL MASTER: Okay. That's all. Okay. Sorry for the confusion.

Have you been provided a list of all of the devices that if someone—of custodians that, if they do bring you a device, that you are to make a backup copy before updating them?

MS. KISNER: Well, I am aware that we are keeping a box of devices that we have pulled back because we don't want to do any kind of factory default wipe on them.

THE SPECIAL MASTER: I'm going to make it easy for you. I'm going to order you to do the following:

Counsel, can you please provide her a list of the individual custodians that are of interest to us in this litigation, with the explicit instructions that if she is brought any said device to be wiped, that she is to not wipe them until a copy has been made, a forensic copy has been created with MD5 hash values verified by whatever forensic expert you want, and that said copy has been verified and validated.

And then if she—I would recommend against wiping of it because of the potential downstream, but at the very least, I would like to be notified of this, if she does decide to wipe them.

Just so I understand, do you have access to the BlackBerry server itself?

MS. KISNER: I do.

THE SPECIAL MASTER: Okay. Do you have administrative control or access?

MS. KISNER: I believe I do.

THE SPECIAL MASTER: Do you use this—

*113 MS. KISNER:—utilize it, but I believe I have access.

THE SPECIAL MASTER: Have you ever used this access or control?

MS. KISNER: I have in the past; not the past probably two years.

THE SPECIAL MASTER: Okay. But in the past four years, you have?

MS. KISNER: I have.

THE SPECIAL MASTER: And what have you used your access to do during that time period?

MS. KISNER: Add users.

THE SPECIAL MASTER: When you add a user, can you please explain to me in a little more detail, what are you adding them to?

MS. KISNER: The BlackBerry server.

THE SPECIAL MASTER: Does that include the messaging?

MS. KISNER: Yes, or—so they would—so they would get their e-mails via that device.

THE SPECIAL MASTER: They have the ability to get their e-mail without that device using the IMAP SMTP settings anyway, if they add their password to their e-mail account.

Is that not correct?

MS. KISNER: It's not, according to our policy.

THE SPECIAL MASTER: I know. I'm not asking you according to your policy.

MS. KISNER: Yes.

THE SPECIAL MASTER: I asked you, if I have an iPhone, and I know your IMAP server, and I know the ports to connect to, and I have a password, and I went on Google, and I typed in “how do I configure my iPhone to check my e-mail,” and I had my own log-in and password, I would be able to do that?

MS. KISNER: On a smartphone through ActiveSync, that—

THE SPECIAL MASTER: Not through ActiveSync. I said through any phone, smartphone. I'm going to say the answer is yes, considering your Exchange administrator is sitting here and had just in the prior hearing told me the IMAP configuration did allow for that with a password, unless you believe differently.

MS. KISNER: Okay. I would agree that he would be the—

THE SPECIAL MASTER: I'm glad you agree. He knows what he's talking about. Through the entire hearing he's established that he's—

MS. KISNER: Yes, I would agree he knows what he's talking about.

THE SPECIAL MASTER:—he's established that he's technically competent and speaks well to UMC's ability to manage the Exchange environment. Just so I understand, for my own edification here, up until—has it always been your standard policy—do you have any policies or practices that are in writing around to how to manage BlackBerry or mobile devices?

MS. KISNER: We have a mobile device policy.

THE SPECIAL MASTER: Does that include record retention and record schedule?

MS. KISNER: No, it does not.

THE SPECIAL MASTER: Okay. Can you please provide that policy to counsel for UMC?

MS. KISNER: I believe I sent that to Cayla last week.

MS. WITTY: Should be in what was provided today.

THE SPECIAL MASTER: Okay. And do you follow that policy?

MS. KISNER: Yes, we do.

THE SPECIAL MASTER: Okay. And just so I understand, can I see that policy, Counsel Witty? I didn't see mobile devices covered in it. I don't mean to say they're not. I just ...

*114 MS. WITTY: It's at “Communication Systems.” There's a “Loss of Communication Systems,” and there's a—

THE SPECIAL MASTER: Oh, here it is. “Communication Failure.” Is that what you're referring to?

MS. WITTY: There was a “Loss of Communication Systems” and a “Communication”—

THE SPECIAL MASTER: Oh, yes. There we go, “Loss of Communication”—okay.

I understand for loss of communications. I'm talking about the support and maintenance and preservation.

So a new employee joins—

MS. KISNER: It is “Appropriate Mobile Device/Smart Phone Use.”

THE SPECIAL MASTER: Okay. The title is “Loss of Communication System.” Am I looking at the right document?

MS. KISNER: Not for mobile device. Are you still looking for the mobile device policy?

THE SPECIAL MASTER: Yes.

MS. KISNER: It is I–207.2, “Appropriate Mobile Device/Smart Phone.”

THE SPECIAL MASTER: I have “Appropriate Internet Use.” I don't have the policy you are referring to.

Can you repeat yourself again, the number?

MS. KISNER: I'm sorry?

THE SPECIAL MASTER: Can you please repeat the name of that—number of the policy?

MS. KISNER: It is I–207.2.

THE SPECIAL MASTER: Okay. One more time.

MS. KISNER: I–207.2, “Appropriate Mobile Device/Smart Phone Use.”

THE SPECIAL MASTER: Okay. I'll have to look that over, because I haven't seen it. One second. Thank you.

THE SPECIAL MASTER: This policy doesn't speak to the wiping and support of these. Do you have a policy around the wiping and support of mobile devices?

Nowhere in this policy, as I've read it, does it talk about when you will be wiping, updating, or etc., to the mobile devices. Do you have any policy that states how or what—

MS. KISNER: I don't believe there is a policy.

THE SPECIAL MASTER: So—that's fine. It's not—it's okay if there is not. I'm just trying to understand.

So then I get this—you—they—I'm just trying to understand how it works, because my focus and what I've been tasked with is to make sure that we have all of the right mobile devices relating to the custodians preserved.

You'll get a list, so we've got that covered. I'm just trying to understand.

So I have context. An executive will come to you, and they will say, “I've lost my phone.”

If they have lost their phone, what do you do?

MS. KISNER: We do an over-the-air wipe from the BlackBerry server.

THE SPECIAL MASTER: Do you log that?

MS. KISNER: I'm sorry?

THE SPECIAL MASTER: Do you log when you do this?

MS. KISNER: I haven't done that, but I would assume that, yes, that it would be logged. There is a security report that they have to do for losing that device and, of which, at that point when we receive that, we would do—if we couldn't wipe it over the air, then we would call Sprint and have them do an over-the-air wipe of the device.

THE SPECIAL MASTER: You would call who? I'm sorry.

*115 MS. KISNER: Sprint.

THE SPECIAL MASTER: What's—

MS. KISNER: Sprint is our cellular carrier.

THE SPECIAL MASTER: Oh, Sprint. Sorry.

Did users connect their device to their lap—to their computers to sync their—

MS. KISNER: No.

THE SPECIAL MASTER: How did they sync their calendars?

MS. KISNER: They sync them over the air through the BlackBerry server. They are not allowed to connect it to their computer. We don't allow people to connect anything into their USB devices. That sends this to security. And you can speak with them, Dean, regarding that, but I believe that they receive a notification when somebody tries to plug something into their USB port.

THE SPECIAL MASTER: Yes, that's passive versus active. The question that we're working, and I'm going to get further answers to, is if there is a log—in the transcript from Friday—but I'm expecting a log of the USB device's connectivity association with each of the six custodians, for my own edification.

But we will—so I'm—or like, if we covered that on Friday, this is nothing to do with you. Excuse me one second.

I am ordering you to provide me as special master a list of USB device connectivity given the issue with the mobile devices that we have had to date for the custodians because there is no backups of any of the wipes that were done internally by your department. That's correct; right?

MS. KISNER: Yes.

THE SPECIAL MASTER: That kind of clears up wiping.

So I mean, when they say they do an “update,” just so I get it, I need an update. I bring you my phone, and I say, “I need you to update my BlackBerry operating system.”

You would not back up their device. You would just simply wipe their device and put the new update on?

MS. KISNER: Correct. And then they would—that's correct. And then as it completes, then it would just reload their calendar and their e-mail account.

THE SPECIAL MASTER: It would sync somehow between all of—which we've—

MS. KISNER: It does sync; correct.

THE SPECIAL MASTER: And are you aware of the sync? Do you know what the policy—

One second and we'll get to your question—or do you have a question?

MR. FORREST: Well, I was just wondering if she recorded whenever she did such an update or what.

THE SPECIAL MASTER: So do you have any record or log of any wiping that you have done?

MS. KISNER: No, I don't believe we do.

THE SPECIAL MASTER: Who's—are you responsible for doing this?

MS. KISNER: For wiping the devices? Yes. It's part of a process or a procedure.

THE SPECIAL MASTER: Well, I mean, luckily Sprint—lucky for us, Sprint tracks all of that in detail. So if you don't have it, we can go to the third party and get it.

MS. KISNER: Okay.

THE SPECIAL MASTER: Are you sure you don't have it?

MS. KISNER: I don't believe we have it, no.

THE SPECIAL MASTER: Can you check?

MS. KISNER: I can check, but I'm pretty sure we don't have it. You want us to go back to our carrier?

*116 THE SPECIAL MASTER: Yes.

MS. KISNER: Okay. We can do that.

THE SPECIAL MASTER: Okay. Just so—who sets the policies here for how long e-mails are allowed to sit on the BlackBerries?

MS. KISNER: I have never set any policy. I think it's on—it may be from the BlackBerry server.

THE SPECIAL MASTER: Well, I can promise you that he's not setting the policies, because he's sitting here and I asked him who's setting the policies.

MS. KISNER: Then I don't know.

THE SPECIAL MASTER: Let's go off record for one second.

(Marilyn Susan Kisner no longer present telephonically.)

THE SPECIAL MASTER: Let's go back on the record.

I'm going to order UMC's counsel to figure out with UMC's IT department and operational executives who the individuals are that set the policies that are then either been configured—well, we've established at least since June of 2012.

And how long have you been responsible for the BlackBerry server?

MR. CLARK: Since its implementation, back in, I don't remember what year, but it's been quite a while ago.

THE SPECIAL MASTER: 2010?

MR. CLARK: Probably around there or earlier.

THE SPECIAL MASTER: For sure 2010.

Well, whoever—I mean, yes, 2010? 2011?

MR. CLARK: I think 2010.

THE SPECIAL MASTER: Let's be safe.2011?

MR. CLARK: Yes.

THE SPECIAL MASTER: Okay. So someone told you what the policies are or set the policies before you took control of it. I need to know what those policies were that were set, because the alternative that remains is that I can have some third-party expert come on-site and get me all of my answers, and I'd like to avoid—

MS. FOLEY: We understand, and we'll endeavor to do that.

THE SPECIAL MASTER: Yes. I'd like to avoid costing you hundreds of thousands of dollars, which is what it will cost to have someone to come in and learn your entire IT infrastructure simply to get me these answers. All right. That is not my desire.

My desire is to get through this as quickly and cost effectively as possible, but we need to know the very basics; right?

With regards to the mobile devices, I don't think there is a lot more to be said. I know that you guys told—I know at least I told the CIO at our very first hearing that there was an expectation for preservation, and I know that was more than two weeks ago.

So I'm a little surprised and shocked that he failed to tell the person that's responsible for wiping them and give her a list.

Now, why he didn't bother to do that, even though I ordered him and the judge ordered him to make sure that that was the case. I am going to repeat the order.

For purposes of clarity and succinctity, I'm ordering UMC to provide a list of custodians and their devices to the people within UMC's organization responsible for wiping and to have them cease such behavior. And if they do want to wipe, create a forensic image with MD5 hash values, and I would advise against doing it, but at the very least, make a bit-level forensic copy, as I earlier stated.

*117 Okay. Does plaintiffs have anything substantive they want to add?

Okay. Perfect.

Now, we have covered the BlackBerry environment, I think, for the most part. So basically when they said “updating,” what they really were doing is they were taking the phones in to the head of customer service, saying, “I need my”—she gives them the phone, and she basically just wiped everything off their phone, didn't make a copy, and on the merry way she went.

I just—that's as I understand it. I mean, you guys all heard the same thing I heard. Is there anything that you have that I didn't hear that you were involved with—were you ever involved in this process?

MR. SCHAIBLEY: No.

THE SPECIAL MASTER: Were you ever involved in this process, the wiping?

MR. CLARK: Wiping, no. I'm—

THE SPECIAL MASTER: That she just described to me with the PBX, I come, she—they get a phone, they wipe it. Were you ever involved in that process?

MR. CLARK: No. I did my own—

THE SPECIAL MASTER: No, no. I wipe my phones every three months and religiously dispose of them every night. So I do—I get personal. I'm talking about for any of the six individuals which you already said “no” to.

MR. CLARK: No, I did not wipe any of those individuals.

THE SPECIAL MASTER: And you, sir?

MR. LATTIN: No.

THE SPECIAL MASTER: Okay. Without any further ado, let's switch to backup because there's nothing like talking about with regards to mobile. But I do want that order, and I want the CIO to sign receipt of this order and that it has been done. Okay? Because I just got off the phone with this lady and she was like, “I heard about a week ago,” and she still doesn't have a list of the people.

And please provide a copy to her of the preservation letter notice so she has one.

Okay. Backup. Let's start at the beginning of the backup.

How long have you been there?

MR. LATTIN: I've been doing the network side which includes the backup since December 2008.

THE SPECIAL MASTER: Okay. When we say “backup,” let's be clear. We're talking server backups, computer backups, or all backups?

MR. LATTIN: The workstations themselves, we don't back up. It'll be just servers.

THE SPECIAL MASTER: So if there is backup done, are you the go-to person?

MR. LATTIN: Normally, yes.

THE SPECIAL MASTER: Normally?

MR. LATTIN: There is one other network individual that could do it, but it's normally me.

THE SPECIAL MASTER: Would you oversee—do you write—let me try this differently.

What backup systems do you use?

MR. LATTIN: Currently we are using CommVault.

THE SPECIAL MASTER: Which version? 10?

MR. LATTIN: Version 10.

THE SPECIAL MASTER: What pack? I'm just kidding.

MR. LATTIN: I can tell you.

THE SPECIAL MASTER: So you are running CommVault. You are upgrading, I heard, to Simpana or some archiving that you're rolling out.

MR. LATTIN: Yes. They're looking at the archiving feature.

*118 THE SPECIAL MASTER: But if I needed a backup done, be it of a local computer, of a mobile device, or a network file server, you are my go-to person?

MR. LATTIN: Correct.

THE SPECIAL MASTER: Okay. We're going to start at the very beginning and get all the way to the end.

Let's first take care of the mobile phones, because this is clearly the one—they would over-the-air wipe them, and they would never get connected to outside of the BlackBerry server, as far as I can tell. But we're going to get a log. There is a chance that maybe the users didn't follow IT policy, and they connected their phones and may actually have a copy there.

Otherwise, the only place we have a copy is sitting on the BlackBerry server, unless I'm missing something. Is that incorrect? From either the Exchange—anybody—

MR. SCHAIBLEY: That sounds correct, yes.

THE SPECIAL MASTER: And Mr. Clark, is that correct? You want me to repeat the question?

MR. CLARK: Yes, please.

THE SPECIAL MASTER: Can you read the question back, please?

THE REPORTER: It might take a minute. Hang on.

THE SPECIAL MASTER: I'll just repeat it:

My question again is, as I understand it, based on the conversation I just had with Stephanie and the conversations I've had with you, with everybody from UMC, the group, the BlackBerry environment today, when somebody wipes their phone, when that wipe happens, the only place any information could actually sit for that phone today would be on the BlackBerry server environment or the Exchange mailbox?

MR. CLARK: That's correct. Or through possibly—

THE SPECIAL MASTER: And that's it?

MR. CLARK: Yes.

THE SPECIAL MASTER: You are responsible for the BlackBerry server backups?

MR. LATTIN: Yes.

THE SPECIAL MASTER: And then a SQL clustering as well?

MR. LATTIN: Correct.

THE SPECIAL MASTER: How does the backup happen?

MR. LATTIN: Normally, we have—let's just start—describe the policy.

THE SPECIAL MASTER: Yes, the policy as implemented.

MR. LATTIN: We do a full backup every Friday evening, and then Sunday through Thursday we do an incremental, so all the changes on the servers are during those days.

As far as the BES server, I believe that was on the virtual environment, Jason, or it is on the virtual environment?

MR. CLARK: All BlackBerries have been virtual since day one.

MR. LATTIN: So in CommVault, you have—retention for at least the data backup retention goes by cycles and days. So on that—

THE SPECIAL MASTER: Do you pull tapes?

MR. LATTIN: Not currently, no. We're all spinning discs, all magnetic media. It's hard drives, sorry. Backing up to hard drives, not tapes.

THE SPECIAL MASTER: You've always backed up to hard drives?

MR. LATTIN: Since I've been there, yes. They had a tape drive when I first started, but it was out of date and we weren't able to use it anymore, so we just moved to—

THE SPECIAL MASTER: I need a date. When did you start? Sorry.

*119 MR. LATTIN: December 5th, 2008.

THE SPECIAL MASTER: Okay. So during the relevant time period, they were writing to disc?

MR. LATTIN: Correct.

THE SPECIAL MASTER: Did they backup the discs?

MR. LATTIN: No. That's just the one—

THE SPECIAL MASTER: Do you DR the discs?

MR. LATTIN: We have—the only policy we have right now is data that resides in our on-site data center gets backed up to the colo area. We have two separate backup systems. Anything residing primarily at the colo gets backed up in the data center side.

THE SPECIAL MASTER: Okay. So walk me through. Daily, weekly, monthly.

MR. LATTIN: Most of the servers, as far as Windows, go—

THE SPECIAL MASTER: We're talking about BlackBerry.

MR. LATTIN: I'm sorry, the—

THE SPECIAL MASTER: We'll get to all the other servers in a little bit. The BES server for -

MR. LATTIN: Sure. BlackBerry, if it lived on the virtual—or if it lives on the virtual environment, it would be backed up the Friday and then incrementals during the week. And the default retention policy for that one is 28 days and three cycles. And a “cycle” is defined as the time between a full backup, so it would be three Fridays minimum.

THE SPECIAL MASTER: So you only have going back 28 days?

MR. LATTIN: Correct.

THE SPECIAL MASTER: For HIPAA you only have it going back 28 days?

MR. LATTIN: That's—yes. That was the only policy we have towards the—for data retention.

THE SPECIAL MASTER: Let's go off the record.

THE SPECIAL MASTER: Let's go back on the record.

It's not within the purview of my—

MR. LATTIN: Yes.

THE SPECIAL MASTER: Okay. So then we basically have no records of anybody's BlackBerry or anything going past 28 days?

MR. LATTIN: If it's been removed off the server; that's correct.

THE SPECIAL MASTER: I'm assuming everything I'm talking to you about has been removed off the server, and I'm looking at the backup discs because that's the only place the information exists in the whole wide world.

MR. LATTIN: Right.

THE SPECIAL MASTER: Do you never do an annual backup, no—no annual snapshots?

MR. LATTIN: No. There's certain servers we have like one yearly backup, but that wouldn't be one of them.

THE SPECIAL MASTER: Would Exchange be one of those?

MR. LATTIN: Exchange has a little bit longer retention policy—

THE SPECIAL MASTER: No, no, I got—we'll get—

MR. LATTIN: Oh, no, not for—

THE SPECIAL MASTER: This is the annual backup; right?

MR. LATTIN: No.

THE SPECIAL MASTER: It's not with the Exchange either?

MR. LATTIN: No, we don't have. So I misunderstood the question originally when you—so just like do a yearly one and keep that for a certain amount of time?

THE SPECIAL MASTER: Right. Well, like every year you make a backup snapshot of your entire environment?

MR. LATTIN: No, we don't have that.

THE SPECIAL MASTER: Like January 2nd, you say, “Okay, we want a snapshot of January for what happened prior year” or December. Usually you do December 31st just to cover—

*120 MR. LATTIN: Okay.

THE SPECIAL MASTER:—and you keep that snapshot for a full year. Some people keep it for a total of seven years, depending on the records that are required.

MR. LATTIN: Yes, we don't have any policy implemented to do that.

THE SPECIAL MASTER: So I get this.

Okay. And do you receive litigation hold notices?

MR. LATTIN: No.

THE SPECIAL MASTER: Can you provide him a copy of the litigation hold notice, and the custodians?

MR. LATTIN: (Nodded head up and down.)

THE SPECIAL MASTER: So there is no way to get data that's 30 days old, basically, from the BES server?

MR. LATTIN: Not for that, no.

THE SPECIAL MASTER: From the BES server, there's no way to get data that's 30 days old?

MR. LATTIN: No, not for that.

THE SPECIAL MASTER: Okay. We're done with the Blackberries and moving forward, unless you guys have any further questions about the BlackBerry backup.

All right. Let's go to e-mail.

Moving forward, do we have time? We're good? Give me 10–minute notice, that way I can—10–minute warning.

Okay. Moving on to—actually, before we get to e-mail, let's talk about users. I'm a senior executive hanging out at my house. I'm told that there is nothing at my house that would be on my computer, like if it's—I don't have a work laptop or whatever. I only have desktops.

Do you guys back up any laptops?

MR. LATTIN: No.

THE SPECIAL MASTER: How does it work for an individual at a desktop sitting at some—I'm sitting in my office. Pretend this is my office. I'm hanging out, and I finish writing this huge treatise on Syrian conflict, and I wrote it, and I'm really proud of myself. I go home, and then, for whatever reason, it goes bye-bye, gone. How does the backup work from my end?

And I didn't save it to my home drive. Yes, I saved it to my C drive. I saved it to C:/DanielSyrianpolicies/version011.docx.

MR. LATTIN: Yes, Unfortunately, if it wasn't saved to the home drive on the file server, we wouldn't have a backup.

THE SPECIAL MASTER: So you don't back up anything from the local computer?

MR. LATTIN: There are probably four or five select, like, workstations that we have backed up, I had used for just testing, my personal one—

THE SPECIAL MASTER: Testing is different. I get the fact that you've got to test to make sure the backup works. I'm talking about—okay. Let's list the six custodians. Let's just make sure. Can you list them again, the chosen ones?

MS. WITTY: Brian Brannman, John Espinoza, Doug Spring, Jackie Panzeri, James Mumford, Claudette Myers, and Cindy Dwyer.

MR. LATTIN: And none of those would be would backed up.

THE SPECIAL MASTER: Okay. So if I save something to my local drive, but now I learned on Friday that's not—at the time period in question, it wasn't encouraged. As of today, is it not possible?

MR. SCHAIBLEY: It will be not possible as the computers are upgraded to Windows 7.

THE SPECIAL MASTER: Let's go off the record.

THE SPECIAL MASTER: Back on the record.

So today, so I get it, a user has the ability to save documents to anywhere they want on their local desktop if they so desire, if they haven't been upgraded?

MR. SCHAIBLEY: I wouldn't say anywhere they wanted.

THE SPECIAL MASTER: Well, outside of the Windows administration folders, they could save it to their local drive.

MR. SCHAIBLEY: They could save it locally to the desktop or to the—under their profile; correct. THE SPECIAL MASTER: Or not even under their profile, could they save it to the—

MR. SCHAIBLEY: Yes.

THE SPECIAL MASTER: Okay. So it is possible for them to save it to their local C drive anywhere they want, as long as it's not within the Windows administration folders and other folders that you prevented them from accessing?

MR. SCHAIBLEY: Yes.

THE SPECIAL MASTER: Okay. But you don't back that up anyways?

MR. SCHAIBLEY: No.

THE SPECIAL MASTER: Just making sure I get it. All right.

But you do have a network file share. Each user, now, so I get this, they get a—they have a user profile. You use an Active Directory; right?

MR. SCHAIBLEY: Yes.

THE SPECIAL MASTER: So you have an Active Directory system?

MR. SCHAIBLEY: Yes.

THE SPECIAL MASTER: Now I have a question, and then I'll—if you have a question.

With the Active Directory profile, it specifies that every user has their own personal drive; right, I'm assuming?

MR. LATTIN: Yes.

THE SPECIAL MASTER: And that gets backed up?

MR. LATTIN: Yes.

THE SPECIAL MASTER: How does that backup work?

MR. LATTIN: As far as the—all their files on the file server?

THE SPECIAL MASTER: Well, whatever, yes.

MR. LATTIN: Yes, the Active Directory, they will be redirected to the file server for their personal My Documents, then that's under the same type of schedule, on Fridays.

THE SPECIAL MASTER: 30 days is all you've got?

MR. LATTIN: I believe that one is four months.

THE SPECIAL MASTER: Yes, I think—on the documents provided to me, it was.

But you have no annual or semiannual backup?

MR. LATTIN: Correct.

THE SPECIAL MASTER: You basically have no data going back more than 12 months?

MR. LATTIN: That's correct.

THE SPECIAL MASTER: Unless it's on their local computer?

MR. LATTIN: Yes.

THE SPECIAL MASTER: How does preservation work, then? Well, you answered that question.

I have a—I don't get how UMC—I guess once the script is run, you assume you have it all and you have a copy, I guess.

MS. FOLEY: Do you leave it sitting on the server for a long time, or no? It's on the server?

MR. LATTIN: Yes, that, I wouldn't know. That's all handled by—

MR. SCHAIBLEY: Are you referring to, like, the data collection we did?

THE SPECIAL MASTER: The data collection you moved to a secure server that only IT security has access to.

MR. SCHAIBLEY: Correct.

THE SPECIAL MASTER: But if I didn't do a network file share collection, right, of the network file profile—if I didn't collect, I'm part of the payroll group, and your script didn't collect the payroll group file shares?

*122 MR. SCHAIBLEY: They did not.

THE SPECIAL MASTER: All right. But just as an example, right, I don't know who the network—oh, that's one thing.

UMC, I'm going to—Counsel, you—

And we'll get to yours in a second.

I need you to go and find out what network file shares are relevant and responsive.

MS. WITTY: We're already working on that.

THE SPECIAL MASTER: Okay. Good.

And then I need you to collect them.

MS. WITTY: That's already been—

THE SPECIAL MASTER: I need you to pull the backup from four months ago from that disc once you get those file shares.

MR. LATTIN: Okay. It's 112 days or 15 cycles, so ...

THE SPECIAL MASTER: Okay. Well, then as soon as they get it for you, I need you to pull it from your tape as well.

MR. LATTIN: Absolutely.

THE SPECIAL MASTER: Just pull a copy of your tape, so that way I have something at least that's—okay? We don't need to do anything with it. Just make a copy of it.

MR. LATTIN: Okay.

THE SPECIAL MASTER: All right. Now, I don't get—how does it—you are responsible also for the clinics' backup?

MR. LATTIN: For the connectivity?

THE SPECIAL MASTER: No, their backup. Like if I'm running a—you have clinic and satellite offices. How does that work? You have—UMC has clinics; right?

MR. LATTIN: Correct.

THE SPECIAL MASTER: Are you—do they back up data at those clinics?

MR. LATTIN: All the servers, they all connect directly to the main campus, so all the servers and stuff would reside there.

THE SPECIAL MASTER: I run a clinic. I'm the manager at a local office. I have people that work for me, etc. Is there a diagram that explains to me how the clinic systems work?

MR. LATTIN: I have a basic diagram of how it's all tied into the UMC network.

THE SPECIAL MASTER: That would be fantastic.

MR. LATTIN: But, yes, because it—we all operate as basically one big organization. The clinic, in terms of the network, it all looks the same to us so—

THE SPECIAL MASTER: I just want to—that's all I want to know. I just want to understand how you actually organize data.

We're going to put this in as an exhibit.

MR. LATTIN: Just kind of threw this together. It's a little rough. But there on the right-hand corner, we have Enterprise, Nellis, Spring Valley, all—that's all of our clinical areas, Quick Cares, and then they connect directly back to our core of our network, which is in the center.

THE SPECIAL MASTER: And they have servers locally there that connect?

MR. LATTIN: No. All the servers reside in our—either our data center on the main campus or—

THE SPECIAL MASTER: Do you have dumb terminals, then, at every clinic?

MR. LATTIN: Normally be on, you know, Windows XP or, more recently, 7 box that they connect to.

THE SPECIAL MASTER: So they're not terminals. They're like boxes?

MR. LATTIN: It's a full workstation, yes.

THE SPECIAL MASTER: All right. So—but everything those workstations connect to, there is no connectivity run out of the local clinic at a server level?

*123 MR. LATTIN: It all runs back to the main campus Exchange.

THE SPECIAL MASTER: Everything?

MR. LATTIN: Correct.

THE SPECIAL MASTER: So we'll get back to that, because that's actually in the transcript. I want to just touch back on the preservation.

Do you have a question?

MR. TOSTRUD: Yes, I would like to enter into evidence an e-mail from Lonnie Richardson to Plaintiff Dan Small dated Friday, March 21st, 2014. This was provided us also by Mr. Small, and it relates the right to the documents and files stored on local C drive. I provided a copy to defense counsel before the break.

THE SPECIAL MASTER: Would counsel like an affidavit as well for this?

MS. FOLEY: Yes, please.

THE SPECIAL MASTER: When you provide an affidavit—when you write the one affidavit for Mr. Small, can you please have them make—

MR. TOSTRUD: Can we just include both exhibits in one affidavit?

THE SPECIAL MASTER: That's fine. As long as the who, what, when, and where ...

MR. TOSTRUD: Yes.

THE SPECIAL MASTER: Do you—UMCPost, who is on that list?

MR. SCHAIBLEY: Everybody with a mailbox.

THE SPECIAL MASTER: All right. So now I know you've seen this. So, basically, as I read this—have you seen this, Counsel?

MS. FOLEY: I have not seen it.

THE SPECIAL MASTER: Here, take my copy if you want.

MR. TOSTRUD: Ms. Witty has seen it.

THE SPECIAL MASTER: This is a huge step forward. We have a network ...

Did everyone have a chance to read it? Did you read it?

MR. LATTIN: Yes.

THE SPECIAL MASTER: Okay. So from a backup perspective, you don't back up the local computers?

MR. LATTIN: Correct.

THE SPECIAL MASTER: What is included in your backup, just for my own—do you have a list of everything that you are backing up?

MR. LATTIN: I can—yes, I have most of it. Normally we just do, you know, a slash, which backs up everything on the server.

THE SPECIAL MASTER: What server? All the servers?

MR. LATTIN: The majority of them, yes. I have the giant list here, but, yes, I could probably present—

THE SPECIAL MASTER: I don't want another giant list. No more giant lists.

MR. LATTIN: I could present a more concise list of all the servers that are getting backed up.

THE SPECIAL MASTER: But none of these servers are actually kept for more than a year?

MR. LATTIN: With the exception of a couple of the UNIX servers that pertain to this.

THE SPECIAL MASTER: What are they for? Billing?

MR. LATTIN: What are the UNIX—UNIX servers, seven-year on that one?

MR. CLARK: Yes, we have seven-year policy on the UNIX servers and a one—

THE SPECIAL MASTER: System V? May I ask, what kind of UNIX?

MR. CLARK: AIX HP–UX.

THE SPECIAL MASTER: Superdome?

MR. CLARK: No, we actually don't. We've got even an old Solaris.

THE SPECIAL MASTER: Really? What sits on the UNIX boxes?

*124 MR. CLARK: AIX is mostly ancillary operating packages like for the lab, MSAT, which is for the ER. We have a SAP ERP box to transfer data to the County on a homegrown product for file transferring.

THE SPECIAL MASTER: You said “SAP”; right?

MR. CLARK: Yes.

We call it UMPRP01. We transfer files and receive files from the County.

THE SPECIAL MASTER: So it's your SAP sync box?

MR. CLARK: Uh-huh. And then we have another AIX box, two of them for a JCAPS, which is our Enterprise interface engine, and that covers all the AIX boxes.

THE SPECIAL MASTER: Okay. So beyond those, that's it? That's all you keep for a year—or seven years, actually?

MR. CLARK: Yes.

MR. TOSTRUD: Counsel, do we have the original desktops for the custodians?

MS. WITTY: The desktops that they currently use are the desktops that they've been using throughout the period, yes.

THE SPECIAL MASTER: And they've all received preservation notices?

MS. WITTY: Yes.

THE SPECIAL MASTER: Did they sign they received it?

MS. WITTY: It is—no, but we can document when they received it.

THE SPECIAL MASTER: Please do it, just for everybody's sake.

Before I talk about your e-mail that you provided, I want to talk about backup tapes. Do you use any third-party backup services, like Mozy or anything like that?

MR. LATTIN: No.

MR. TOSTRUD: Plaintiffs have any questions?

MR. FORREST: I'm just wondering, there have been references between XP and Windows 7. Are all the 26, or the 6 and 7, are they all still on XP?

THE SPECIAL MASTER: When we get the custodian interview form—the chain of custody will document the systems from which—actually, it won't. Thank you. I need to know, like he's wanting—well, ask your question and then I'll—

MR. FORREST: Okay. Are all of the relevant 26 custodians, plus or minus Myers and/or Dwyer, whatever, are all of their desktops currently running XP?

THE SPECIAL MASTER: You can say “I don't know” and “I have to check.”

MR. SCHAIBLEY: Yes, I need to get back to you on that.

THE SPECIAL MASTER: Can you please just check and put together a list to provide to counsel and circulate it?

MR. SCHAIBLEY: Yes.

MR. FORREST: It might be a good idea not to update any of those desktops that have—

MS. WITTY: We've already addressed that.

THE SPECIAL MASTER: We've already taken care of that.

Who was in charge of the updates on the actual—on the ground doing the work?

MR. SCHAIBLEY: Which updates?

THE SPECIAL MASTER: If I—before you swap out any of the custodians' boxes, who would do it?

MR. SCHAIBLEY: Our desktop support team.

THE SPECIAL MASTER: Can you please make sure the desktop support team gets the litigation hold notice, signs receipt of it, and there is no confusion, because we have tried through the CIO level, and I have concerns that the message may be getting lost.

MR. TOSTRUD: May we also get the names of the people who are on that team?

*125 THE SPECIAL MASTER: The desktop manager. I don't need all of the people. I just need—when they get the—

MR. SCHAIBLEY: The desktop manager is Susie Kisner.

THE SPECIAL MASTER: Oh, Susie. We already spoke to her this morning.

MS. WITTY: And that's all included within the IT org chart.

THE SPECIAL MASTER: Exactly. So I just want to be clear. My immediate concern, so we don't have another conversation like I just had on the phone, and that they know not to do anything.

So anything more relating directly to the backups?

MR. TOSTRUD: Just as Plaintiffs' counsel and we have an obligation to our class to protect the class, we would ask that mirror images be made of all those desktops, whether you are going to order it or not, but it's up to you, but I'm just on the record making that request.

THE SPECIAL MASTER: I do want to discuss this e-mail because this e-mail suggests or indicates that people don't actually follow your storage policies.

I'll give UMC a chance to review the e-mail, and I would like to—if you could do me a favor. Anybody within UMC's IT team, explain to them what exactly is happening and then we can revisit this.

Let's go off the record for a second.

(LUNCH RECESS.)

THE SPECIAL MASTER: So on the record.

I'm going to order UMC to preserve and create forensic images—before I get to that, I'm going to order UMC to create a spreadsheet of all 26 custodians that have their full name, their device, the operating system version number on it, for any user who doesn't have a computer that's dedicated to them, meaning in their office, within, that they sit and log in—that they log in and access more than 10 times a month, that they physically go to and sit in, that's what constitutes a computer for a user, meaning it's in their office and they sit down and use it. Or I want another table created—or in addition, I want another table created that identifies any computer that any one of those 26 individuals, again with their first name, their last name, the operating system version number that has been—that is accessed more than five times by that user in a single month.

If it turns out that every one of the 26 custodians is accessing—we'll see what the data comes back as. The goal here is to identify the computers that are used by these custodians on a regular basis to perform their duties.

And this is largely based on my belief that by an e-mail provided by plaintiffs that's speaking to the current issues at UMC with regards to user behavior—with regards to user behavior and how they are saving things.

I'm also ordering UMC to provide an affidavit to provide me context for the e-mail and why it was sent and what the reasoning was, meaning was there some issue that came up, is it because of—whatever the reasoning was, to give me a context for the e-mail. Okay?

I'm also going to order for the next hearing, whatever dates we will set, leaning towards the 24th and 25th of April, that we—that the CEO and CIO make themselves here and present and available.

*126 I am very disappointed and frustrated by the fact that UMC, despite counsel for UMC's repeated attempts, my repeated attempts to try to figure out the most basic knowledge, including, but not limited to we had a conversation earlier today when the manager—customer support manager said she was contacted last week where she was informed that she shouldn't be recycling or wiping.

Whether or not that has happened or not, which I make no judgment as to whether it's happened or not, it's not acceptable because we had a hearing on March 10th where the CIO was here, where both the Court and myself ordered him to inform his employees immediately therein to preserve and cease all potential spoliation of mobile devices and anything else.

That clearly was not done because on the record we had testimony today where she did not receive such notice until last week. I want them both here and present so they understand the gravity and importance of the situation.

My order will be reflected as such; and when I issue my order based on the hearings in the last two days, it will be included in there as well.

I now open it for any requests and additional comments. Counsel?

MR. TOSTRUD: Plaintiffs' counsel would simply request an addendum and the addition of potentially three names to the list of 26 custodians that you have ordered to be preserved, their local drives, local computers be preserved. When we reached initial agreement on the list of 26 custodians, that was done several months ago.

Since that agreement was reached, we've learned a tremendous amount about this litigation and preservation efforts, or lack thereof, at UMC.

So we would request that, at a minimum, Lonnie Richardson, who is the author of the e-mail you just referred to, Exhibit 10, I believe it is, we ask that his local drive be mirror-imaged or copied or preserved.

We would also ask that Ernie McKinley, if he's not on the list, that his be preserved and copied.

And I think, importantly, there is a new CEO at UMC, and I don't know who the person is. It used to be Brian Brannman, but whoever that new CEO is. Maybe you guys can tell us who that is.

MS. WITTY: The new CEO at UMC is Lawrence Bernard, B-e-r-n-a-r-d.

MR. TOSTRUD: I believe he was on the list; correct? Was he on our list of 26 custodians?

MS. WITTY: No.

MR. TOSTRUD: Okay. That, to me, seems to be an obvious one.

THE SPECIAL MASTER: I'm going to take it under advisement.

Do you have anything you would like to respond with?

And let me be clear. Just so I understand from our last hearing, which we haven't fully gone through, the initial list of custodians was what was suggested by plaintiffs and you, and then you got—and so if you want or have any comments as to each of the three individuals, I'd welcome them.

MS. WITTY: With regard to those three individuals—

THE SPECIAL MASTER: I would like an affidavit, by the way, from plaintiffs explaining why each one of those individuals would be considered, for my records, because I don't know anything about any of the individuals.

*127 MR. TOSTRUD: Certainly.

THE SPECIAL MASTER: I'm not going to issue a finding or order today around it.

MS. WITTY: With regard to those three individuals, Lonnie Richardson has not been with UMC and was not with UMC during the relevant time period to this lawsuit. He is new to UMC within the past eight months. I believe he started in October of 2013.

THE SPECIAL MASTER: So he wouldn't have made any records?

MS. WITTY: Ernie McKinley is the chief information officer. And while I understand the perspective from the preservation and ESI discovery standpoint, I'm not sure that his collection would regard any relevant material with—as to the claims of this lawsuit.

The CEO, understanding that he is currently in a position of authority, his role would not have covered—again, it would not overlap with the time period relevant to this lawsuit.

THE SPECIAL MASTER: I'm not going to issue any ruling today because I actually don't have any context as to why—I understand your explanation. I'd like to know more as to why for each of these individuals. We have a bunch of other things to cover today. I'll take it under advisement. I will, however, issue—I will, on a—I have some questions. I mean, I'm going to quickly touch on it.

How does the current CEO that just joined, of this year, have relevant information?

MS. FOLEY: He's been with us for a while.

THE SPECIAL MASTER: Oh, he has?

MS. WITTY: Only about a year.

MR. TOSTRUD: Well, not only that, but I think that there is a fundamental misunderstanding that the time period for the lawsuit is over. We filed our class complaint and collective action in July of 2012, but it's continuing to this day. We don't know what's happening. We haven't reached—

THE SPECIAL MASTER: So your assertion is it's still ongoing?

MR. TOSTRUD: Well, they've changed—they've remediated the practice. They made a change in timekeeping, but we don't know that things have stopped. We represent these people through today and will continue—

THE SPECIAL MASTER: Are they still employees, some of these individuals or all of them?

MS. WITTY: Some individuals that they added?

THE SPECIAL MASTER: No, no, the class.

MR. TOSTRUD: Yes, these are current employees, many of them. We have 614 Fair Labor Standards Act—

THE SPECIAL MASTER: So let me understand.

MS. WITTY: Current and former. They're—

THE SPECIAL MASTER: Okay. I got it.

But, I mean, there's more—I get it.

But would the current CEO be involved in any decisions relating to pay or these issues that are before the Court now?

MS. FOLEY: No. The time has passed.

MR. TOSTRUD: With all due respect, the time hasn't passed. The lawsuit continues. We filed the case, and it continues through today.

THE SPECIAL MASTER: Okay. I'm going to table—

MS. FOLEY: The opt-in period is over.

MR. TOSTRUD: No. The time period for opting in is over.

THE SPECIAL MASTER: But they're saying the abuse is still—or the violation is still ongoing; correct?

*128 MR. TOSTRUD: We're—that's part of our investigation.

THE SPECIAL MASTER: That's what they are asserting.

MR. TOSTRUD: If the former CEO who was on the list is relevant, then people—

THE SPECIAL MASTER: Okay. I understand. I'm just trying to understand. They are asserting that the violation is ongoing. What I'm asking you is, your position is that it's not an ongoing violation or there was no violation? I'm just trying to understand—I'm just trying to understand if—

MS. WITTY: It encompasses both of those.

THE SPECIAL MASTER:—these people will have relevant information, because based on what he's telling me, it sounds like the CEO, if they believe it's an ongoing violation, would certainly have relevant information.

Now, I'm not ready to make a ruling because I'm also not sure—I have to read over my order to see if, A, it's within the scope of my orders and that if I'm comfortable adding them. I do think it is, but I do want to read it over, and I do want to make it through the other things that I have on my list to do today.

MR. TOSTRUD: Just in the interest of full disclosure, we intend to send a further preservation letter then to defense counsel—

THE SPECIAL MASTER: Well, that's what I was going to suggest. I'm going to reserve issuing—I'm going to withhold issuing any order or decision on this matter until I've had a chance to read a three-page letter from plaintiffs and, if you want to respond, three-page from defense. You have seven days from when he sends me the letter, CC both parties. I will issue a decision three days thereafter. Okay? Then if you want, you can appeal to the Judge.

Now off the record.

THE SPECIAL MASTER: Back on the record.

Couple of pressing things I want to go over, and I want to keep going through the transcript.

Before we broke for lunch—let's go over the collection itself.

I've been able to determine through conversation—

MS. WITTY: Oh.

THE SPECIAL MASTER: Off the record or still on the record?

MS. WITTY: On the record. I apologize.

Before moving on, could we clarify with regard to the spreadsheet that you requested for the computers whether you mean five log-ins or five days in which they logged in to a specific computer?

THE SPECIAL MASTER: Within a month five log-ins.

MS. WITTY: So if they logged in five times in one day, that would qualify to be entered onto the list?

THE SPECIAL MASTER: If it turns out that my algorithm results in 500 computers, please let me know, and I will amend my algorithm immediately. Okay?

MS. WITTY: Okay.

THE SPECIAL MASTER: I don't know. Most people log into a computer once and stay logged in for the day. But if people are floaters and they're logging in and out of machines, I'll revise and amend accordingly.

I'm operating under the assumption that a user logs in, piddles around, does whatever, does their work, views whatever in Las Vegas, logs off, goes to lunch, comes back, logs back on; maybe they go to a different area of the building.

*129 If my assumption is wrong, please let me know—let counsel know and let me know as soon as possible, and I will then amend it accordingly. Just provide me the statistics so I can then act in an educated fashion.

Okay. Returning back to the collection and the collections scripts and the hash values, did we make any progress in determining whether the evidence is actually all of the evidence in your possession? I know you collected all the evidence minus the network file shares; but the original evidence you collected, is that now all in your possession?

MR. EDMONDSON: I believe it's not all in my possession at this point from what we have compared.

THE SPECIAL MASTER: All right. So I'm going to go with near certain, because I just ran a—the nice thing about the way it was given to me is I converted it all to a spreadsheet and then I just ran a sum totaling, and I got over 80 gigs.

So I'm going with its not, because I ended up with about 195 gigs, and you said you only had 80 gigs. So that means 110 gigs didn't make the trip.

Now, that's, again, no reflection of counsel, because it was former counsel and former IT person.

Now, that doesn't excuse it. Okay? I want to be clear. It doesn't excuse it. But my goal right now is to just fix it. So calculate the hash values, put it on a-yes?

MS. WITTY: We actually discussed part of this issue at lunch, and because we do have the collection that was done both in April of 2013 and August of 2013, and additional areas where information will be collected, UMC now has the capability to do with EnCase 7 a forensic image and generate MD5 hash values for that, and that new subset or that new set of data would be what we would continue processing.

THE SPECIAL MASTER: The original collection, just in EnCase?

MR. SCHAIBLEY: Yes.

THE SPECIAL MASTER: So you're just getting just instead of him?

MR. SCHAIBLEY: Well, what I would look at doing is taking the original collection and creating a new forensic image of the original collection using EnCase with the assistance of Mr. Edmondson and then providing all of that, EO1 files, to him.

And rather than creating one individual EO1 file for the entire collection, creating an E01 file for each custodian.

THE SPECIAL MASTER: Well, that sounds smart. Plaintiffs?

MR. PIXLEY: You are making an EO1 of the entire disc, or are you making a logical of his file?

MR. SCHAIBLEY: Logical.

THE SPECIAL MASTER: Oh, does that answer that? Did you answer?

MR. SCHAIBLEY: I said “logical.”

THE SPECIAL MASTER: Any issue with that?

MR. PIXLEY: No. I think it's a good idea to preserve it into an LO1 file.

THE SPECIAL MASTER: I agree 100 percent.

MR. PIXLEY: So then were you going to de-dupe it and figure out what—

MR. EDMONDSON: Yes, I'll process it in a similar fashion.

THE SPECIAL MASTER: Can you record what you do?

MR. EDMONDSON: Yes.

THE SPECIAL MASTER: So that way we have a record.

*130 MR. PIXLEY: That answers it. Thank you.

THE SPECIAL MASTER: We can't have a rolling production until you have everything. When will that be? I'm just asking, and then I'll order you. So I'm thinking Thursday.

How about this. I'm going to help you both out real quick.

Let's go off the record.

THE SPECIAL MASTER: Back on the record.

One more time.

MS. WITTY: So the five agreed-upon custodians are now a subset of seven to include the two executive assistants to the chief human resources officer and the CEO. I'm going to name them again for the benefit of the record. That's Brian Brannman; his executive assistant, Cindy Dwyer; chief human resources officer, John Espinoza; the administrative assistant to HR, Claudette Myers; Doug Spring; James Mumford; and Jackie Panzeri.

THE SPECIAL MASTER: So any—I know you've requested three.

MR. TOSTRUD: We can make it a round 30.

THE SPECIAL MASTER: No, no, no. We've requested three, and I'm not ruling. But the 27 do you agree with?

MR. TOSTRUD: Yes.

THE SPECIAL MASTER: Okay. Great. Fantastic.

Now, I want a rolling production, and this is how this is going to happen. Did we get privilege log agreement?

I take that as an overwhelming yes.

MR. TOSTRUD: I think so. They're going to have to amend the privilege log perhaps. I don't know.

MS. WITTY: Yes, there will absolutely be an amended privilege log.

THE SPECIAL MASTER: I'm going with the sense not all the evidence has made the trip yet, and they haven't seen it all, there is a very high likelihood that there will be a substantial amount of amending ongoing.

Have you agreed more to the—rather than the-the substance to the form?

MR. TOSTRUD: Yes.

THE SPECIAL MASTER: And the process?

MR. TOSTRUD: Yes.

THE SPECIAL MASTER: That's all I care about. I look forward to having very few privilege conversations with you all.

Now, I'm going to do this rolling. Minus the 700 encrypted mystery files that we're not exactly sure how they ended up encrypted, that we are going to, by Friday, give me an answer or I'm going to bring someone in to get me an answer.

And I don't think we are going to include the network file.

And then I'm going to carve out the network file share—shall we have the 27 custodians plus the network file shares? Is that how we are doing this?

MS. WITTY: (Nodded head up and down.)

THE SPECIAL MASTER: Does counsel for plaintiff understand what I'm saying? Because if not, you can talk to your experts just to make sure.

I just want to make sure everybody is on the same page, because I don't want to revisit this.

So we have 27 plus a potential 3, and we have the network file shares that are responsive for those specific custodian groups like payroll, HR, I have no idea, whatever is deemed responsive that they touched, that is included. Okay?

We have a rolling production.

Do we know how to use eCapture to do the de-duping of the multiple OST and PST files here?

*131 MR. EDMONDSON: It's used for the de-duplication of the e-mails once they've been extracted.

THE SPECIAL MASTER: Yes, I get that. But I'm saying do you know how to use it to make sure that they are not going to read 20 copies of the same e-mail, because Mr. Mumford has 25 different PST files, of which I'm assuming a large number of them have duplicative e-mails in them.

MR. EDMONDSON: As long as they are identical, they will be removed during the de-duplication process in eCapture, which it did remove previously when we used it.

THE SPECIAL MASTER: Send me a screen shot of the configuration just so we can—to both sides so we can make sure it's configured as-is. All right? That way we know-because one of the problems we had earlier was with the options that were selected and not selected.

So before you do anything, take me a screen shot, send it to both sides, unless, Plaintiffs and UMC counsel, you have an objection to that.

MS. WITTY: No.

THE SPECIAL MASTER: Because one thing that that happened between the second and third was we forgot to hit the right buttons. So hopefully, as a group, we will be able to make sure everything is configured properly.

We'll go over the revised ESI protocol in a minute.

Does Plaintiff have anything else they want to add to this before I list how this is going to go with people? So you are going get a screen shot of the eCapture pro configuration. I'm relying on you to QC what the configuration is that he's going to be running. You are primary, meaning that I'm expecting you to get it right, and we are simply QC'ing it. The idea is, is that there are 25 of the same e-mail messages theoretically for some of these custodians that nobody should have to read.

So we agree, Plaintiffs? Is that acceptable?

MR. GODINO: (Nodded head up and down.)

THE SPECIAL MASTER: Okay. Because when I tallied your data sets, they were way bigger. So I'm trying to understand-today's the 7th; right?

MS. WITTY: Yes.

THE SPECIAL MASTER: Let's say the 16th. How much can you guys take in one shot? Don't say everything, because nobody is going to read it all at once.

So how many, like in a—if we had a rolling production and I gave you three custodians—how many custodians can you take at once and properly run through whatever processes you are going to run through before they get ...

MR. FORREST: It depends on how many gig it is; right?

THE SPECIAL MASTER: Figure lots of gigs. I mean, it's hard for me to guess because I couldn't even remotely tell you. I mean-

MR. FORREST: Well, I think the last-I don't know how many gigs the last one was. Whatever it is, we'll process it, whether it's going to be a day or two days ...

THE SPECIAL MASTER: Okay. That wasn't helpful.

Three custodians on the 16th to go across. I'm going to start with just three, and I want to troubleshoot it. We're going to have a hearing on the 17th for an hour to go over—is that enough time between—the 16th, 9:00 a.m. You can send it Morse code, pigeon courier, however. It's in his hands on the 16th at 9:00 a.m.

*132 MS. WITTY: So essentially you're requiring the production on the 15th?

THE SPECIAL MASTER: Well, you can do it overnight using FTP, SFTP, or I don't know how you guys move data.

MR. TOSTRUD: Well, as—I mean, we—

MS. WITTY: But we have to encrypt it.

THE SPECIAL MASTER: Yes, but you can encrypt it as a packet and send the encrypted packet.

MR. FORREST: Well, yes, depending on how large it is. If we're getting—taking 10 or 20 megabytes over FTP, then we've got to encrypt it, and then we've got to move it to—

THE SPECIAL MASTER: Sorry. I have OCR to my office. You don't have OCR to your office. I have a cable that's—it can run like—

MS. WITTY: I can guarantee you that our firm's system is not going to beat that.

THE SPECIAL MASTER: Okay. Recognizing we're using FedEx, then, and TrueCrypt, I'm going to make it the 17th at 9:00 a.m.—10:30 a.m., you have 10:30 delivery. So either you are blaming FedEx, or it's there.

MS. WITTY: I know previously we've gone directly to plaintiffs' counsel—

MR. TOSTRUD: Send it directly to Mr. Forrest.

MR. FORREST: Yes. We'll give you the address.

MS. WITTY: I don't—okay.

MR. FORREST: Okay. So we have 10:30. We have to decrypt it, we've got to load it, we've got to index it, and then we've got to examine it.

THE SPECIAL MASTER: We're only looking for errors. If it works, have a party. But all I care about is making sure you get it with no errors. Because before I have him do the remaining 23 plus the network file shares, I want to make sure it works.

MS. WITTY: I'm concerned about the time for review for privilege.

THE SPECIAL MASTER: I think you should be too.

MS. WITTY: I'm extremely concerned about that.

MR. TOSTRUD: We have a claw-back agreement in place.

THE SPECIAL MASTER: They are looking at almost twice as much data.

MS. WITTY: And we've had—well, we have—

THE SPECIAL MASTER: Let's go off the record here.

THE SPECIAL MASTER: Let's go on the record.

Plaintiff, can you please provide who you would like for the three custodians to be initially.

MR. TOSTRUD: For the initial three custodians, we would ask for Mr. John Espinoza, Mr. Doug Spring, and Mr. James Mumford.

THE SPECIAL MASTER: And Counsel for UMC, it was off the record you requested it just be one to start. I'm noting that I haven't—

MS. FOLEY: Correct. Ms. Witty knows the kind of ratios of who is bigger and who is smaller.

THE SPECIAL MASTER: Right. So you want a chance to confer with—he has the actual current data set on his computer right now. You can look, if you want to take a quick glance.

I know that won't answer the privilege question. So the question I have for you is, the three custodians that were just identified, will they have—do you believe they will be privilege heavy?

MS. WITTY: Mr. Espinoza and Mr. Spring have been significantly involved in attorney-client communications; Mr. Mumford, not as significant.

*133 THE SPECIAL MASTER: Why don't you spend a minute, we'll go off the record, and you just look at the data set real quick.

THE SPECIAL MASTER: Let's go back on the record.

So do you have any preference as to the three?

MS. WITTY: Our preference would be to do James Mumford first and Mr. Espinoza. Doug Spring is going to be much larger.

THE SPECIAL MASTER: All right. Here's what's going to happen. You're going to do Mr. Espinoza first, you'll do Mr. Mumford second, and you'll do Doug Spring third.

As to the first, we're just going to set the date for the first one. I'm not going to set the date for the other three—other two until I get the first one done. I'm going to keep that date—I'm going to help you out and push it a bit because I actually saw the data, and I—I looked at the Robocopy script, just on the filenames alone.

MS. FOLEY: What about the privilege issue?

THE SPECIAL MASTER: Well, that's what I'm saying. I just looked at the filenames alone, and if you just look at the number of hits that come up for, like, labor or for—and I'm just looking at the filenames. I'm assuming counsel is going to want to—I mean, it's a lot of docs to review. I mean, you're talking about 4 to 5,000—there will be a lot of scintillating reading.

The point being that—let's make it the 21st.

Any errors and issues, though, that come up technically need to be resolved by—I want—let's be clear. But I had this—let me be clear. By the 16th, counsel for UMC must have it, and I want written confirmation from UMC's counsel that they are starting their process.

You will have one week, more or less, to do that privilege exercise. Okay?

That means before that day, any technical issues that arise need to be flagged immediately. Okay? Are we all crystal-clear as to this? Counsels for plaintiff?

MR. TOSTRUD: (Nodded head up and down.)

THE SPECIAL MASTER: Do you have any objection to this? I think one week is enough to get started, and then I'm going to rapidly increase the rate at which things are going to happen, but I'm going to let us and give everybody some leeway for the first, because I realize that, inevitably as an attorney, I've found that the privilege log, the form that you come up with sometimes needs tweaking because of document types, document formats, or any one of a litany of things.

I do fully expect, though, that the network file share collection is completed and in hand, not necessarily processed but completed by—before—what is today?

MR. GODINO: 7th.

THE SPECIAL MASTER:—by the 14th.

I'm also ordering Mr. Lattin to pull a disc today of the network file share until this is done.

MR. LATTIN: The entire share or just this?

THE SPECIAL MASTER: Whatever folders that those custodians have access to to be pulled. Shouldn't be a problem because you have a full month backup. So all you have to do is take the backup from whatever it is, 28 days ago, and pull it and allocate space or buy a new server if you have to, but I need to know that since that hasn't happened, that nothing going forward is being deleted.

*134 I'd like ideally, and since it's on disc, can you run the script against the four months' old—is the network file share four months?

MR. LATTIN: Correct.

THE SPECIAL MASTER: Could you run it four months back or do you want it run against current data? I mean, because it should have actually been done a year ago. So I'm going to defer to Plaintiffs as to how you would like it done, if you have any preference, before I determine it.

Do you want a chance to confer?

MR. TOSTRUD: Yes.

THE SPECIAL MASTER: Off the record-wait. On the record. It doesn't mean that I'm going to grant it. Just I wanted them to give their input first.

Off the record.

THE SPECIAL MASTER: Back on the record.

MR. TOSTRUD: So in response to your request, Special Master Garrie, Plaintiffs would request both the oldest version possible and the most recent version; but failing that, we would—our preference would be to get the older—oldest version possible if they force us to choose.

THE SPECIAL MASTER: So I'm going to split the difference, because I was thinking the same, but then I thought we could split the difference. Here's what's going to happen:

You are going to collect the oldest. You are going to run the search terms on the oldest. You are going to collect the newest. You are going to run the search terms on that. You're then going to run a hash value calculation.

Outside of e-mails, if—the PSTs and OSTs, if you come back—and you are going to notify me if there is anything more—I am hoping that there is not a lot of PSTs and OSTs in your network file shares relating to your work. There shouldn't be, because there's like over a thousand of them within just the 27 custodians that we have.

So I am assuming there will be no PST and OST files or e-mail messages and just work-related documents and spreadsheets. Is that an accurate assumption? Is that safe, do you think?

MR. SCHAIBLEY: Yes.

THE SPECIAL MASTER: Okay. So assuming that that's the case, it should just be a simple hash value analysis.

So I would like you to collect from—preserve four months and current, run the search, provide him both. Do you understand? So whatever the network file shares are for both of them, provide them to him. Run the searches against the oldest first, calculate the hash values for all of them, run the same search terms against the newest. Obviously, the union, pull; the rest, junk. Make sense?

MR. EDMONDSON: Yes.

THE SPECIAL MASTER: Any questions? Does that make sense, Counsel?

MS. WITTY: (Nodded head up and down.)

THE SPECIAL MASTER: Is that acceptable?

MR. FORREST: I'm wondering about the junk part in view of the fact that there may be additional search terms coming down the road.

THE SPECIAL MASTER: He's preserving both. I said preserve one—

MS. WITTY: In terms of production, production junk.

THE SPECIAL MASTER: No, stop, stop. I said—let me be crystal-clear. I said preserve one, preserve today, run the delta, because I'm talking about production here.

*135 MR. FORREST: Okay.

THE SPECIAL MASTER: Right? Whatever you—and going forward, for new search terms, they will do it the same fashion, right, given that we're running defendants late.

At no point am I—just to be crystal-clear, no deleting anything ever. Okay? Ever. Are we crystal-clear on this?

Mr. Lattin, you're just sitting back there nodding, so I need to hear a “yes.”

MR. LATTIN: Yes.

THE SPECIAL MASTER: Okay. Thank you. Okay. Does that assure—assuage your—

MR. LATTIN: Actually, and by “deleting,” you're including overwriting?

THE SPECIAL MASTER: I'm saying anything remotely resembling hitting the delete or backspace key or command in a UNIX environment or anything at all, whether it's overwrite, delete, or therein otherwise.

You run backups, so I don't think you do it anyway. So nothing—I'm not even saying UMC would even think that that would happen or anything. So I'm not even—I don't—hope my order or my remarks should not be interpreted that I believe that UMC is doing anything, except UMC forgot to collect the network file shares in the initial collection, which is its own issue.

But I don't think that anybody in this room is going to overwrite or delete or do anything outside of follow the black letter of what I'm ordering.

Does that answer that?

MR. FORREST: Well, now I was just wondering whether the backups are still going to be on the same rotation schedule and we're going to—

THE SPECIAL MASTER: Well, why? You've got a four-month-old—I mean, you want them to cease—do you want them to hold copies of all of their network file shares? You are talking about a petabyte probably. I mean, you have over a petabyte. How much do you have?

MR. LATTIN: Currently on just the file share?

THE SPECIAL MASTER: Yes.

MR. LATTIN: A single backup is probably 2.3 ter. It's probably 30 ter total for the four months, just estimating.

THE SPECIAL MASTER: Every day or each day?

MR. LATTIN: For the total.

THE SPECIAL MASTER: So day one, two, three, total is 30 ter?

MR. LATTIN: Yes.

THE SPECIAL MASTER: And what are you asking?

MR. FORREST: Withdrawn.

THE SPECIAL MASTER: All right. I'm just saying that that's a lot of data. I want to be clear. You're going to be reviewing it all. If I'm ordering it, you're going to—I'm going to make sure that you understand that you are inviting 2.3 terabytes a day of potential—well, maybe not. I have no idea, to be honest with you.

So I think it's fine. We have a snapshot. The custodians—all of the custodians have signed and received and understand they should not be deleting; right?

MS. WITTY: And that will be reinforced.

THE SPECIAL MASTER: So if we go down this track and it turns out otherwise, we have a snapshot to compare against. So I don't believe there is any need to have a rolling preservation. They shouldn't be deleted; right? Nobody should be deleting from the network file sharing in payroll, in HR, and anywhere else; right?

*136 The backup is just simply for collection purposes. We will have, if necessary, a separate conversation if it comes to light.

Okay. Now, to review, Mr. Espinoza is up first. On the 16th—17th or 16th?

MR. SCHAIBLEY: 16th.

THE SPECIAL MASTER: On the 16th, UMC technology forensic quasi team will provide to UMC counsel that information, whatever form they want, to review and create a privilege log. That privilege log will be provided in complete and totality by the 21st.

MS. WITTY: The 22nd will be the week.

THE SPECIAL MASTER: 21st is a Sunday?

MR. FORREST: Monday.

THE SPECIAL MASTER: All right. 22nd, because if they ship it on Sunday on FedEx, then they're probably—the 22nd, 10:30 a.m. has to be sitting in his hands with the privilege log fully signed off on. Okay?

MR. FORREST: We'll take the disc. They'll take the privilege log?

THE SPECIAL MASTER: You are going to get the disc with the privilege log. I'm not making this complicated. And you can pull it off and send it to them using courier pigeon. All right? All right.

Now, my log files from my script—I'm on page 39 of my transcript from the last hearing—I didn't get them for the 26 custodians.

MS. WITTY: The 26, correct.

THE SPECIAL MASTER: Are they in the works?

MS. WITTY: Yes. It was a failure on—

THE SPECIAL MASTER: It's all right. We've met on Friday. So there is no need to apologize.

MS. WITTY: Our law firm could not process the zip file to transmit them. I have no idea why, but it's my—

THE SPECIAL MASTER: It's probably too big. Why don't you split it up and send it to her as three different files—maybe five different files, actually. How big is it? I can put up a secure file server if you want. I'm just getting the Robocopy log files here, is what we're talking about.

MS. WITTY: I just sent electronic copies of the five custodians' Robocopy scripts, so Plaintiffs should have those five custodians.

THE SPECIAL MASTER: The full scripts or just the results?

MS. WITTY: The full scripts.

THE SPECIAL MASTER: Okay. All they need is-actually, you know what?

MR. SCHAIBLEY: It's a zip file that's 9 megs.

THE SPECIAL MASTER: That's it? Okay. The script file is solely being submitted to Plaintiffs' counsel for no other evidentiary purpose other than to see the failure logs. Are we crystal-clear here?

MR. TOSTRUD: Yes.

THE SPECIAL MASTER: Okay. No conversation is to be had about this unless you see some pressing, dire need, and you will file a letter to me and to the other side about that. Are we crystal clear?

Specific to the Robocopy scripts you have just received, the sole purpose you received them is so you can see the failure logs.

MR. TOSTRUD: Yes.

THE SPECIAL MASTER: Okay. So 9 megs?

MR. SCHAIBLEY: Yes. It's a zip file that's 9 megs. It contains a total of four folders. I just did each log file for the—

THE SPECIAL MASTER: I can take full 9, so as soon as you can get it, send it to me. Okay? I'm going to look at it. And the only reason—it's the same script was run, so you don't need it.

*137 Okay. Oh, I have a question for counsel from plaintiff. Last time we were speaking, you raised an interesting point about the clinics. We've got this wonderful diagram.

As I understand it—who is responsible for the clinics' IT systems?

MR. SCHAIBLEY: What do you mean “responsible for the clinics”?

THE SPECIAL MASTER: Well, he raised the point—

Well, why don't you repeat your point from the prior—I can—I'll repeat it, or would you like to?

MR. TOSTRUD: I can.

So UMC has a central campus which we've visited a couple of times and toured it. Our lawsuit revolves around that campus, but also we have people in our case who work at the Quick Care facilities.

And in the context of gathering relevant evidence, we wanted to get a better understanding of how the Quick Care facilities are managed electronically and, parenthetically, we also want to understand if there are other documents there.

But for your purposes, we want to understand how they are managed electronically with information and how they communicate with the central campus.

THE SPECIAL MASTER: That was the request. That wasn't what was granted.

But the gist that he does raise and that I do have questions about is that the script that was run, and it's—the goal is to collect the responsive information and then search it accordingly with keyword search terms or predict what computer sys to review and whatever term you use to filter it down and turn it over.

In order to do that, we need to understand where all the data may sit. He raises a very good point that there could be data sitting at clinics.

Based on my limited knowledge, and I'm looking at this diagram, and I have the luxury of actually having a decent memory and being able to cross-reference the spreadsheet I was given earlier with the servers and what they really stand for.

But that all said, explain to me from the clinic side how—what systems they have locally, if any.

MR. LATTIN: There shouldn't be any local server-type systems at any of the clinics. Everything, as far as they're concerned, would look the same at the clinic as it does on the main campus. It's all one big, contiguous network. In either service, they do use Exchange, file server, all come from—the same as everybody on campus would use.

THE SPECIAL MASTER: So if a grievance is filed locally with a—I think it was mentioned—they mentioned a grievance—and I'm not speaking to merits or substance here. I'm just using it for context. Okay? I'm not saying that this happened or has happened. I'm just using it because the only other healthcare systems I know are patient-related, and that has no bearing here.

An issue happened; a grievance is filed. Just so I understand, that is never stored locally at the office or the clinic? Sorry.

MR. LATTIN: Not to my knowledge, no.

THE SPECIAL MASTER: Counsel?

MS. WITTY: It's kind of hard to answer that because of the term of art of “grievance.”

*138 THE SPECIAL MASTER: All right. Forget grievance. Somebody files a complaint with their manager, whatever, for—I know digital sexual harassment, so I'm just going to stick with something that I have some expertise in serving ...

But the point is, let's say somebody files a sexual harassment complaint with their manager at a clinic. Okay? Does that actually sit where?

MS. WITTY: It would go through HR.

THE SPECIAL MASTER: But I talked to the manager—what I'm trying to understand is, I go—is there any data that that manager would have on his local computer at that clinic?

MS. WITTY: They should not.

THE SPECIAL MASTER: The IT guys, anything?

MR. LATTIN: They shouldn't. That was—what they've always been told is that you always save the files to the file share, file server so it gets backed up.

MR. CLARK: Can I go off record and help?

THE SPECIAL MASTER: Yes, let's go off the record.

THE SPECIAL MASTER: Let's get back on the record, because I'm going to have to draw it out myself at some point.

MR. SCHAIBLEY: If one of the 26 custodians had logged into a computer at a Quick Care, that computer would have been identified and logged in the log scripts that Ms. Witty is providing you; and the Robocopy script, because that computer is connected to the network, would have gone and captured whatever was on that computer.

THE SPECIAL MASTER: Can you circulate the script itself?

MR. SCHAIBLEY: What do you mean “circulate the script”?

THE SPECIAL MASTER: The Robocopy script, could you send it to me?

MR. SCHAIBLEY: It's included in the zip file.

THE SPECIAL MASTER: Got it.

Theoretically, then, Counsel, based on what they are telling me, and that I've looked at the script right, if a user logs in from the clinic, it's—that data would still be collected.

MR. TOSTRUD: I understand. I guess our concern is rather obvious, and that is that Mr. Schaibley I think indicated that there are—there is information stored on local C drives, and that information I don't think makes it back. Correct?

And in light of the e-mail in Exhibit 10 to this transcript, when you combine those two, there may be a lot of relevant information that's sitting out in the Quick Cares. So that's our concern.

THE SPECIAL MASTER: How about you give me a list of the custodians that sit in the Quick Care facilities, and then I'll make a—I'll further explore it if I believe appropriate.

But right now, their script is pretty complete and thorough. What we might—yes?

MR. PIXLEY: I just noted that the Robocopy script is designed to just target the user profile on that machine, not the machine itself. So that's why earlier I asked the question if somebody created a folder off the root of C called “My Stuff” and just put stuff in “My Stuff,” the script would not include that data.

THE SPECIAL MASTER: Right. I agree, and it wouldn't be backed up, which is why we're grabbing the 26.

*139 MS. WITTY: A quick review of the 26, 27 custodians: None of them are Quick Care, I don't believe any of the plaintiffs are—the named plaintiffs, the original six.

MR. TOSTRUD: No, I don't believe the named plaintiffs have worked at Quick Care facilities, but we have opt-ins who have worked at Quick Care facilities, and we have opt-ins who would indicate that they have complained about these issues while they were working in Quick Care facilities.

THE SPECIAL MASTER: So here's what I want: I want a list of those individuals' names, and then I'll go from there, because I don't—we don't even know how often they logged into the computers or what they were doing. So before I go down a rabbit hole, I want to at least understand.

Give me the list. I'm then going to order UMC to give me a corollary spreadsheet that says, “These users were logging into these computers,” and etc., etc., so that way I can get some context, and I know how computers we're talking about, and I know how many devices, and so it stays reasonable and focused, if at all.

And that's also assuming that I believe that—and also, if you are going to list them, you have to say why you believe they would—what relevant information would be on these systems. For each one of the people, I would need to know for that person what it would be. Because it's a lot of relief, because they have—these people could have been walking around the clinics logging into God knows what.

So before I even entertain it, there better—I would like to know why you believe it is necessary, and then I will consider it.

And then, Counsel for UMC, I give you three days, business days to respond to their request as to why you believe it may or may not be necessary.

I am going to request, Mr. Clark, that you take your very expert and wide set of knowledge skills that you have as to UMC's design of Enterprise and the SAN and the other pieces and create a diagram that is actually intelligible of the data, so that way I can have a more cogent and cost-effective conversation, because if I do it, it will cost you a substantial amount more money and I'd have to go on-site and take pictures.

And if I find that that—the diagram that's provided is insufficient or lacking or whatever, I'll then revisit your request. But he seems to be more than skilled and expert. And if necessary, I will virtually log in and verify it myself. Okay?

All right. And you are working on resolving the errors in the scripts. Did we pick a day when I'm going to get that?

MS. WITTY: We did not.

THE SPECIAL MASTER: Fantastic. Would you like to suggest a day or would you like me to pick a day? Sort of a trick question, but we'll—you can suggest a day.

MR. SCHAIBLEY: I'd prefer to suggest a day for next week, just because I'm the one who will have to do that, along with the new EO1 files.

THE SPECIAL MASTER: Okay. Let's make it the 17th.

And to your point, the Robocopy scripted error out on files, I pointed out in the last hearing we're going to find out what the files are and then go from there.

*140 Obviously, if they are PST, OST files, or anything of that nature, they are going to be—we're going to need them. If they are .dat files or etc., I will reserve right to judgment. But any PST, OST, doc, Microsoft Office program, Kronos-based file, or the likes, similar such data, errored out, I expect you immediately to go back and grab it, manually if necessary.

We're updating the chain of custody; right?

MR. SCHAIBLEY: Yes.

THE SPECIAL MASTER: And we're calculating MD5 hash values this time around? You're going—we already figured—right?—that we are going to get all the right evidence over.

I would like an explanation. If you could please go to your former forensic expert that was—you retained and try to figure out how he completely and totally missed two-thirds of your evidence.

I mean, you didn't know. I'm not—counsel for UMC clearly had no knowledge or understanding—like you assumed you got—he did his copying and he assumed the guy who showed up did the proper forensic imaging. And then counsel for UMC actually came in several months later, assumed that it was also correct, and they didn't know otherwise.

I'd like you to inquire, and if you would be so kind as to provide us a written response. If not, please advise him I will order him to appear.

What happens also with the script with the path, the filename and the copy, what if the path, the filename, is too long?

MR. SCHAIBLEY: I don't believe I've seen one that was too long that it errored for that specific reason, but I would have to go back through and check those specific errors to see if any of them were for a reason like that.

THE SPECIAL MASTER: All right. Voice mail, is there a person here today that knows the voice mail?

MR. LATTIN: I think it would be Susie Kisner.

MS. WITTY: Susie actually deferred on the voice mail issue.

THE SPECIAL MASTER: To Trina?

MR. LATTIN: No.

MR. SCHAIBLEY: To Brett?

MS. WITTY: Yes.

THE SPECIAL MASTER: Brett who?

MR. SCHAIBLEY: Brett Johnson.

THE SPECIAL MASTER: Why don't you spell that for the record.

MR. SCHAIBLEY: B-r-e-t-t J-o-h-n-s-o-n.

THE SPECIAL MASTER: Can you have him submit a-since he's not here, is he available to speak right now by phone?

MS. WITTY: He was not.

THE SPECIAL MASTER: Okay. So then get a dec affidavit from him explaining to me exactly how the phone systems work, how they back them up, do they send them to e-mail, what exactly—how—are they backed up?

MR. LATTIN: Not through our system, no, not through CommVault.

THE SPECIAL MASTER: So are they backed up separately and apart; if so, by who. And have him include as exhibits any relevant pieces of information there.

Let's go take a look—the BlackBerry backup policy, we don't have that; right?

MS. WITTY: There isn't one.

THE SPECIAL MASTER: Yes, there is no BlackBerry backup policy.

I'm going to request by the 13th that you circulate further clarification as to the use of the iPhone—the search terms—were you guys the ones responsible for providing them for the iPhone, iPad, whatever?

*141 MS. WITTY: You should have received a—did I not send that? It was just an e-mail that had the search terms in it.

THE SPECIAL MASTER: Did they get it too?

MS. WITTY: Should have.

THE SPECIAL MASTER: Did you guys receive it?

MR. GODINO: When did you send it?

MS. WITTY: It would have been—

MS. FOLEY: Half-hour ago?

MS. WITTY: No. It was Friday night.

THE SPECIAL MASTER: I didn't—I don't think I got it.

MS. WITTY: I will re-send that.

THE SPECIAL MASTER: Okay. I need Plaintiff to review them if at all possible today and sign off on them.

MR. TOSTRUD: Okay.

THE SPECIAL MASTER: I haven't seen them, so as soon as I see them, I will add accordingly.

All right. Let's talk about custodian interviews. Someone mentioned Mr. Espinoza. Who was that? I forget. Was it you, Mr. Forrest?

MR. FORREST: I mentioned Mr. Spring and Ms. Myers. And actually I also have a comment about Panzeri when we get to it.

THE SPECIAL MASTER: All right. Really quickly, I also order plaintiffs to pull 10 of the packets that you were provided to look at the SAP correlation of data. When will you have, could you have that done?

MR. TOSTRUD: I think you gave us a date which may be by this Friday, but we are working on it.

THE SPECIAL MASTER: Okay. I just want to know—so that's fine. Provide a written letter with the response and the validation, so I understand.

MR. TOSTRUD: Yes.

THE SPECIAL MASTER: It's in the transcript, page 81, if you need the record.

Okay. So let's go through the custodian interviews. Page 81 of the transcript covers the issue we just covered.

So who had a question? Panzeri, you said?

MR. FORREST: Yes. And this goes—

THE SPECIAL MASTER: And, Plaintiffs, if you have any questions as well, feel free to—

MR. FORREST: And this goes to the Kronos SAP question, the completeness of the data that we have, and we'll check that with respect to the 10 packets.

THE SPECIAL MASTER: Randomly picked packets.

MR. FORREST: Randomly picked packets.

But I note in the description of the hard copies in Panzeri's custodian interview, she talks about pack rat because so much documentation is required for payroll/audit. And in essence, a large part of what we're doing is auditing the calculations with respect to the wages and hours recorded for the plaintiffs.

So that documentation may or may not be useful. We'll know shortly, I think.

And I will also note that—

THE SPECIAL MASTER: Well, what's the question?

MR. FORREST: Well, I guess the question is do we have enough data from—just from Kronos to essentially recreate the documentation required for auditing, that the hours and payments were calculated correctly.

MS. FOLEY: Yes.

MR. FORREST: And I don't know how we can do that without having access to the SAP data. We haven't—

THE SPECIAL MASTER: And we already had this conversation. You are verifying that and then getting back to me by Friday.

*142 MR. FORREST: Okay.

THE SPECIAL MASTER: And then you are going to detail out what you would additionally need if it was not sufficient.

MR. FORREST: All right.

THE SPECIAL MASTER: No, I'm not saying you do or do not. I'm just saying we—and once you can give me specific “I need X, Y, and Z or A, B, C data that is not provided in these packets,” I can then have an educated conversation about it. But right now it's too esoteric.

MR. FORREST: Okay.

THE SPECIAL MASTER: I had a question about Ms. Panzeri's custodian interview, but do you have any others, Counsel, or any—

MR. FORREST: No.

THE SPECIAL MASTER: From Plaintiff?

MR. GODINO: No.

Hold on. I think we would like, since we got the interviews last night at 8:00 p.m., we really haven't a full—

THE SPECIAL MASTER: Chance to look at them?

MR. GODINO:—opportunity to look at it. So I think maybe at the next hearing we would have a lot more questions on them.

THE SPECIAL MASTER: We'll make it a phone hearing and—

MS. WITTY: I was going to say, if we could do that—

THE SPECIAL MASTER: We'll do it as a phone hearing, and we'll set hearing dates at the end, and you'll—but I will request that you circulate a written bulleted list for each custodian. So the whole idea is to get the questions answered, not do anything else.

Now, my question is, it says “created our own distribution list for timekeepers.” I'm a little confused.

MS. WITTY: So essentially, what we've done in this case to include everyone on e-mails, when something is sent to all counsel, you know, it lists out all the separate e-mails. She essentially does that for her timekeepers.

THE SPECIAL MASTER: She doesn't mean a distribution list per se at an Exchange level?

MS. WITTY: Exactly. I can-

THE SPECIAL MASTER: Mr. Schaibley, she didn't actually request for you to do that; right?

MR. SCHAIBLEY: I don't recall creating a distribution list for her, no.

THE SPECIAL MASTER: All right. Just checking. So can you just double-check, yourself, to make sure? She says a, quote, “distribution list for timekeepers.”

Now, let's go over the webmail question that came up earlier. You can access e-mail through the Outlook Web client; no?

MR. SCHAIBLEY: Correct.

THE SPECIAL MASTER: And it's just going to a URL and putting in a login and a password; right?

MR. SCHAIBLEY: Yes.

THE SPECIAL MASTER: So when she says “webmail,” she says “webmail,” what is she referring to there?

MR. SCHAIBLEY: I can only assume she's referring to the UMC Outlook webmail.

THE SPECIAL MASTER: Okay. So that's what she's doing. Which she can access from her phone or from any device?

MR. SCHAIBLEY: Correct.

THE SPECIAL MASTER: It doesn't—

MR. SCHAIBLEY: I'm sorry, did you say can or can't?

THE SPECIAL MASTER: Can, c-a-n.

Counsel for Plaintiffs, does anybody have any questions beyond the ones I've asked?

*143 We can then go to Mr. Espinoza. Do Plaintiffs have any questions about his custodian interview that they would like further clarification around?