JOHN ERAR, Plaintiff, v. CITY OF ANDOVER, a Minnesota municipal corporation, and DON JACOBSON, MIKE KNIGHT and JULIE TRUDE, individuals, Defendants COURT FILE NO. 04-3742-HDV/RAW United States District Court, D. Minnesota Filed April 05, 2005 Counsel Jessica J. Clay, Halunen & Associates, John A. Fabian, III, Fabian May & Anderson, Minneapolis, MN, for Plaintiff. Clifford M. Greene, John M. Baker, John W. Ursu, Greene Espel PLLP, Mpls, MN, Pamela L. VanderWiel, Everett & VanderWiel, PLLP, Rosemount, MN, for Defendants Walters, Ross A., United States Magistrate Judge RULING ON PLAINTIFF’S MOTION TO COMPEL *1 The above resisted motion is before the Court following telephonic hearing at which counsel for both sides, Mr. Fabian and Mr. Greene, appeared for their respective clients. It is fully submitted. Plaintiff Erar moves to compel defendant Trude to submit her personal computer for mirror image copying of its hard drive and forensic examination by a computer expert, Mr. Mark Lanterman. Plaintiff would pay the cost. Trude objects on the ground that the inspection would be overly intrusive, unjustified, and not sufficiently relevant. The computer in question was purchased by Trude’s family in about 1999. It is used by the entire family, which includes Trude’s husband, a physician, and three teenage children. It is used for work purposes, personal correspondence, computer games, Internet access, entertainment--apparently all of the typical kinds of things families use personal computers for these days. From time to time Trude used the family computer to correspond by e-mail in the course of performing her duties as a member of the Andover, Minnesota City Council. She saved “only those emails that were related to current City issues” and which she felt she wanted to keep for future reference. Trude Aff. ¶ 11. These she usually printed to hard copy and saved in paper files. Documents thus retained have been produced to the extent responsive to Erar’s discovery requests. A paralegal in the defense law firm took possession of Trude’s computer. By affidavit the paralegal states she conducted a thorough review of all the files stored on the computer and conducted a key word search of the computer’s hard drive using the key words plaintiff’s counsel had identified in a request for production of documents. The paralegal also viewed all e-mails stored in Trude’s e-mail account. Harris Aff. ¶¶ 8-10. Responsive documents obtained by this process have been produced. Of the 540 pages of documents produced by Trude, some 77 contained e-mail material. Most of these were found in Trude’s paper files rather than on her computer. Id. ¶¶ 12-14. The motion papers provide no reason to believe otherwise than that all responsive, reasonably accessible information electronically stored on Trude’s computer has been produced. There is no question that relevant electronically stored data is subject to discovery. Antioch Co. v. Scrapbook Borders, Inc., 210 F.R.D. 645, 652 (D. Minn. 2002) (quoting Advisory Committee Notes to 1970 Amendment to Fed. R. Civ. P. 34). When a user deletes material from a personal computer the material still lingers in the subconscious of the hard drive and can for a time, until overwritten, be retrieved by the type of forensic examination Erar proposes. In addition, some “metadata” concerning a computer-generated document not part of a hard copy may be retained in the hard drive. Metadata is essentially “information about information.” It may include text from earlier drafts, dates when documents were created, accessed or modified, and “header” information. Lanterman Aff. at 9. Clearly, deleted material, metadata and other embedded data in a computer hard drive may also be discoverable. Antioch, 210 F.R.D. at 652 (citing Simon Property Group L.P. v. mySimon, Inc., 194 F.R.D. 639, 640 (S.D. Ind. 2000)); Playboy Enterprises, Inc. v. Welles, 60 F. Supp. 2d 1050, 1053 (S.D. Cal. 1999). *2 The problem with material of this kind is that it is not readily accessible. See Zubulake v. UBS Warburg LLC, 217 F.R.D. 309, 319-20 (S.D.N.Y. 2003). It must be extracted from the computer hard drive in an effort that requires “significant processing,” id., and implicates concerns about expense, burden, and, particularly in the case of a multi-user family computer, privacy. Consequently, a forensic examination of a hard drive for not readily accessible data should not be compelled absent some indication that the likely benefit will outweigh the countervailing concerns. The evolving approaches in dealing with the discovery and retrieval of electronically stored information have coalesced into a proposed revision to Fed. R. Civ. P. 26(b) recently issued by the Judicial Conference Committee on Rules of Practice and Procedure. A party would not be required to provide discovery of electronically stored information shown to be not reasonably accessible unless the requesting party demonstrates good cause. The committee viewed it as “sensible to limit discovery to that which is within Rule 26(b)(1) and reasonably accessible, unless a court orders broader discovery based on a showing of good cause.” Committee Note to Subdiv. (b) (2) . The comment period for the amendment has just passed, and it may be that it will not be adopted in its present form, but the proposed amendment may be looked to as a thoughtful expression of informed judgment. Even without the amendment, the factors now articulated in Rule 26(b) (2) governing limitations on discovery suggest “the rule should be used to discourage costly, speculative, duplicative, or unduly burdensome discovery of computer data in systems.” Manual for Complex Litigation (4th) § 11.446 at 79 (2004). Erar proposes that Mr. Lanterman be allowed to prepare a mirror image of Trude’s computer. He would then analyze and organize the data in some fashion, and conduct a key word search to locate material responsive to Erar’s discovery request. Any information retrieved would be turned over first to defense counsel for an opportunity to review and assert privilege and other objections. On consideration of the factors in Fed. R. Civ. P. 26(b)(2), the evolving standards concerning forensic examination of computer hard drives for information not readily accessible, the probable expense and time involved, and the privacy interests involved, the Court concludes plaintiff has not shown good cause for the requested forensic examination. To begin with, the reasons put forward by Erar for his request are not compelling. He contends Trude’s document production has been incomplete in a way which suggests she has selectively produced documents while withholding others. Erar identifies a number of e-mail communications in his possession sent to him and to a Mr. Kellogg by Trude which he says Trude did not produce. However, from the response to the motion it appears that all of the documents identified by Erar as having been withheld were in fact produced by Trude, save one. That document was a 2002 e-mail from her to Erar which was apparently not retained in her computer and, given the age of the communication, probably would not have been retrievable from the computer’s hard drive. The failure to produce the document in question does not give rise to an inference that Trude has been less than forthcoming in her discovery responses. Erar also contends a forensic examination of Trude’s computer might provide metadata which would assist in authenticating and establishing the foundation of some of the e-mail copies Trude has produced but which do not indicate the date or the identity of the sender or recipient. Only a handful of documents are involved and there is no indication that Erar will be unable to lay a foundation or authenticate the documents through testimony. *3 Passing beyond the reasons for Erar’s request, it is speculative, indeed doubtful, that a forensic examination of Trude’s computer would produce any significant relevant information not previously disclosed. First, as noted, the record indicates all readily accessible information has been produced. Depositions of the persons Trude would most likely have communicated with concerning Erar, her co-defendants, have been taken with no evidence in the testimony that additional electronic communications occurred beyond those currently in the discovery record. Second, given the passage of time and the heavy use of Trude’s computer in the interim it is unlikely that much remains to be plumbed from the hard drive. As noted, Trude saved e-mails that pertained to city business and which she thought might be important. She deleted the rest. The events in issue occurred from about April 2001 to April 2004. Any relevant deletions, or other data embedded in the hard drive, occurred or were created a year or more ago. Defendants have their own computer expert, Mr. Michael Younger. His affidavit, which is supported in part by the affidavit of Mr. Lanterman, is to the effect that when a user deletes a document from a computer the contents are not erased, but the space they occupied in the system is made available for new data, “free” space. As the computer is used, and new files are added to those spaces, the “deleted” material is overwritten and cannot be recovered. Thus, the longer a computer is in use the greater the probability deleted data is overwritten. Trude’s hard drive is relatively small and the computer has seen heavy use by five family members. The usage of the computer was heavy enough that the hard drive reached capacity a number of times and the family had to delete files to create space, which would further reduce the likelihood of recovering web-based e-mails. The computer was also programmed to use a defragmentation program weekly. The defragmentation program rearranges fragmented files to create segments of continuous free space which in turn facilitates the overwriting of deleted data. In August 2003 the Trude family upgraded the computer operating system to Windows XP in order to use a new broadband Internet service. According to Younger, the upgrade “would have caused a mass file replacement ... which would have caused large amounts of ‘unallocated’ space to be overwritten ....” Younger Aff. ¶ 15. When Trude changed service providers from AOL to Comcast in August 2003, she deleted the entire AOL file folder which in turn deleted the “Personal Filing Cabinet” where AOL e-mails were stored in the system. The Comcast system Trude has used since then is a web-based system which typically stores sent or received e-mails on the provider’s server, not the customer’s computer. Finally, examination of the hard drive on Trude’s computer is unlikely to reveal the kind of metadata Erar says he needs in order to authenticate some of the e-mails. In her affidavit Trude says that she saved e-mails on her hard drive as text or HTML files. Trude Aff. at 5. Younger states that text files contain only raw text and not “embedded metadata such as content from previously edited versions of the file.” Younger Aff. ¶ 17. Further, an e-mail in plain text would not contain metadata about the sender, receiver, or date of transmission. Id. Any Comcast e-mails on Trude’s computer also would not contain “hidden” metadata. Id. That the computer trail is now too cold to be of much use finds some support in Mr. Lanterman’s affidavit. He emphasizes it is essential to preserve computer hard drives thought to contain relevant information as soon as possible because data is overwritten and destroyed as the computer is used. Indeed, Mr. Lanterman is concerned that the search for information from Trude’s computer conducted by the defense law firm paralegal itself probably resulted in the destruction of residual data. The fact is a mirror image copy of Trude’s hard drive was not made early on and at this point a forensic examination is a stab in the dark. *4 The burden and expense factor is mitigated by the fact Erar has volunteered to pay for the cost of the examination of Trude’s hard drive. That does not, however, eliminate all cost to the defense. Defendants would still be faced with the cost of defense counsel’s involvement in the process. The intrusion the proposed examination of the hard drive portends into the private affairs of the Trude family members remains a highly relevant consideration. Defense counsel and Mr. Lanterman are sensitive to this and Mr. Lanterman says that he would adhere to any protective order restricting the use of information revealed by his analysis of the hard drive. The Court does not doubt Mr. Lanterman’s good faith, but he is still a stranger to whom all of the personal business filed away in the Trude family computer would be exposed.[1] Defendants request an award of fees and expenses as permitted by Fed. R. Civ. P. 37(a)(4)(B). The request is denied because in the circumstances it would be unjust. This is an evolving area of discovery law. The Antioch case cited previously provides an arguable basis for the motion in the case law of the District of Minnesota. The fact plaintiff volunteered to pay the expense of the forensic examination, which would not be cheap, illustrates the good faith of plaintiff and his counsel in bringing the present motion. Motion denied. IT IS SO ORDERED. Footnotes [1] For this reason as indicated at hearing, if the Court were to authorize a forensic examination of the computer, defendants would be allowed to select the expert to conduct the examination.