WHEREAS on December 14, 2022, the Court found Respondent Aaron Etra (“Etra”) to be in contempt of Court, and ordered him to submit his laptop computer and cellphones (the “Devices”) to Petitioner to conduct a forensic examination, see Order, Dkt. 263;

WHEREAS the Court further ordered Petitioner Benthos Master Fund, Ltd. (“Benthos”) to propose a forensic protocol that would govern the forensic examination and allow Etra to assert attorney-client privilege over any materials he asserts are privileged, see id.;

WHEREAS the Court ordered that the proposed forensic protocol should address: (a) the process for the forensic examination; (b) production of a report reflecting the contents of the Devices for Etra to review; (c) time for Etra to review the report and to lodge, if appropriate, any claim of privilege over any particular contents; and (d) a process for the Court to determine whether the purportedly-privileged material is, in fact, privileged, see id. at 1;

WHEREAS on January 13, 2023, Benthos proposed a forensic protocol, see Proposed Protocol, Dkt. 271-1;[1]

WHEREAS on August 17, 2023, Benthos proposed revisions to the forensic protocol after retaining a new forensic expert, see Second Proposed Protocol, Dkt. 362-1;[2] and

WHEREAS on September 18, 2023, Etra produced the passcode required to unlock his phone to Daniel McGuinness (“Counsel”) and to Petitioner, see Letter, Dkt. 378;

WHEREAS on September 20. 2023, Etra produced the password required to unlock his laptop to Counsel and to Petitioner, see Letter, Dkt. 381; and

WHEREAS Mr. Etra to date has not provided a list of his on-line accounts with usernames and passwords to Counsel;

IT IS HEREBY ORDERED that the following protocol will apply to the forensic examination of Etra’s Devices:

1. By Friday, September 29, 2023, Etra’s Counsel shall provide the Devices to Benthos’ counsel, which will ship them to the independent forensic expert Vestige Digital Investigations (“the Forensic Expert”), 23 Public Square, Suite 250, Medina, OH 44256, gkelley@vestigeltd.com, 800-314-4357 x5432. By Friday, September 29, 2023, Etra’s Counsel shall deliver to Benthos, via email to Benthos’s counsel (spopofsky@kkwc.com and abenintendi@kkwc.com), via email to the Forensic Expert (gkelley@vestigeltd.com) and via email to the Court (CaproniNYSDChambers@nysd.uscourts.gov) the passcodes and passwords received from Etra so far.
2. As soon as practicable, and not later than Wednesday, October 4, 2023, Etra’s Counsel shall deliver to Benthos, via email to Benthos’s counsel (spopofsky@kkwc.com and abenintendi@kkwc.com), via email to the Forensic Expert (gkelley@vestigeltd.com) and via email to the Court (CaproniNYSDChambers@nysd.uscourts.gov) a list, prepared by Etra, identifying all accounts – including, but not limited to, e-mail accounts (including web-based e-mail accounts); accounts (including web- or cloud-based) relating to any document management services, such as (by way of example only) Dropbox or iCloud; and accounts related to any messaging services, such as (by way of example only) WhatsApp, Facebook Messenger, instant messages, etc. – that Etra has used at any time since August 12, 2020 (the “Media”), together with user names and passwords associated with those accounts.
3. Before beginning any work on the Devices and Media, the Forensic Expert will use a hardware write block device on the Devices and Media to protect the integrity of the existing data (or other techniques standard in the industry to protect the integrity of data), and will notify Etra and Etra’s Counsel of the date and approximate time of its examination. The Forensic Expert will conduct its forensic examination in a secure environment and will use a secure and encrypted network when conducting its examination.
4. The Forensic Expert will create full forensic images of each Device and Media/account (the “Complete Etra Images”). The Complete Etra Images shall include, to the extent possible, allocated, unallocated, and host protected areas. As part of the creation of the Complete Etra Images, the Forensic Expert will record on a log, where applicable: (1) the date and time the Device or Media was provided for forensic imaging and the date and time the Device or Media was imaged; (2) the time set in the BIOS or system clock at the time of imaging; (3) the “boot order” recorded in the BIOS of the Device or Media at the time of imaging; (4) the make, model, and serial number of the Device being imaged; (5) the username associated with any Media being imaged; (6) any identifying marks or labels on any Device or Media being imaged; (7) the tool and/or method used to create the forensic images; and (8) MD5 and SHA-I hash values of the data collected from the Device or Media being imaged.
5. The Forensic Expert will develop a “Content Report” listing all user-generated content contained within the Complete Etra Images, including any content stored in the cloud (e.g., Apple iCloud, Dropbox, etc.), except for images with excessive amounts of skin tone.[3] The Content Report will be produced as an Excel spreadsheet and will contain the following information, where applicable: (1) a unique identifier; (2) the device from which the file or email was obtained; (3) the MD5 hash of the file or email; (4) the file name; (5) the file path; (6) the file system dates (created, last written, last accessed, MFT entry modified); (7) the file size; (8) the file status (active or deleted); (9) the email sender; (10) the email recipient(s); (11) the date the email was sent/received; (12) the email’s location in the inbox; and (13) the names of email attachments.
6. The Forensic Expert will send the Content Report via email[4] to Benthos and Etra’s Counsel and will provide the Complete Etra Images on a hard drive to Etra’s Counsel and the Court. Etra’s Counsel must deliver the Etra Images to Etra within five business days of receiving them. If Etra is still incarcerated by the time the Complete Etra Images are delivered to his Counsel, Counsel must deliver the Complete Etra Images to MDC Brooklyn, 80 29th Street, at some point between 8AM and 12PM, and ask an officer to deliver the Etra Images to MDC’s Paralegal Specialist Michael Cardew, who will convey them to Etra.
   a. Not later than three weeks after the Content Report has been delivered to Etra’s counsel, Benthos must file a status update regarding the forensic examination and its availability for a status conference to discuss the timeline for Etra to assert any claim of privilege over any particular contents contained on his Devices or in his Media (the “Privilege Assertions”).
   b. At the conference, Etra must be prepared to agree to a date by which he will submit any claim of privilege, recognizing that such claims must be presented in the form of a table or log setting forth (1) the data at issue, cross-referenced to the Content Report; and (2) Etra’s factual and legal basis for any claim or privilege over that data.
7. Within five business days following the Court’s ruling on the validity of the Privilege Assertions, the Forensic Expert shall make available to Benthos, through its counsel, the Complete Etra Images minus any data the Court deems privileged (the “Non-Privileged Etra Images”). Benthos will use its best efforts to target solely data relevant to this litigation when reviewing the Non-Privileged Etra Images. The Original Etra Images shall remain in possession of the Forensic Expert and shall not be provided to Benthos except by Court order. The Forensic Expert shall not delete any data from the Devices.
8. Upon Benthos’s request, and the Court’s prior approval, the Forensic Expert will perform a forensic analysis of the Non-Privileged Etra Images to identify any evidence that relates to the integrity, authenticity, and completeness of the data held on the Non-Privileged Etra Images. The Forensic Expert will then conduct a forensic examination of the contents of the Non-Privileged Etra Images to review activity involving the creation, downloading, transfer, deletion, obfuscation, or destruction of any files from August 12, 2020, forward. The Forensic Expert will also attempt to recover any and all files that were transferred, deleted, obfuscated, or destroyed since August 12, 2020, and examine those files using the procedures set forth herein.
9. Upon delivery of the Non-Privileged Etra Image to Benthos, the Forensic Expert shall return the Devices to Etra’s Counsel. Etra’s Counsel shall not return to Etra, nor provide Etra with access to, the Devices unless and until so ordered by the Court. Benthos shall be given a reasonable opportunity to be heard before Etra repossesses or accesses the Devices.

SO ORDERED.

Footnotes