Getting a Forensic Examination Ordered Over an Objection

Courts do not order forensic imaging of an opponent's device because deleted files might exist. They order it when the responding party has defaulted on its own obligation to search and produce, and the request is proportionate under Rule 26(b)(1). Suspicion is not a showing. The motions that succeed prove a production failure first and ask for access second — and specify who examines, what is examined, and what happens to everything else on the device.

This article is educational. It is not legal advice, and it is not a substitute for reading the rules and your own court's practice.

What does Rule 34 actually authorise?

Rule 34(a)(1) lets a party serve a request to produce and to permit the requesting party to inspect, copy, test or sample designated documents or electronically stored information. On its face that reaches inspection of a device. In practice, the Advisory Committee's position — repeated in opinion after opinion — is that the rule creates no routine right of direct access to an opponent's electronic information system, and that courts should guard against undue intrusiveness.

Everything else flows from Rule 26(b)(1), which limits discovery to matter relevant to a claim or defence and proportional to the needs of the case, weighing the importance of the issues, the amount in controversy, the parties' relative access to the information, their resources, the importance of the discovery in resolving the issues, and whether the burden or expense outweighs the likely benefit. Rule 26(c) supplies the protective-order machinery that makes an intrusive inspection tolerable when one is ordered.

So there are really two motions inside every forensic-examination motion: a discovery-failure motion and a proportionality motion. Most denied motions fail because only the second was briefed.

What is the threshold showing, and why does suspicion fail?

The clearest statement of the sequence comes from the Texas Supreme Court in In re Weekley Homes, L.P., which granted mandamus and vacated an order permitting the requesting party's forensic experts direct access to employees' storage devices for imaging and searching. Discrepancies and inconsistencies in the opponent's production, without more, did not justify so intrusive a measure.

The court drew explicitly on the federal experience under the 2006 amendments to Rule 34, whose committee notes state that direct access may be justified in some circumstances but that the rules create no routine right of access. From that it distilled a sequence worth memorising:

1. The requesting party must first show the responding party defaulted in its own obligation to search for and produce the requested information.
2. Skepticism alone is not enough.
3. Even then, only a qualified expert — not the requesting party — should conduct the examination, with intrusiveness carefully constrained.

In re Shipman applies the same framework and shows what a sufficient response looks like from the other side. The Texas Supreme Court conditionally granted mandamus and ordered vacatur of an order requiring a party to turn over his computer and other electronic devices for forensic examination: a suspicion that the responding party was unable or unwilling to search his own computer diligently did not justify it. The record mattered — the responding party had produced documents twice, had located further files in a backup folder on a replacement computer after an earlier machine crashed, and had explained through sworn affidavits that older records were destroyed under a retention practice years before suit.

The lesson runs in both directions. If you are resisting, the way to defeat the motion is to document your own search: sources identified, custodians interviewed, search terms run, results produced, and sworn explanation for what does not exist. If you are moving, you need to make that record impossible for your opponent to produce.

How does proportionality defeat a well-founded request?

By timing, cumulativeness, and burden — independently of whether the request is justified in principle.

Motorola Solutions, Inc. v. Hytera Communications Corp. denied a renewed motion to compel forensic inspection of an opponent's computers and network servers located overseas. The court's reasons are a checklist of what to avoid: forensic examination of a party's computers is not a routine matter even domestically; the request was made far too late in the discovery period to be completed; and on the record the inspection would have been cumulative and disproportionate. The court traced the movant's year-long pattern of raising and abandoning the request, and noted that the proposed protocol — imaging, examination, a detailed forensic report and chain-of-custody documentation — could not realistically be carried out in the weeks remaining.

The opinion also quotes two sources worth putting in your own brief on either side: the Advisory Committee's caution against routine access to an opponent's devices, and the Sedona Principles' warning that civil litigation should not treat information systems as crime scenes justifying forensic investigation at every opportunity. The Sedona Principles, Third Edition is the citation, and it is one judges recognise.

A separate proportionality trap concerns form rather than access. In re State Farm Lloyds holds that a requesting party is not automatically entitled to production of ESI in native, metadata-bearing form. Metadata may be discoverable when relevant, but relevance must be obvious or concretely linked to a claim or defence; hypothetical needs, surmise and suspicion carry no weight. The court distinguished native formats, which carry metadata, from static formats such as TIFF and PDF, which strip it and are searchable only through optical character recognition, and framed the test as whether the who, what, where, when and why of the data's creation is an actual issue in the case rather than a theoretical one. Discoverability, it emphasised, does not settle the manner of production.

That holding matters to examination motions because a great many of them are really metadata motions wearing a heavier coat. If what you need is creation and modification metadata for fifty documents, ask for those documents in native form and explain why the metadata is an actual issue. It is a far easier motion to win than imaging.

When do courts grant it?

Four recurring routes.

Preservation failure supplies the justification. Treppel v. Biovail Corp. found an adverse inference unjustified on the record but ordered additional discovery as the remedy, including a forensic search of the opposing party's computer systems. Because the movant had not shown the lost material would have supported his claims to the degree an adverse inference requires, the court chose a measure aimed at recovering what might still exist rather than one that presumed its contents. The mechanism is worth naming: a sanctions request converted into an investigative remedy, with the preservation failure supplying the justification for the intrusion.

The devices themselves are the evidence. In Jones v. Riot Hospitality Group LLC, the Ninth Circuit upheld orders directing the plaintiff and non-party witnesses to surrender their phones to a jointly retained forensic specialist. Two features of that holding are transferable. It located device-privacy concerns within Rule 26(b) proportionality and Rule 26(c) protective orders rather than treating them as a separate barrier, and it found the orders adequately limited by stipulated search terms and a privilege review. A protocol with those two features is materially more likely to be entered than a bare imaging request.

The responding party's own account is internally impossible. That is the shape of Rossbach v. Montefiore Medical Center, where forensic analysis showed the proffered text-message photograph could not have been produced on the device said to have received it. Once a party's evidence is shown to be inconsistent with the device it is attributed to, the argument that its devices need not be examined is much harder to sustain.

A criminal defendant's inspection request, answered with an image. United States v. Durham upheld the handling of the defendant's requests to inspect a phone where the government produced a mirror image rather than the device itself, and the defence examined the image through its own forensic expert. That is the routine and defensible answer to a device-inspection demand in either posture: produce a verified image, not the hardware.

What should the protocol say?

A motion that asks for "forensic imaging and examination" and stops there invites denial. A protocol that answers the following is asking the court to grant something it can supervise.

Term	What it should specify
Examiner	A neutral or jointly retained specialist, not the requesting party or its expert. This is the Weekley Homes point.
Scope of acquisition	Which devices, which accounts, which date ranges; logical or physical extraction; what is excluded outright.
Search method	Stipulated search terms or an agreed artefact list, as accepted in Jones.
Privilege	First-pass review by the responding party or a special master before anything goes to the requesting party.
Irrelevant data	Sequestration or destruction of everything outside scope; no retention of the full image by the requesting party.
Cost	Who pays, and whether allocation shifts if the examination confirms a production default.
Chain of custody	Hash values recorded at acquisition and verified, with documentation. See ISO/IEC 27037 and the SWGDE acquisition best practices.
Reporting	What the examiner may report to whom, and in what form.

Two references do real work in this drafting. ISO/IEC 27050-3, the electronic-discovery code of practice, is useful precisely because it is not a litigant's document. The Sedona Conference Commentary on Discovery of Mobile Device Data addresses the phone-specific proportionality arguments, and the Commentary on Ephemeral Messaging covers disappearing-message platforms, where the preservation question and the examination question collapse into one.

What about the data on the device that has nothing to do with the case?

This is the objection that most often persuades a court, and it deserves a straight answer rather than a dismissal. A phone image contains the custodian's medical records, family photographs, financial data, and the communications of every person who ever messaged them — including non-parties who have no notice and no voice in the proceeding.

Three things follow. First, proportionality analysis under Rule 26(b)(1) is the right home for the objection, and Jones confirms that is where it lives, alongside the Rule 26(c) protective order. Second, the answer is architectural, not rhetorical: a protocol that never lets the requesting party hold the full image, and that sequesters out-of-scope data, removes most of the force of the objection. Third, non-party devices raise the stakes — Jones upheld orders reaching non-party witnesses' phones, but it did so in a case with a documented pattern of coordinated deletion, which is not the ordinary case.

There is also a live tension in this area that is worth flagging rather than smoothing over. The device-search cases decided under the Fourth Amendment have accepted that a phone is qualitatively different from other containers because of what it aggregates. Civil discovery has no equivalent doctrinal rule, and courts reach the comparable outcome only through proportionality and protective orders — which are discretionary, non-uniform across districts, and reviewed for abuse of discretion. Practitioners should not assume the civil analysis has absorbed the constitutional intuition; it has not, and the results vary accordingly.

For counsel who want the forensic vocabulary these protocols are written in, the Digital Forensics for Lawyers track and Digital Forensic Files: Computer Forensics cover acquisition and examination mechanics; the FJC Reference Manual on Scientific Evidence is the reference most likely to be on the judge's shelf.