Court Opinion

ID: 9372007
Source: CourtListenerOpinion
Date Created: 2023-02-17 16:00:55.158991+00
Date Added: 2024-06-11T17:16:31.754265
License: Public Domain

ATTACHMENT A: Forensic Examination Protocol

This protocol relates to BioConvergence, LLC v. Jaspreet Attariwala, No. 1:20-mc-101-RC
(D.D.C) (“D.C. Court”), which is a miscellaneous action relate to BioConvergence, LLC v.
Jaspreet Attariwala, No. 1:19-cv-01745-SEB-MG (S.D. Ind.) (hereinafter, the “Underlying
Action”).

In accordance with the D.C. Court’s instructions during the November 19, 2021 hearing,
BioConvergence LLC d/b/a Singota Solutions (“Singota”) has selected for initial inspection the
external hard drive to which Simranjit J. Singh states he copied the Western Digital My Book
drive that was identified by Rebecca Green and that Jaspreet Attariwala and Mr. Singh have
testified was discarded in or about late 2017 or 2018 (“Western Digital My Book Drive”). See
Declaration of Third Party, Sim J. Singh (“Singh Decl.”) [Doc. 22-1] ¶¶ 34-35; Tr. Dep.
Simranjit Attariwala, Nov. 4, 2021 (“Singh Dep.”) at 116:4 – 119:15. Mr. Singh has stated that
before discarding the Western Digital My Book Drive, he copied it to another external drive that
remains in his possession (the “Device”). Singota therefore has selected that Device for initial
inspection.

The examination shall be conducted by Jim Vaughn and iDiscovery Solutions (the “Examiner”).

The Examiner will serve as an officer of the court in examining the Device and be bound by the
terms of this Protocol. The Examiner will sign a copy of this Protocol and any Protective Order
issued and in effect for this case at the time of the examination. The Examiner must agree in
writing to be bound by the terms this Protocol or any order related to this examination prior to
the commencement of the work.

The Examiner will abide by forensic industry ethical standards and will not accept improper
attorney influence. Furthermore, the Examiner will not knowingly reach conclusions before
research is completed, overstate conclusions, base conclusions and testimony on speculation, or
give misleading testimony.

Singota has absolutely no interest in Mr. Singh’s personal, family, or work data, and its only
interest pertains to Singota’s trade secrets or confidential information that belongs to Singota in
completing their CDMO business (the “Relevant Singota ESI”).

None of the sections in this Forensic Examination Protocol shall be construed as a waiver of any
defense or privilege by Mr. Singh.

The following steps and reporting shall apply to the documentation, imaging and analysis of the
external drive described by Mr. Singh on page 118 of his deposition transcript.

Step 1. Payment

1.1. Any charges and fees for the Examiner’s professional time shall be timely paid exclusively
by Plaintiff Singota per this Court’s Order, subject to further order of this Court or the U.S.
District Court for the Southern District of Indiana in which the underlying litigation is pending.

                                                 45
Step 2. Production of Device

2.1 Within 7 business days after this protocol has been approved by Judge Rudolph Contreras via
Court Order, Mr. Singh shall ship the device to the Examiner using FedEx pack and ship
services. FedEx will pack and ship the device. Mr. Singh’s counsel will provide a copy of the
tracking information for the shipment to Singota’s counsel by email on the day of shipment.

2.2 All costs of shipping via FedEx will be borne by Mr. Singh. Mr. Singh will provide along
with the Device the address and the contact information to be used for the return of the Device.

Step 3. Documentation

3.1 Upon receipt by the Examiner, the external device shall be photographed by the Examiner
from enough angles to capture all markings of the device, including, but not limited to, the top,
bottom, any connection ports and any attached labels or stickers. The make, model and serial
number of the external device shall be documented and included in the report described in
Section 4.4 of this protocol.

Step 4. Forensic Imaging

4.1 All forensic imaging must occur promptly in order for the Examiner to be able to comply
with the Device return dates detailed in Step 5 below.

4.2 A forensic industry standard hardware write blocker shall be used to prevent any changes to
the external device. Once connected to an industry standard hardware write blocker, a forensic
imaging tool such as FTK Imager (or comparable software program) shall be used to create a full
physical bit by bit forensic image. The write blocker and forensic imaging tool used shall be
documented and included in the report as part of this protocol. The forensic image shall be
verified by either SHA-1 or MD5 hash. An exact copy shall be made of the forensic image. The
original forensic image shall be kept in pristine condition, and the copy shall be used for the
analysis as described within this protocol.

4.3 The Examiner shall ensure that all partitions on the forensic image are accounted for. Once
all partitions have been accounted for and are visible within the forensic image, recovery of
folders and files shall be conducted. Once all partitions have been recovered, and all folders and
files recovered, results of the analysis shall be placed into a report (the “Forensic Imaging
Report”).

4.4 The Forensic Imaging Report shall:

i. Contain the format date of the external drive.

ii. Except for 4.4(i), 4.4(vi), 4.4(vii), and 4.4(viii), be restricted to the time period from January
1, 2018, through the present (the “Relevant Time Period”).

iii. Be restricted to files and emails with Creation Date, Last Accessed Date, Date Added, Last
Modified / Last Saved / Last Written Date, within the Relevant Time Period.

                                                    46
iv. Contain a listing of files within the Relevant Time Period, minus content, in spreadsheet
format, one file per row, to include File Name, File Extension, File Signature, File Size, Creation
Date, Last Accessed Date, Date Added, Last Modified / Last Saved / Last Written Date, MD5
hash, Full Path values, Password Protection Status (yes or no), and File Description (archive,
file, deleted, overwritten, etc.).

v. Contain a listing of emails within the Relevant Time Period, minus content, in spreadsheet
format, one parent email and attachment name per row, to include sent date and time, from, to,
cc, bcc, subject line and attachment name.

vi. If possible, provide an opinion regarding whether the Device is, or is not a copy of the
Western Digital My Book Drive. If it is not possible to provide an opinion one way or the other,
report what factors prevent the Examiner from providing an opinion.

vii. Report any evidence that tends to show what devices this Device has been connected to and
when.

viii. Report any deletions from, manipulations of data on, and irregularities concerning the
integrity of the Device.

4.5 The Report under this section shall be provided in full to Mr. Singh’s counsel.

4.6 Only the Report’s findings as to 4.4(i), 4.4(vi), 4.4(vii), and 4.4(viii) shall be provided to
Singota’s counsel.

Step 5. Return of the Device

5.1 Within 7 calendar days from the original date of receipt of the Device, and absent any reason
beyond the control of the Examiner, the Examiner will immediately ship the original Device
back to Mr. Singh by overnight delivery using FedEx ship services.

5.2 All costs of the return of the device via FedEx will be borne by Singota.

5.3 The return of device shall be made to the address and contact information provided by Mr.
Singh. (See Section 2.2.)

5.4 Once the Device is returned, it shall not be utilized by Mr. Singh or connected to any other
device until the procedures under this Protocol are completed, including any necessary
remediation.

Step 6. Creation of Examiner List/Access to the Data

6.1 The Examiner has previously been provided or generated the following lists: Names of
Singota’s Clients, Names of Singota’s Potential Clients, Names of Vendors Used by Singota,
Names of Employees at Singota, and Metadata from Files originating on Ms. Attariwala’s
Singota work laptop, which the Examiner may refine with further input from Singota’s counsel
based on experiences using these search terms in the Underlying Action. This information is

                                                  47
confidential to Singota, and the Examiner shall continue to maintain the confidentiality of this
information. (Hereafter, the “Confidential Search Term List.”)

6.2 After creation of the forensic image and analysis image of the Device, the Examiner will run
keyword searches using the Confidential Search Term List and use other data analytic tools,
including metadata and digital fingerprint analysis, and use manual review, as it determines
appropriate and consistent with industry best practices to attempt to identify Potentially Relevant
Singota ESI for the Relevant Time Period and create a listing of identified Potentially Relevant
Singota ESI files and emails (the “Examiner List”). The Examiner will prepare the Examiner List
after the Examiner has completed the Forensic Imaging Report.

6.3 Within 30 calendar days of returning the Device to Mr. Singh, the Examiner will create the
Examiner List and provide Mr. Singh’s counsel and Singota’s counsel with a copy of the
Examiner List.

6.4 Within 30 calendar days of receipt of the Examiner List, Mr. Singh’s counsel will use the
Examiner List to create a log and a list of files and emails on the Examiner List that Mr. Singh
believes in good faith contain entirely personal or privileged information. For each file or email
included on the Examiner List that Mr. Singh claims to be entirely personal or privileged, Mr.
Singh will provide a brief explanation of its contents and why it may have been captured by the
Singota keyword searches. Mr. Singh’s counsel will provide this log and list to Singota’s
counsel.

6.5 Within one business day after Mr. Singh’s counsel has provided the log and list described in
Section 6.4 to Singota’s counsel, Mr. Singh’s counsel will direct the Examiner to produce to
Singota’s counsel those files and documents identified on the Examiner List to which Mr. Singh
has not objected as either privileged or personal. As soon as practicable after receiving Mr.
Singh’s direction, the Examiner will provide copies of those specified files and documents to
Singota’s counsel. This timeline can be extended by the agreement of the parties or by Court
order due to, for example, the length of the list of files and emails.

6.6 Within 7 business days after Singota has received Mr. Singh’s log and list under Section 6.4
and the production of files and emails pursuant to Section 6.5, Singota’s counsel shall provide
written notice to Mr. Singh’s counsel whether Singota has any objections to Mr. Singh’s
withholdings based on claims of personal or privileged contents. If the parties cannot reach
agreement on these matters, the parties shall meet and confer, and cooperate in good faith to
resolve these objections. If the parties cannot resolve a dispute, then any party may move for
protection or for an order for the Court to review specified documents in camera. If Singota
requests such an in camera review by the Court, it will also provide an explanation as to why it
challenges Mr. Singh’s objection for each file or email. This timeline can be extended by the
agreement of the parties or by Court order due to, for example, the length of the list of files and
emails.

6.7 Within 15 business days after any objections have been resolved by agreement or court order,
Singota’s counsel shall confirm in writing whether each produced file contains Singota Relevant
ESI. If no objection is raised by Singota, Singota’s counsel shall confirm in writing to Mr.
Singh’s counsel whether each produced file contains Singota Relevant ESI within 15 business

                                                 48
days after receipt of the productions. This timeline can be extended by the agreement of the
parties or by Court order due to, for example, the number of files and emails.

6.8 To the extent the Examiner has direct or indirect access to information protected by the
attorney-client privilege, spousal/marital privilege, or any other privilege, such access will not
result in a waiver of any privilege. The parties will meet and confer to attempt to agree to a
protective order to cover any confidential files or documents of Mr. Singh or Singota from the
Device produced under this protocol. Pending entry of such a protective order, possession of files
and documents from the Device produced under this protocol is limited to the Examiner, the
attorneys of record in this case, the parties, and their experts. Any files and documents from the
Device produced under this protocol may be filed in the underlying or related litigation subject to
any protective orders in place therein; neither party may file any such purportedly confidential
information in any underlying or related litigation, however, until the Court has resolved any
request for a protective order over the information.

Step 7. Remediation

7.1 If Relevant Singota ESI is found on the device, the parties will meet and confer to attempt to
agree on a procedure for remediating the Relevant Singota ESI from the Device and any other
copies in Mr. Singh’s possession, custody, or control. If the parties are unable to agree, then the
parties shall submit remediation proposals to the Court for the Court to decide the issue of
remediation.

Step 8. Handling of Device Images Upon Conclusion of Examiner’s Work

8.1 Once the parties have agreed or the Court has determined that all Relevant Singota ESI has
been extracted from the device data in possession of the Examiner, the Examiner will within 15
business days destroy all other data in his possession, to include the Forensic Imaging Report,
and provide a certificate to the parties stating such action. If this does not occur, upon the closing
of this Third Party Matter (Case No. 1:20-mc-00101-RC), the Examiner will within 15 business
days destroy all other data in his possession, to include the Forensic Imaging Report, and provide
a certificate to the parties stating such action.

8.2 If Singota is unable to identify any Relevant Singota ESI in the device data in possession of
the Examiner, then the Examiner shall proceed to the destruction of all data as described in
Section 8.1.

                                                 49