MEMORANDUM OPINION AND ORDER

JEFFREY CUMMINGS, Magistrate Judge.

Before the Court is defendants United Airlines, Inc.'s and James Simons' ("defendants") renewed motion to compel plaintiff Christopher Belcastro ("Belcastro") to submit to a forensic examination of his electronic devices. (Dckt. 137). Defendants filed a prior motion to compel on August 7, 2019 but withdrew it one week later. (Dckt. 131). The Court rules on these motions under District Judge Andrea R. Wood's referral for a decision pursuant to N.D. Ill. Rule 72.1. (Dckt. # 99). Based on the parties' briefs and an oral hearing on December 12, 2019 the Court finds that defendants' motion is granted in part and denied in part.

I. BACKGROUND

On March 15, 2017, Belcastro resigned from his position as a probationary pilot with United Airlines by submitting a resignation letter to Chief Pilot James Simons. See Belcastro v. United Airlines, Inc., No. 17 C 1682, 2019 WL 1651709, at *1-2 (N.D.Ill. April 17, 2019) (outlining the allegations involved in Belcastro's resignation from United). On March 2, 2017, Belcastro brought this action alleging inter alia race discrimination under Title VII, 42 U.S.C. § 2000e et seq., and defamation. Belcastro alleges that United defamed him by causing "a snapshot of Belcastro's employment file, of which only United had access, to be posted to the website airlinepilotcentral.com." (Dckt. 54 at ¶ 29). Belcastro clarified this allegation at his deposition. He testified that a pilot for another airline informed him sometime after he resigned that his employment file had been posted on airlinepilotcentral.com and that it incorrectly stated that Belcastro had been terminated. The file had been posted from a cell phone, had a time stamp on it, and had been highlighted in blue. (Dckt. 149, Ex. A at p. 60).

Much of the parties' dispute in this matter concerns the retrieval of this text. Belcastro stated in his discovery responses that he regularly backed up the iPhone to which the text was sent to his laptop computer. The computer, however, failed in August 2016 and Belcastro purchased a new laptop from Best Buy. He also purchased an external hard drive on which Best Buy was able to transfer some of the information from Belcastro's old computer. The recovered data — which receipts later showed amounted to 387 GB — was then transferred to Belcastro's new computer. In addition, Belcastro purchased a new iPhone in November 2017, transferred data from his prior phone to the new one, and left the older iPhone with Best Buy as a trade in. Despite that direct transfer of data, Belcastro claims that he "does not have access to text messages to his prior phone sent or received before May 31, 2017." (Dckt. 149 at Ex. C).

On November 28, 2018, Belcastro sat for his deposition. Some of his testimony was internally inconsistent and conflicted with other evidence that subsequently came to light. Belcastro said that he had the text message his friend sent him even though he could no longer locate the website image that accompanied it. In addition, his counsel claimed that the text had already been produced to defendants. Belcastro later testified, however, that he did not have the text message. (Dckt. 149, Ex. A at pp. 123-24, 147). He also stated that he traded in his prior iPhone in November 2016 and did not preserve any relevant data from it because he was not contemplating filing a lawsuit at that time. (Id. at p. 66). In reality, the phone was traded for a new iPhone in November 2017 — six months after this action was filed on March 2, 2017. Belcastro claimed in his July 15, 2019 interrogatory responses that he had produced all relevant non-privileged data from his laptop, cell phone, and hard drive. (Dckt. 149 at Ex. C). Defendants point out, however, that documents continued to be produced after that statement was made. Indeed, plaintiff's counsel conceded at the December 12, 2019 hearing that hundreds of documents had been turned over after the instant motion was filed and that some had been produced the morning of the hearing.

After defendants withdrew their earlier motion to compel, the parties began negotiations on a forensic search protocol ("the Protocol") setting out the terms for a third-party exam of Belcastro's electronic devices. The Protocol identifies the specific devices to be examined, proposes 130 search terms, and sets out procedures to govern the forensic exam. (Dckt. 150 at Ex. F). Defendants agreed to pay for the costs associated with the exam. Before the Protocol could be finalized, however, Belcastro withdrew from it out of a concern that a third-party ESI search would be overly invasive of his privacy.

Defendants then brought their renewed motion to compel asking the Court to direct plaintiff to (1) identify the information that he has withheld based on his objections to defendants' discovery requests and to submit a certificate of completion stating that plaintiff has fully answered defendants' requests; (2) respond more fully to defendants' Requests for Production Nos. 9 and 18; (3) provide a complete privilege log; and (4) submit to a third-party ESI search of plaintiffs' electronic devices.1 In their reply brief, defendants withdrew the first three elements and only pursue the fourth argument that plaintiff should submit to a forensic examination by a third-party ESI vendor.

II. LEGAL STANDARD

A forensic ESI exam constitutes an extraordinary remedy that is required "[o]nly if the moving party can actually prove that the responding party has concealed information or lacks the expertise necessary to search and retrieve all relevant data." Mirbeau of Geneva Lake LLC v. City of Lake Geneva, No. 08-CV-693, 2009 WL 3347101, at *1 (E.D.Wis. Oct. 15, 2009) (emphasis added). As this language suggests, the non-moving party may be required to submit to a forensic exam even if that party has not intentionally withheld discoverable ESI: in particular, a third-party investigation may be appropriate when the non-moving party "fails to initiate a reasonable process to search for, collect and produce responsive ESI." Procaps S.A. v. Patheon, Inc., No. 12-24356, 2014 WL 11498061, at *3 (S.D.Fla. Dec. 30, 2014). "Mere suspicion or speculation that an opposing party may be withholding discoverable information is insufficient to support an intrusive examination of the opposing party's electronic devices or information system." Hespe v. City of Chicago, No. 13 C 7998, 2016 WL 7240754, at *4 (N.D.Ill. Dec. 15, 2016) (internal quotes and citation omitted). In determining whether a third-party exam is required, courts must guard against undue intrusiveness and protect the non-moving party's privacy interests. See John B. v. Goetz, 531 F.3d 448, 459-60 (6th Cir. 2008). To that end, courts must take care to ensure that the request for a forensic exam is proportional to the needs of the case. See Motorola Solutions, Inc. v. Hytera Comm. Corp., 365 F.Supp.3d 916, 925 (N.D.Ill. 2019) (citing cases).

III. DISCUSSION

A. A forensic exam is warranted because the evidence shows that plaintiff lacks the expertise to search and retrieve all relevant data from his devices

Defendants argue that a forensic exam is warranted because plaintiff's continued production of ESI material — as well as the contradictions in his statements about that production — give rise to an inference that he has engaged in the spoliation of evidence. Plaintiff, on the other hand, argues that a forensic exam is unnecessary because he has diligently examined all of his devices and has already produced 1,300 pages of information to defendants. (Dckt. 145 at p. 18). Although the Court does find that a forensic exam is called for, it does not agree with either of the above propositions.

To begin, the fact that plaintiff cannot locate the evidence he says is central to his defamation claim — namely, the text involving his personnel file — does not suggest that plaintiff is intentionally concealing evidence. To the contrary, this fact suggests instead that plaintiff lacks the expertise to carry out a fully accurate ESI exam of his electronic devices because no rational litigant would withhold or delete information that is so important to his case. Furthermore, a party who was in fact engaged in spoliation of the evidence would not continue to produce documents that he earlier stated under oath in an interrogatory response did not exist.

At the same time, plaintiff's continued production of responsive documentation long after he represented in his sworn July 2019 interrogatory responses that he had produced all relevant non-privileged data from his devices supports an inference that plaintiff lacks the expertise necessary to search for and retrieve all relevant data. This inference is strengthened by the fact that plaintiff states that he has searched the data recovered by Best Buy as well as his phone but does not describe the specific terms he used to conduct that search. Cf. Memry Corp. v. Kentucky Oil Tech., N.V., No. C04-3843, 2007 WL 832937, at *4 (N.D.Cal. March 19, 2007) (refusing to order a third-party forensic inspection where party's representatives testified about the search of the hard drives of all of their computers for potentially relevant documents and the party seeking inspection could "only point to two missing emails out of thousands of documents produced"). That fails to clarify the steps that Belcastro has actually taken in this case. For these reasons, the Court finds that plaintiff's piecemeal production of responsive documents is explained by the fact that he "lacks the expertise necessary to search and retrieve all relevant data" from his multiple varied devices. Mirbeau of Geneva Lake LLC, 2009 WL 3347101, at *1. Consequently, a third party forensic exam is warranted to ensure that all responsive documents on plaintiff's devices is discovered and produced. Id.

B. Plaintiff's privacy concerns are adequately addressed by the parties ESI Protocol and the Agreed Confidentiality Order that is in place

Plaintiff, with citation to Hespe, supra, asserts that a forensic exam is unwarranted because it would be unduly invasive to his privacy. The Court recognizes the legitimate concerns that plaintiff, and litigants in general, have about the intrusions that inevitably accompany a third-party forensic exam. However, the facts that supported the decision in Hespe, differ in significant ways from the facts in this case. In Hespe, the plaintiff originally produced 850 text messages in response to discovery requests. Defendants subsequently learned through a subpoena to the plaintiff's mother that an additional 5,748 text messages existed that had not been produced. Hespe, 2016 WL 7240754, at *1. Defendants sought to examine plaintiff's devices on the ground that additional unproduced documents might be available. In particular, the defendants in Hespe sought thousands of texts and voice mails instead of looking "for any specifically identified text message or messages with particular content that they have shown to have existed at one point[.]" Id. at *5.

The Hespe court denied defendants' request for a forensic exam, in part, based on a concern that it would invade the plaintiff's privacy interests. Id. at *4. As Hespe suggests, the potential for infringing on a party's privacy interests rises with the increase in the scope of a forensic exam. Those concerns have been limited here by the Protocol that the parties were negotiating before plaintiff withdrew from an agreement to have his devices examined by a third party. The Protocol sets out specific terms and procedures that will govern the forensic exam. The Court further accommodated plaintiff's privacy concerns at the December 12, 2019 hearing by modifying several aspects of the Protocol. For the reasons discussed in open court, search terms 95-123 are stricken from Ex. B of the Protocol. Defendants' proposed search of the websites identified in Paragraph III(H) is also stricken. In addition, Paragraph IV(D) is modified to give plaintiff's counsel three weeks to review the retrieved information for privileged items and to submit a privilege log to defendants. Finally, the Protocol as modified confines the forensic exam to the period from January 1, 2015 through the date of the filing of this case on March 2, 2017 (instead of through the present as the Protocol was initially drafted). With these modifications in place, the Court finds that plaintiff's privacy interests will not be unduly invaded by a third-party exam of his electronic devices.

The Hespe court also denied the forensic exam on the ground that the inspection of the plaintiff's devices "was not proportional to the needs of the case." Id. at *2. Such is not the case here. To the contrary, the document that defendants are primarily concerned about here — the website text — goes to the heart of plaintiff's claim of defamation. Moreover, the defendants in Hespe were seeking information to support a claim that the court determined the "plaintiff all but conceded . . . in her brief in opposition to defendants' motion to compel[.]" Id. at *5. Again, that is clearly not the case here where plaintiff alleges — and defendants deny — that defendants have defamed him. Thus, unlike in Hespe, both sides in this case have a strong interest in the question of whether the posted image of plaintiff's personnel file can be retrieved.

C. Defendants must bear the cost of the forensic exam

Defendants agreed in the Protocol to pay for the forensic exam. In their renewed motion, however, defendants claim that plaintiff's withdrawal from the Protocol supports requiring plaintiff to bear the costs. Citing Zubulake v. UBS Warburg LLC, 217 F.R.D. 309 (S.D.N.Y. 2003), plaintiff argues that defendants should pay. Zubulake sets out a seven-factor test for evaluating who should pay for an ESI search: (1) the extent to which the request is specifically tailored to discover relevant information; (2) the availability of such information from other sources; (3) the total cost of production compared to the amount in controversy; (4) the total cost of production, compared to the resources of each party; (5) the relative ability of each party to control costs and its incentive to do so; (6) the importance of the issues at stake in the litigation; and (7) the relative benefits to the parties of obtaining the information. Zubulake, 217 F.R.D. at 322. Zubulake stresses that these factors are not a "check-list" and "should not be weighed equally." Id.

The Court finds that defendants' earlier agreement to bear the costs of the ESI exam should remain in place. Defendants claim that the cost would involve a "minimal expense," (Dckt. 149 at p. 11), which they estimated at the hearing would amount to around $5,000. That may be minimal to a corporation like United but it would impose a significantly greater burden on an individual plaintiff with far fewer resources. The Court also notes that even though plaintiff's document production may not have been complete in all respects, he has turned over a significant number of responsive materials to defendants. Given that plaintiff's inability to provide all of the non-privileged documents stems from a lack of skill instead of an adverse intent, defendants should bear the burden of paying for the forensic exam.

D. Defendants are not entitled to an award of expenses that they incurred in bringing their motion to compel

The Court further denies defendants' request that plaintiff should pay their expenses in bringing the motion to compel. Defendants withdrew three of the four topics on which that motion is based. That suggests that the withdrawn issues could — and should — have been resolved through a more vigorous application of Local Rule 37.2's meet and confer requirements. See Mirbeau, 2009 WL 3347101, at *3 ("Nothing is to be gained by the distraction of the parties' resources through invoking the court to police discovery disputes."). Moreover, although the Court has ordered a forensic exam, it also limited the timeframe and scope of the ESI search that defendants seek and it ordered defendants to bear the costs of the exam. For these reasons, the Court denies defendants' request to be reimbursed for their expenses.

CONCLUSION

For all of the above reasons, defendants' renewed motion to compel [137] is granted in part and denied in part.