FORENSIC PROTOCOL ORDER

JAMES L. COTT, Magistrate Judge.

Consistent with this Court's directives from the November 7, 2019 Status Conference as transcribed (ECF #365), and following the hearing on December 12, 2019, this Court ORDERS that the following forensic analysis protocol be followed:

OVERVIEW

1. Ricoh Forensics ("Ricoh") has provided services related to forensic examination on behalf of Defendants in connection with the Connecticut Server, Office 365 and hard drive images listed in Ricoh's October 14, 2019 Report and assigned Item Numbers 001 through 045 therein (the "Ricoh Collected Data").

2. Capsicum Group, LLC ("Capsicum") shall be the designated examiner for the forensic examination on behalf of Plaintiffs.

3. Ricoh will provide Capsicum with a verified copy of the Ricoh Collected Data by December 16, 2019. Defendants shall provide Plaintiffs by January 6, 2020 with a certification under oath from a Ricoh representative that the Ricoh Collected Data includes all information located on the Connecticut Server at the time the Ricoh Data was collected.

EXAMINATION PROCEDURES

4. Capsicum agrees to return the copies of the Ricoh Collected Data to Defendants' counsel within fifteen (15) days of a decision on any spoliation motion brought by Plaintiffs in the above-captioned matter and shall destroy any and all copies of the data (and any associated work product) created during its examination. Capsicum shall include an executed certificate of destruction with the returned Ricoh Collected Data. Defendants shall maintain a full copy of the Ricoh Collected Data until the final resolution of this matter including the expiration of all appeal periods. If no spoliation motion is made, Capsicum agrees to return the copies of the Ricoh Collected Data to Defendants' counsel within fifteen (15) days of the date by which Plaintiffs' counsel has reported to the Court that no such motion will be made.

5. Unlike Plaintiff's counsel, Capsicum shall have complete access to the Ricoh Collected Data and any documents and information extracted from the Ricoh Collected Data. Plaintiffs' counsel shall have access only to metadata information and reports generated from metadata (e.g. names of authors, custodians, email addresses, dates and times) and quantitative data (e.g. file sizes, counts and page counts) provided to them by Capsicum. Plaintiffs' counsel will not have physical possession of the ESI. Capsicum may use whatever means are reasonable and necessary to access and tabulate the Ricoh Collected Data and provide reports to Plaintiffs' counsel.

6. Should Plaintiffs' counsel require access to additional content not authorized in Paragraph 5 above, including the substance of identified documents, Capsicum shall provide that content to Defendants' counsel before disclosing any of that content to Plaintiffs' counsel. Defendants' counsel will have fifteen (15) days from receipt of any such content (the "Review Period") to file an objection with the Court objecting to the disclosure of any content to Plaintiffs' counsel on the basis that the information is privileged or otherwise objectionable. Absent any objection, after the expiration of the Review Period, such content shall be provided to Plaintiffs' counsel and shall be subject to the Stipulated Protective Order entered in this case (ECF #120).

7. Plaintiffs and Defendants shall meet and confer to resolve any disputes that arise related to this Order, and no objections or any other dispute may be presented to the Court until after they have done so. TERMS, CONDITIONS, AND RESTRICTIONS

8. Capsicum agrees to diligently endeavor not to review substantive information accessible on the Ricoh Collected Data. However, notwithstanding the foregoing, Capsicum shall have the ability to review the Internet header information for any email and may also access email for the limited purpose of determining the custodian of the data (such as by looking at the signature block for any particular email).

9. Pursuant to Federal Rule of Evidence 502(d), to the extent that Capsicum or Plaintiffs' counsel has direct or indirect access to information protected by any applicable privilege, including but not limited to attorney-client privilege, work-product privilege, and common interest privilege, such access will not result in a waiver of any such privilege in this or any other federal or state proceeding.

10. All data and analyses governed by this Protocol are deemed to be protected and considered Restricted Confidential material as defined in the Stipulated Protective Order entered in this case (ECF #120), and will be treated as such unless and until, upon application from the parties, such material should be characterized differently.

11. Capsicum shall not use any data security intelligence obtained through the examination to access any electronic information not present on the devices or storage media, including but not limited to accessing private online or cloud accounts, e-mail accounts or servers, private social media sites and banking and credit card accounts and transactions.

12. Plaintiffs' counsel will provide a copy of this Order to Capsicum no later than December 16, 2019 (and in advance of its receipt of the Ricoh Collected Data). Defendants' counsel will provide a copy of this Order to Ricoh no later than December 16, 2019 (and in advance of its production of the Ricoh Collected Data). The parties, Ricoh, and Capsicum are hereby put on notice that failure to comply with the terms of this Order may result in sanctions.

SO ORDERED.