When a case needs devices imaged, an intrusion reconstructed, or data identified and removed, a neutral forensic examiner spares the court a battle between each side's expert. This annotated order sets the imaging protocol, the chain of custody, and a privilege screen — and confines the neutral to facts, reserving conclusions to the parties and the Court.
How to use this. The shaded text is model order language; the note beneath each clause explains its function. Bracketed terms are for you to complete. This is a drafting framework, not legal advice — adapt it to your court, the governing rule, and the operative protective order. Print this page to PDF to circulate it.
Appointment and mandate
The Court appoints [Name] as Neutral Forensic Examiner and Special Master under Rule 53 to forensically image and examine the devices and data sources identified below, and to report factual findings, reserving all legal conclusions to the Court and the parties.
Note — A forensic neutral is a fact gatherer, not a problem solver. Confine the mandate to imaging, examination, and factual reporting.
Devices and data sources
The examination shall cover: [identified computers, mobile devices, servers, cloud accounts, and storage media]. The parties shall facilitate access and provide credentials necessary for imaging. The Examiner shall not exceed the sources enumerated without further order.
Note — Enumerate the sources precisely and require cooperation on access and credentials. An open-ended device list invites disputes about overreach.
Imaging protocol and chain of custody
The Examiner shall create forensically sound images using write-blocking and shall record hash values for each image. The Examiner shall maintain a documented chain of custody for all media and images from acquisition through disposition.
Note — Write-blocking, hashing, and a documented chain of custody are the baseline of defensible forensics. State them so the resulting evidence is not vulnerable to an authenticity challenge.
Privilege and confidentiality screen
Before any material is disclosed to a party, the producing party shall have the opportunity to review the Examiner's proposed production for privilege and confidentiality and to log withheld items. The Examiner shall handle all data under the Protective Order.
Note — Build in a privilege review before disclosure. A neutral examination that skips the privilege screen creates waiver risk that can sink the engagement.
Identification and removal of data
Where the Order contemplates the identification and removal of specified data (for example, misappropriated files or inadvertently produced material), the Examiner shall identify candidate items, submit them for the parties' review under the protocol above, and remove or remediate only as the Court directs.
Note — Removal is powerful and irreversible; gate it behind party review and a court direction. This clause is what makes a neutral useful in trade-secret and inadvertent-production matters.
Report
The Examiner shall submit a written report describing the process of collection, processing, analysis, and review, and stating factual findings. The report shall present no legal findings or conclusions, which are reserved to the Court and the parties.
Note — The report describes method and facts. Keeping legal conclusions out preserves the neutral's role and the report's utility to both sides.
Compensation and review
The Examiner shall be compensated at $[__] per hour, allocated under Rule 53(g). A party may object to the report within [14] days; the Court reviews under Rule 53(f).
Note — Standard Rule 53 compensation and review terms. Forensic engagements can expand with the data volume; a clear rate and allocation prevent mid-course disputes.
Tailoring the Order
A model order is best finalized with the prospective neutral, who can flag the technical-access and protective provisions a specific matter will need. Chambers and counsel are welcome to request a draft framework for an anticipated appointment.