OPINION OF THE COURT
Moskowitz, J.
This appeal provides us with the first opportunity to address the obligation of a nonparty to produce electronically stored information (ESI) deleted through normal business operations. The action underlying this discovery dispute concerns a statement about plaintiff that someone posted on a Web site known as Vitals.com on April 12, 2009. Plaintiff claims this statement defamed her.1
Plaintiff claims that through discovery she managed to trace the Internet protocol (IP) address of the computer from which the allegedly defamatory post originated “to a computer in the [77]*77custody and control of New York University.” This computer had accessed the Internet through a portal located at Bellevue Medical Center and registered to nonparty New York University Langone Medical Center (NYU). According to NYU’s Chief Information Security Officer, NYU had installed the Internet portal at Bellevue for the convenience of its residents who train there. The portal is a network address translation portal that is essentially a switchboard through which a person can access the Internet. While only NYU personnel with proper security codes can gain access to NYU’s computer system and medical records, anyone using a computer plugged into an ethernet outlet at Bellevue can access other Web sites through the NYU portal. On April 12, 2009, as many as 2,000 NYU personnel and an untold number of Bellevue physicians, staff, and visitors could have accessed a Web site through the NYU portal. In fact, the portal is capable of allowing access to up to 65,000 users at any one time.
On April 30, 2010, plaintiff served a subpoena on NYU seeking the identity of all persons who accessed the Internet on April 12, 2009, via the IP address plaintiff previously identified.2 With the subpoena, plaintiff served a preservation letter advising NYU that the identity of the person who posted the remarks was at issue and that NYU should halt any normal business practices that would destroy that information.
When NYU did not produce the information, plaintiff moved for contempt. In opposition to plaintiff’s contempt motion, NYU’s Chief Information Security Officer stated that “ [Computers that simply access the web through NYU’s portal appear as a text file listing that is automatically written over every 30 days. NYU does not possess the technological capability or software, if such exists, to retrieve a text file created more than a year ago and ‘written over’ at least 12 times.”
Plaintiff, in reply, submitted an affidavit from a forensic computer expert opining that NYU could still access the information using software designed to retrieve deleted information. The expert stated that “the term ‘written over’ is deceptive” because what really occurs is that “ ‘old’ information or data is typically reallocated to ‘free space’ within the system.” Plaintiffs expert suggested using “X-Rays Forensic” or “Sleuth Kit” to retrieve the information from unallocated space.
[78]*78Supreme Court denied the contempt motion in part because it found that NYU did not have the ability to produce the materials plaintiff demanded and that “[t]his allegation is unrefuted as a reply affidavit contradicting such allegation has not been supplied.”3
Supreme Court was incorrect. As just mentioned, plaintiff had interposed an affidavit in reply from an expert detailing the steps NYU could take to obtain the data, including the utilization of forensic software.
In its papers in opposition to the motion, NYU offered no evidence that it made any effort at all to access the data, apparently because it believed it could not, as a nonparty, be required to install forensic software on its system. However, the cases that NYU cites to support its assertion that it need not install forensic software are outdated. The most recent is from 1993, nearly 20 years ago (see Carrick Realty Corp. v Flores, 157 Misc 2d 868 [Civ Ct, NY County 1993]). Thus, as discussed below, there are several unanswered questions regarding NYU’s ability to produce the requested documents.
The party moving for civil contempt arising out of noncompliance with a subpoena duces tecum bears the burden of establishing, by clear and convincing evidence, that the subpoena has been violated and that “the party from whom the documents were sought had the ability to produce them” (Yalkowsky v Yalkowsky, 93 AD2d 834, 835 [1983]; see also Gray v Giarrizzo, 47 AD3d 765, 766 [2008]).
In this day and age the discovery of ESI is commonplace. Although the CPLR is silent on the topic, the Uniform Rules of the Trial Courts, several courts, as well as bar associations, have addressed the discovery of ESI and have provided working guidelines that are useful to judges and practitioners. Indeed, in 2006, the Conference of Chief Justices approved a report entitled “Guidelines for State Trial Courts Regarding Discovery of Electronically Stored Information” (available at http:// www.ncsconline.org/images/EDiscCCJGuidelinesFinal.pdf). New York’s Uniform Rules for the Trial Courts specifically contemplate discovery of ESI. Rule 202.12 (c) (3) allows a court, where appropriate, to establish the method and scope of electronic discovery (Uniform Rules for Trial Cts [22 NYCRR] § 202.12 [c] [3]).
[79]*79The Uniform Rules addressing the discovery of ESI are fairly recent. They took effect in 2009. However, the Rules of the Commercial Division of the Supreme Court have addressed discovery of ESI for some time. Rule 8 (b) of the rules contains requirements similar to those in the Uniform Rules (22 NYCRR 202.70 [g]). The Commercial Division for Supreme Court, Nassau County has built on Commercial Division rule 8 (b) to develop the most sophisticated rules concerning discovery of ESI in the State of New York. That court also publishes in-depth guidelines for the discovery of ESI (the Nassau Guidelines). While aimed at parties, the Nassau Guidelines are appropriate in cases, such as this, where a nonparty’s data is at issue.
ESI is difficult to destroy permanently. Deletion usually only makes the data more difficult to access. Accordingly, discovery rules contemplate data recovery. For instance, the Uniform Rules include the “anticipated cost of data recovery and proposed initial allocation of such cost” in the scope of electronic discovery (Uniform Rules for Trial Cts [22 NYCRR] § 202.12 [c] [3]).
The Nassau Guidelines urge that parties should be prepared to address the production of ESI that may have been deleted. The Nassau Guidelines state that at the preliminary conference, counsel for the parties should be prepared to discuss: “identification, in reasonable detail, of ESI that is or is not reasonably accessible without undue burden or cost, the methods of storing and retrieving ESI that is not reasonably accessible, and the anticipated costs and efforts involved in retrieving such ESI” (New York State Supreme Court, Commercial Division, Nassau County, Guidelines for Discovery of Electronically Stored Information [“ESI”], at II [C] [4] [eff June 1, 2009], available at http ://www. courts. state. ny.us/courts/comdiv/PDFs/N assau-E - Filing_Guidelines .pdf).
The Nassau Guidelines also suggest that the parties be prepared to discuss “the need for certified forensic specialists and/or experts to assist with the search for and production of ESI” (id.
Free access — add to your briefcase to read the full text and ask questions with AI
OPINION OF THE COURT
Moskowitz, J.
This appeal provides us with the first opportunity to address the obligation of a nonparty to produce electronically stored information (ESI) deleted through normal business operations. The action underlying this discovery dispute concerns a statement about plaintiff that someone posted on a Web site known as Vitals.com on April 12, 2009. Plaintiff claims this statement defamed her.1
Plaintiff claims that through discovery she managed to trace the Internet protocol (IP) address of the computer from which the allegedly defamatory post originated “to a computer in the [77]*77custody and control of New York University.” This computer had accessed the Internet through a portal located at Bellevue Medical Center and registered to nonparty New York University Langone Medical Center (NYU). According to NYU’s Chief Information Security Officer, NYU had installed the Internet portal at Bellevue for the convenience of its residents who train there. The portal is a network address translation portal that is essentially a switchboard through which a person can access the Internet. While only NYU personnel with proper security codes can gain access to NYU’s computer system and medical records, anyone using a computer plugged into an ethernet outlet at Bellevue can access other Web sites through the NYU portal. On April 12, 2009, as many as 2,000 NYU personnel and an untold number of Bellevue physicians, staff, and visitors could have accessed a Web site through the NYU portal. In fact, the portal is capable of allowing access to up to 65,000 users at any one time.
On April 30, 2010, plaintiff served a subpoena on NYU seeking the identity of all persons who accessed the Internet on April 12, 2009, via the IP address plaintiff previously identified.2 With the subpoena, plaintiff served a preservation letter advising NYU that the identity of the person who posted the remarks was at issue and that NYU should halt any normal business practices that would destroy that information.
When NYU did not produce the information, plaintiff moved for contempt. In opposition to plaintiff’s contempt motion, NYU’s Chief Information Security Officer stated that “ [Computers that simply access the web through NYU’s portal appear as a text file listing that is automatically written over every 30 days. NYU does not possess the technological capability or software, if such exists, to retrieve a text file created more than a year ago and ‘written over’ at least 12 times.”
Plaintiff, in reply, submitted an affidavit from a forensic computer expert opining that NYU could still access the information using software designed to retrieve deleted information. The expert stated that “the term ‘written over’ is deceptive” because what really occurs is that “ ‘old’ information or data is typically reallocated to ‘free space’ within the system.” Plaintiffs expert suggested using “X-Rays Forensic” or “Sleuth Kit” to retrieve the information from unallocated space.
[78]*78Supreme Court denied the contempt motion in part because it found that NYU did not have the ability to produce the materials plaintiff demanded and that “[t]his allegation is unrefuted as a reply affidavit contradicting such allegation has not been supplied.”3
Supreme Court was incorrect. As just mentioned, plaintiff had interposed an affidavit in reply from an expert detailing the steps NYU could take to obtain the data, including the utilization of forensic software.
In its papers in opposition to the motion, NYU offered no evidence that it made any effort at all to access the data, apparently because it believed it could not, as a nonparty, be required to install forensic software on its system. However, the cases that NYU cites to support its assertion that it need not install forensic software are outdated. The most recent is from 1993, nearly 20 years ago (see Carrick Realty Corp. v Flores, 157 Misc 2d 868 [Civ Ct, NY County 1993]). Thus, as discussed below, there are several unanswered questions regarding NYU’s ability to produce the requested documents.
The party moving for civil contempt arising out of noncompliance with a subpoena duces tecum bears the burden of establishing, by clear and convincing evidence, that the subpoena has been violated and that “the party from whom the documents were sought had the ability to produce them” (Yalkowsky v Yalkowsky, 93 AD2d 834, 835 [1983]; see also Gray v Giarrizzo, 47 AD3d 765, 766 [2008]).
In this day and age the discovery of ESI is commonplace. Although the CPLR is silent on the topic, the Uniform Rules of the Trial Courts, several courts, as well as bar associations, have addressed the discovery of ESI and have provided working guidelines that are useful to judges and practitioners. Indeed, in 2006, the Conference of Chief Justices approved a report entitled “Guidelines for State Trial Courts Regarding Discovery of Electronically Stored Information” (available at http:// www.ncsconline.org/images/EDiscCCJGuidelinesFinal.pdf). New York’s Uniform Rules for the Trial Courts specifically contemplate discovery of ESI. Rule 202.12 (c) (3) allows a court, where appropriate, to establish the method and scope of electronic discovery (Uniform Rules for Trial Cts [22 NYCRR] § 202.12 [c] [3]).
[79]*79The Uniform Rules addressing the discovery of ESI are fairly recent. They took effect in 2009. However, the Rules of the Commercial Division of the Supreme Court have addressed discovery of ESI for some time. Rule 8 (b) of the rules contains requirements similar to those in the Uniform Rules (22 NYCRR 202.70 [g]). The Commercial Division for Supreme Court, Nassau County has built on Commercial Division rule 8 (b) to develop the most sophisticated rules concerning discovery of ESI in the State of New York. That court also publishes in-depth guidelines for the discovery of ESI (the Nassau Guidelines). While aimed at parties, the Nassau Guidelines are appropriate in cases, such as this, where a nonparty’s data is at issue.
ESI is difficult to destroy permanently. Deletion usually only makes the data more difficult to access. Accordingly, discovery rules contemplate data recovery. For instance, the Uniform Rules include the “anticipated cost of data recovery and proposed initial allocation of such cost” in the scope of electronic discovery (Uniform Rules for Trial Cts [22 NYCRR] § 202.12 [c] [3]).
The Nassau Guidelines urge that parties should be prepared to address the production of ESI that may have been deleted. The Nassau Guidelines state that at the preliminary conference, counsel for the parties should be prepared to discuss: “identification, in reasonable detail, of ESI that is or is not reasonably accessible without undue burden or cost, the methods of storing and retrieving ESI that is not reasonably accessible, and the anticipated costs and efforts involved in retrieving such ESI” (New York State Supreme Court, Commercial Division, Nassau County, Guidelines for Discovery of Electronically Stored Information [“ESI”], at II [C] [4] [eff June 1, 2009], available at http ://www. courts. state. ny.us/courts/comdiv/PDFs/N assau-E - Filing_Guidelines .pdf).
The Nassau Guidelines also suggest that the parties be prepared to discuss “the need for certified forensic specialists and/or experts to assist with the search for and production of ESI” (id. at II [C] [13]) Most important, the Nassau Guidelines do not rule out the discoverability of deleted data, but rather suggest a cost/benefit analysis involving how difficult and costly it would be to retrieve it: “As the term is used herein, ESI is not to be deemed ‘inaccessible’ based solely on its source or type of storage media. Inaccessibility is based on the burden and [80]*80expense of recovering and producing the ESI and the relative need for the data” (id. at IV [A]).4
The Federal Rules of Civil Procedure take a similar, although slightly more restrictive, approach. Rule 45 provides specific protections to nonparties. A person responding to a subpoena “need not provide discovery of electronically stored information from sources that the person identifies as not reasonably accessible because of undue burden or cost” (Fed Rules Civ Pro rule 45 [d] [1] [D]). Moreover, “[n] on-party status is a significant factor to be considered in determining whether the burden imposed by a subpoena is undue” (Whitlow v Martin, 263 FRD 507, 512 [CD Ill 2009]). Nevertheless, a federal court may still “order discovery from such sources if the requesting party shows good cause, considering the limitations of Rule 26 (b) (2) (C)” (Fed Rules Civ Pro rule 45 [d] [1] [D]). Rule 26 (b) (2) (C) (i)-(iii) requires a court to limit any discovery: (1) that “is unreasonably cumulative or duplicative,” (2) “can be obtained from some other source that is more convenient, less burdensome, or less expensive,” (3) where the party has already “had ample opportunity to obtain the information by discovery in the action” or (4) when “the burden or expense of the proposed discovery outweighs its likely benefit, considering the needs of the case, the amount in controversy, the parties’ resources, the importance of the issues at stake in the action, and the importance of discovery in resolving the issues.” The Advisory Committee Notes explain that the costs of retrieving the information are properly part of this analysis.
Meanwhile, some federal courts have suggested strict limits on the discovery of specific types of data that are typically overwritten or ephemeral. For example, the Seventh Circuit Electronic Discovery Pilot Program has adopted several “principles” to guide litigants through the discovery of ESI. In particular, principle 2.04 governing the scope of preservation states that certain categories of ESI “generally are not discoverable in most cases” (Seventh Circuit Electronic Discovery Com[81]*81mittee, Seventh Circuit Electronic Discovery Pilot Program, at 14-15 [Oct. 1, 2009], available at http://www.ilcd.uscourts.gov/ Statement%20-%20Phase%200ne.pdf). These categories include:
“(1) ‘deleted,’ ‘slack,’ ‘fragmented,’ or ‘unallocated’ data on hard drives;
“(2) random access memory (RAM) or other ephemeral data;
“(3) on-line access data such as temporary internet files, history, cache, cookies, etc;
“(4) data in metadata fields that are frequently updated automatically, such as last-opened dates; and
“(5) backup data that is substantially duplicative of data that is more accessible elsewhere;
“(6) other forms of ESI whose preservation requires extraordinary affirmative measures that are not utilized in the ordinary course of business” (id.).
However, the federal courts may still order the discovery of data from these sources in an appropriate case (see Victor Stanley, Inc. v Creative Pipe, Inc., 269 FRD 497, 524 [D Md 2010] [“(t)he general duty to preserve may also include deleted data, data in slack spaces, backup tapes, legacy systems, and meta-data”]; Columbia Pictures, Inc. v Bunnell, 245 FRD 443 [CD Cal 2007] [ordering production of server log data]). We also note Judge Scheindlin’s groundbreaking decision in Zubulake v UBS Warburg, LLC (217 FRD 309, 317 [SD NY 2003] [in developing framework for cost/benefit analysis, court noted that discovery obligations apply not only to “electronic documents that are currently in use, but also (to) documents that may have been deleted and now reside only on backup disks”]).
Based on the specific facts of this case, we find that the Nassau Guidelines provide a practical approach. To exempt inaccessible data presumptively from discovery might encourage quick deletion as a matter of corporate policy, well before the spectre of litigation is on the horizon and the duty to preserve it attaches. A cost/benefit analysis, as the Nassau Guidelines provide, does not encourage data destruction because discovery could take place regardless. Moreover, similar to rule 26 (b) (2) (C) (iii), the approach of the Nassau Guidelines, has the benefit of giving the court flexibility to determine literally whether the discovery is worth the cost and effort of retrieval.
[82]*82Here, plaintiff has variously described the information it seeks as stored in a “cache” file, as “unallocated” data or somewhere in backup data. Data from these sources is difficult to access. But, plaintiffs only chance to confirm the identity of the person who allegedly defamed her may lie with NYU. Thus, plaintiff has demonstrated “good cause” (see Fed Rules Civ Pro rule 45 [d] [1] [D]) necessitating a cost/benefit analysis to determine whether the needs of the case warrant retrieval of the data.
However, the record is insufficient to permit this court to undertake a cost/benefit analysis. Accordingly, we remand to Supreme Court for a hearing to determine at least: (1) whether the identifying information was written over, as NYU maintains, or whether it is somewhere else, such as in unallocated space as a text file; (2) whether the retrieval software plaintiff suggested can actually obtain the data; (3) whether the data will identify actual persons who used the Internet on April 12, 2009 via the IP address plaintiff identified; (4) which of those persons accessed Vitals.com; and (5) a budget for the cost of the data retrieval, including line item(s) correlating the cost to NYU for the disruption.5 Some of these questions (particularly [1] and [2]) may involve credibility determinations. Until the court has this minimum information, it cannot assess “the burden and expense of recovering and producing the ESI and the relative need for the data” (Nassau Guidelines, at IV [A]) and concomitantly whether the data is so “inaccessible” that NYU does not have the ability to comply with the subpoena. That NYU is a nonparty should also figure into the equation (see Whitlow, 263 FRD at 512). Of course in the event the data is retrievable without undue burden or cost, the court should give NYU a reasonable time to comply with the subpoena.
Further, it is worth mentioning that CPLR 3111 and 3122 (d) require the requesting party to defray the “reasonable production expenses” of a nonparty. Accordingly, if the court finds after the hearing that NYU has the ability to produce the data, the court should allocate the costs of this production to plaintiff and should consider whether to include in that allocation the cost of disruption to NYU’s normal business operations. In this latter consideration, the court should also take into account that plaintiff waited one year before sending the subpoena and preservation letter.
[83]*83The court also erred in transferring the case to Civil Court. Although the complaint seeks damages, it also seeks equitable relief that is not within the jurisdiction of Civil Court (see CPLR 325 [d]; W.H.P. 20 v Oktagon Corp., 251 AD2d 58, 59 [1998]).
Accordingly the order of the Supreme Court, New York County (Doris Ling-Cohan, J.), entered September 14, 2010, that denied plaintiff’s motion to hold nonparty NYU in contempt for failing to comply with a judicial subpoena, should be reversed, on the law, without costs, and the matter remanded to Supreme Court for a hearing on whether the information plaintiff seeks is “inaccessible” and hence whether NYU has the ability to comply with the subpoena. The order of the same court and Justice, entered September 24, 2010, that sua sponte transferred the action to the Civil Court pursuant to CPLR 325 (d), should be reversed, on the law, without costs, and the order of transfer vacated.
Gonzalez, EJ., Tom, Andrias and Freedman, JJ., concur.
Order, Supreme Court, New York County, entered September 14, 2010, reversed, on the law, without costs, and the matter remanded to Supreme Court for a hearing on whether the information plaintiff seeks is “inaccessible” and hence whether nonparty New York University Langone Medical Center has the ability to comply with the subpoena. Order, same court and Justice, entered September 24, 2010, reversed, on the law, without costs, and the order of transfer vacated.