//
© 2026 Zoe. All rights reserved.
Zoe is a legal information platform. Always consult the Federal Register of Legislation for authoritative text.
[2003] FCA 1161
plaintiff. Orders made preserving electronic and other documents, directing production to Court of documents relating to the email address and identity of the user, prohibiting deletion or tampering with...
The applicant sought Court orders to preserve and obtain electronic evidence from a public library computer to identify the anonymous author of emails that alleged corruption. The Federal Court (Emmett J) found that the hard drive might contain information to identify the author, that privacy concerns could be addressed by s 25 and by confidentiality undertakings, and therefore made orders preventing tampering, requiring production of documents and permitting forensic imaging and analysis subject to specified safeguards and undertakings.
AI-generated legal information, not legal advice. Zoe can make mistakes. Check the cited source, and for advice about your situation consult a qualified Australian lawyer.
2 cited instruments linked from this judgment.
1,988 words · generated 19/07/2026
This proceeding concerned an application by Ms Ingeborg Luise Grant (the applicant), a senior officer of the Art Gallery Society of New South Wales, for orders under O 15A r 3 of the Federal Court Rules to preserve and obtain documents and electronic evidence held by two local councils (the fourth and fifth respondents). The factual trigger was an email sent on 29 July 2003 alleging corruption in the sale or agency arrangements of a travel business; the email was purportedly signed by "Robert Menin" but the applicant knew no such person and believed the email author could have exposed her to an actionable claim (Reasons [2]–[3]). Inquiries traced the dispatch of the email to a computer in a library administered by the fifth respondent, with facilities supplied under arrangements involving the fourth respondent (Reason [3]).
The applicant sought three central forms of relief: (a) preservation orders preventing deletion or tampering with documents and electronic records; (b) production orders requiring the councils to produce documents and copies relating to the email address and the identity of the user of the email account (including records from particular date ranges and records relating to a specific IP address); and (c) controlled forensic access to the hard drive of the identified computer to permit a computer forensics expert to create a forensic image and analyse it (Orders and Annexures; Reasons [5]–[6]).
The councils did not oppose orders under O 15A r 3 provided appropriate safeguards were adopted. Those safeguards included confidentiality undertakings to be given to the Court by any person conducting the forensic examination (Reason [6]). The Court (Emmett J) found that examination of the hard drive might yield information helpful in identifying the author and that privacy concerns could be managed by reference to s 25 of the Privacy and Personal Information Protection Act 1998 and by the proposed safeguards. The Court therefore made preservation, production and controlled access orders, and annexed a detailed forensic imaging procedure (Annexure A) and a confidentiality undertaking form (Annexure B) (Reasons [4], [6]–[7]; Orders).
The decision rests on the procedural scope of O 15A r 3 and the balance of practical considerations about electronic evidence and privacy. The Court summarised the rule relied upon: where an applicant, after reasonable inquiries, cannot ascertain the description of a person for the purpose of commencing proceedings, and where it appears someone has or is likely to have documents or knowledge that would assist in such identification, the Court may order discovery under r 3(2) (Reason [1]). That is the threshold statutory mechanism empowering the Court to require discovery aimed specifically at identifying an unknown "person concerned".
The factual material before the Court satisfied the predicate for such relief. The applicant had made inquiries which showed the emails were sent from a particular library computer and that examination of the hard drive could potentially provide identifying information (Reason [3]–[4]). The Court expressly recorded satisfaction "that it may be possible, by examination of the hard drive of the computer in question, to obtain information that could assist in identifying the author of the emails" (Reason [4]). That finding of possibility is a central factual basis for ordering preservation and production.
Privacy concerns were acknowledged. The judgment notes that the proposed inquiries and examinations could involve contravention of provisions of the Privacy and Personal Information Protection Act 1998 (the reasons state the Act as "(Cth)") but points to s 25 as a statutory provision allowing a public sector agency not to comply with certain privacy obligations if the agency is lawfully authorised or required not to comply (Reason [4]). The Court therefore treated the statute not as an absolute bar but as a factor capable of being accommodated by process and safeguards.
Because the councils consented so long as safeguards were adopted, the Court required explicitly protective measures. Those measures were specified: a confidentiality undertaking by any person who examines the hard drive and any produced material; controlled forensic image procedures set out in Annexure A; and an undertaking to the Court to be given by the forensic examiner in the form annexed (Reason [6]; Orders 4 and Annexures A and B). The Court concluded that, given the factual position, the statutory power under O 15A r 3 and the availability of proportionate safeguards, it was appropriate to make the orders sought (Reason [7]).
The judgment operationalises the existing procedural power under O 15A r 3 of the Federal Court Rules to secure documents and information that may identify an unknown person. Prior to these orders the applicant had traced the emails to a library computer but lacked access to the device's hard drive and records necessary to progress identification. After the orders were made, the Court authorised preservation, production and controlled forensic access to that hardware and associated documents subject to confidentiality and forensic process controls (Orders; Annexures A and B).
The decision demonstrates how O 15A r 3 can be applied to modern forms of electronic evidence: the rule is robust enough to support preservation and imaging orders directed to public agencies that control access to a computer from which allegedly actionable communications were sent. It underscores that privacy statutes do not necessarily prevent such orders where statutory exceptions or authorisations (here s 25, as referred to in the reasons) and court-imposed safeguards are available.
The judgment does not purport to restate or create a new general doctrine outside the textual scope of r 3; rather it is an application of that rule to electronic forensics. The annexed forensic process offers a practical model for how courts can frame technical requirements in orders to preserve evidential integrity. The detailed forensic steps, and the confidentiality undertaking, are procedural adjuncts designed to protect third-party interests and the integrity of evidence.
Reason [1]: "That rule provides that where an applicant, having made reasonable inquiries, is unable to ascertain the description of a person ... the Court may make an order under r 3(2)." Plain English: If you have tried to find who did something but cannot, the Court may order someone who likely has information or documents to produce them to help identify that person.
Reason [3]: "On 29 July 2003, an email was forwarded ... purportedly signed on behalf of one 'Robert Menin'. The applicant knows of no person by that name." Plain English: The problematic email came from an unknown person using a false or unfamiliar name; the applicant wants to find who really sent it.
Reason [4]: "I am satisfied ... that it may be possible, by examination of the hard drive ... to obtain information that could assist in identifying the author of the emails." Plain English: The judge accepted that the computer's hard drive might contain traces, logs, cached data, email headers, that could show who used the machine to send the emails.
Reason [6]: "The fourth and fifth respondents do not oppose ... so long as certain safeguards are adopted ... include an undertaking of confidentiality." Plain English: The councils agreed to help but required protections to keep private information secure; the Court required those protections.
Reason [7]: "In the circumstances, I consider that it is appropriate to make the orders sought by the applicant." Plain English: Balancing the interest in finding the author and privacy concerns, the judge decided that the applicant should get the ordered steps, with safeguards.
This decision is directly engaged when these elements are present:
An anonymous or pseudonymous publication or communication gives rise to potential civil claims and the identity of the author is unknown (Reason [3]);
The applicant has made reasonable inquiries but cannot ascertain the person's description for commencement of proceedings (Reason [1]);
Inquiries enable reasonable grounds to believe that a specific third party (often a public body or service provider) has or is likely to have documents or access to electronic records that may identify the author, for example, a library computer, ISP logs or other retained electronic records (Reasons [3]–[4]);
There is a realistic prospect that forensic examination of electronic storage (hard drive, server logs, or similar) could reveal identifying information (Reason [4]);
The custodian of the system is a public sector agency or a body affected by privacy rules, and appropriate statutory exceptions and court-imposed safeguards can be fashioned (Reason [4], [6]).
Where these elements align, the Court may be persuaded to make preservation, production and controlled forensic access orders, and to require undertakings and specified technical processes to protect privacy and evidential integrity.
The text of this judgment itself does not discuss subsequent appellate treatment or later judicial citation. The decision is a Federal Court exercise of rule 3 powers and a practical model for drafting orders in electronic-evidence contexts; however, any statement about how later courts have treated Grant v Marshall would require external research beyond the judgment's text. Practitioners should therefore verify subsequent citations and appellate treatment in a current case law database before relying on this judgment as precedent for particular points of law or practice.
Several issues remain open or are not fully addressed within the four corners of this judgment:
Scope of s 25: The reasons refer to the Privacy and Personal Information Protection Act 1998 and s 25 as permitting non-compliance, but the judgment does not elaborate on the statutory test or the limits of that exemption. A full legal analysis of how s 25 operates in this factual context requires statutory construction and possibly further evidentiary material.
Standard for "may be possible": The Court found it "may be possible" that forensic examination could assist identification (Reason [4]). The threshold applied was permissive; future disputes may need clearer guidance on the level of likelihood or evidential basis required before intrusive forensic orders are made.
Particularity and proportionality of orders: While Annexure A prescribes a forensic image process and Annexure B a confidentiality undertaking, the judgment does not set detailed limits on the scope of searches, retention periods for copied images, or protocols for third-party or incidental personal data. Those operational details can be contested in later cases.
Privilege and third-party privacy: The orders permit access to potentially sensitive personal information of library users other than the suspected author. The judgment secures confidentiality undertakings, but it does not elaborate on notice to impacted third parties, the management of privileged material, or the test for redaction and return.
Costs and indemnity: The applicant undertook to pay reasonable costs incurred by the councils in complying with orders (Orders preamble; Reason [5]). The judgment does not explore how costs will be quantified or taxed, nor whether discovery costs might be recoverable later.
Chain of custody and evidence admissibility: Annexure A provides a method to preserve evidential integrity; however, admissibility and weight of forensic evidence when produced at trial will raise further issues of authentication, potential contamination and expert evidence, matters not litigated here.
Each of these points represents an area where subsequent litigation or legislative clarification could refine the principles applied in Grant v Marshall. Practitioners should design orders that anticipate these issues: specify limited search parameters, retention and destruction protocols for incidental data, clear chain-of-custody and verification procedures, and, where possible, obtain court approval of the technical process to reduce disputes about admissibility.
Concluding note: Grant v Marshall offers a practical template for obtaining preservation and controlled forensic access to electronic devices held by public agencies where an unknown author must be identified under O 15A r 3. The case emphasises the Court's willingness to order technically specific preservation and forensic processes while insisting on confidentiality and other safeguards to respect privacy and evidentiary integrity (Reasons [4], [6]–[7]; Annexures A and B).
By consent, upon noting the undertaking of the applicant to pay to the Fourth and Fifth Respondents their reasonable costs of complying with the following Orders, the Court makes the following Orders: 1. That, until further order, the Fourth Respondent, whether by itself, its servants, its agents or otherwise, refrain from deleting, moving, erasing, altering, concealing or tampering with any document or copy of document, whether electronic or otherwise, in its possession, custody or power, which: (a) was made or dated in the period 14 October 2002 to date and refers or relates to the email address robertmenin59@hotmail.com; (b) was made or dated in the period 14 October 2002 to date and refers or relates to the identity of any person using a computer to send or receive email: (i) via an account in the name of robertmenin59@hotmail.com; and (ii) from any library in the Shorelink network on 29 July 2003; (c) was made or dated in the period 4 August 2003 to date and which refers or relates to investigations undertaken by or on behalf of the Fourth Respondent, or any employee of any library in the Shorelink network of libraries: (i) to ascertain the identity of a person using the email address robertmenin@hotmail.com at any time; or (ii) regarding the I.P. address 203.111.117.212. 2. That the Fourth Respondent produce to the Court at Queen Square Sydney on 26 September 2003 all documents or copies of documents, whether electronic or otherwise, in its possession, custody or power, which: (a) were made or dated in the period 14 October 2002 to date and refer or relate to the email address robertmenin59@hotmail.com; (b) were made or dated in the period 14 October 2002 to date and refer or relate to the identity of any person using a computer to send or receive email: (i) via an account in the name of robertmenin59@hotmail.com; and (ii) from any library in the Shorelink network on 29 July 2003; (c) were made or dated in the period 4 August 2003 to date and which refer or relate to investigations undertaken by or on behalf of the Fourth Respondent, or any employee of any library in the Shorelink network of libraries: (i) to ascertain the identity of a person using the email address robertmenin@hotmail.com at any time; or (ii) regarding the I.P. address 203.111.117.212. 3. That until further order, the Fifth Respondent, whether by itself, its servants, its agents or otherwise, refrain from deleting, moving, erasing, altering, concealing or tampering with any document or copy of document, whether electronic or otherwise, in its possession, custody or power, which: (a) was made or dated in the period 14 October 2002 to date and refers or relates to the email address robertmenin59@hotmail.com; (b) was made or dated in the period 14 October 2002 to date and refers or relates to the identity of any person using a computer to send or receive email: (i) via an account in the name of robertmenin59@hotmail.com; and (ii) from any library in the Shorelink network on 29 July 2003; (c) was made or dated in the period 4 August 2003 to date and which refers or relates to investigations undertaken by or on behalf of the Fifth Respondent, or any employee of any library in the Shorelink network of libraries: (i) to ascertain the identity of a person using the email address robertmenin@hotmail.com at any time; or (ii) regarding the I.P. address 203.111.117.212. 4. That upon his giving an undertaking in the form attached to these Orders (Annexure B) the Fifth Respondent provide Peter Chapman with access to the hard drive, and all copies which have been made in the period 5 August 2003 to date of the hard drive, of the computer which is associated with IP address 203.111.117.212. for the purpose of enabling the process described in Annexure A to these Orders to be carried out. 5. That the Fifth Respondent produce to the Court at Queen Square Sydney on 26 September 2003 all documents or copies of documents, whether electronic or otherwise, in its possession, custody or power (other than the hard drive of the computer which is associated with IP address 203.111.117.212.), which: (a) were made or dated in the period 14 October 2002 to date and refer or relate to the email address robertmenin59@hotmail.com; (b) were made or dated in the period 14 October 2002 to date and refer or relate to the identity of any person using a computer to send or receive email: (i) via an account in the name of robertmenin59@hotmail.com; and (ii) from any library in the Shorelink network on 29 July 2003; (c) were made or dated in the period 4 August 2003 to date and which refer or relate to investigations undertaken by or on behalf of the Fifth Respondent, or any employee of any library in the Shorelink network of libraries: (i) to ascertain the identity of a person using the email address robertmenin@hotmail.com at any time; or (ii) regarding the I.P. address 203.111.117.212. 6. The matter be stood over to 31 October 2003 Note: Settlement and entry of orders is dealt with in Order 36 of the Federal Court Rules.
THE FORENSIC IMAGE PROCESS 1. Proper acquisition of computer evidence requires the use of non-invasive advanced computer software specifically designed for the task. Such software recovers, searches, authenticates and documents relevant electronic evidence without compromising the integrity of the original evidence. PricewaterhouseCoopers currently use "EnCase" software, which is the industry standard.
Analysis of a forensic image is a technical process requiring skill and resources. The vast array of computer software in use requires the forensic examiner to employ a diverse range of techniques to access data in a myriad of formats. Additionally, it is possible that there has been an attempt to conceal evidence with deceptive file names, password protection or encryption. The forensic image allows the examiner to conduct this search in a properly controlled environment.
The image process is also enables the computer evidence can be evaluated in the 'environment in which the evidence was created'. Operating System and Application Software files are preserved so that all steps that the user took to create the evidence can be duplicated by the computer forensics specialist and if necessary an independent examiner. This is vitally important in a case wherein sophisticated programs have been used, such as accounting software, electronic mail and Internet applications, or graphic design programs.
The adaptation of imaging to the investigation of computer data, together with the appropriate analysis software, now allows the forensic examiner access to data without fear of altering the original and with minimal disruption to the owner. A thorough search and complete identification of all evidence on a can take many hours per computer, depending on the volume, type and complexity of data stored, and the complexity of the search criteria. Without the forensic image process the analysis would be impractical and invasive.
It is possible to forensically preview the contents of a 'target' computer (that is, examine the hard drive in a write protected environment) prior to making a decision as to whether a forensic image is required. The preview is executed using a similar methodology as described above. The preview allows the examiner to search the 'target' computer for relevant material so that he/she can be confident the computer is relevant to the orders or legislation under which the search is being carried out.
The forensic preview is not a substitute for full analysis. If relevant data is located the contents of the hard drive should still be preserved by a forensic image and fully analysed.
CONFIDENTIALITY UNDERTAKING I, Peter Chapman, of 201 Sussex Street Sydney in the State of New South Wales, Manager, Dispute Analysis and Investigations, undertake to the Court in relation to data or information supplied to me on behalf of the Fifth Respondent pursuant to orders of the Court in the form contained in Annexure A for the purpose of carrying out the forensic process described in the Annexure to those orders ("the Confidential Material"), that subject to further or other order of the Court releasing me from these undertakings:
REASONS FOR JUDGMENT 1 The applicant claims relief under O 15A of the Federal Court Rules. Specifically, she claims relief against the fourth and fifth respondents, the Council of the City of Willoughby and the Council of the Municipality of Mosman respectively, pursuant to r 3. That rule provides that where an applicant, having made reasonable inquiries, is unable to ascertain the description of a person sufficiently for the purpose of commencing a proceeding in the Court against that person (in the rule called 'the person concerned'), and it appears that some person has or is likely to have knowledge of facts, or has or is likely to have or has had or is likely to have had possession of any document or thing, tending to assist in such ascertainment, the Court may make an order under r 3(2). Rule 3(2) authorises the Court to order that the person, and in the case of a corporation, the corporation by an appropriate officer, make discovery to the applicant of all documents which are or have been in the person's or the corporation's possession, relating to the description of the person concerned. 2 The applicant is the Senior Vice-President of the Art Gallery Society of New South Wales ('the Society') and has been a member of the Executive Committee since 1995. The Society is the membership-based fundraising arm of the Art Gallery of New South Wales. Among its fundraising and member services activities, the Society organises travel tours, through independent travel operators for its members. On 9 May 2002, the travel subcommittee of the Society recommended to the Society that it appoint Fiorella Travel Pty Ltd as agent in respect of some of the Society's tours and, on 23 September 2002, the Society entered into an agreement with that company in relation to overseas tours for members of the Society. The applicant believes that on 14 October 2003 the then owner of that company sold the company or the company sold its business to BMP Travel & Tourism Group Pty Ltd. 3 On 29 July 2003, an email was forwarded to a number of people making allegations of corruption. The email was purportedly signed on behalf of one 'Robert Menin'. The applicant knows of no person by that name. The email makes allegations in relation to the sale of the business of Fiorella Travel Pty Ltd and its arrangements with the Society. There is reasonable cause for belief that the applicant would have a cause of action under the Trade Practices Act 1974 (Cth) against the author of the emails. Instructions were given on behalf of the applicant for inquiries to be conducted in order to determine the source of the emails. Those inquiries have demonstrated that the emails were despatched from a computer in a library conducted by the fifth respondent. The computer in question provides facilities pursuant to arrangements made between the fifth respondent and the fourth respondent. 4 I am satisfied from the material before me that it may be possible, by examination of the hard drive of the computer in question, to obtain information that could assist in identifying the author of the emails. However, those inquiries and examinations may involve contravention of provisions of the Privacy and Personal Information Protection Act 1998 (Cth). On the other hand, s 25 of that Act provides that a public sector agency, which would include the fourth and fifth respondents, is not required to comply with certain provisions of that Act if the agency is lawfully authorised or required not to comply. 5 The applicant seeks orders that the fourth and fifth respondents refrain from deleting or erasing material that might assist in identifying the author of the emails. She also seeks orders for the production to the Court of material that might assist in identifying the author. She also asks that access to the hard drive of the computer be given to a computer forensic expert upon an appropriate undertaking being given. An undertaking has been given by the applicant to pay to the fourth and fifth respondents their reasonable costs of complying with the orders sought. 6 The fourth and fifth respondents do not oppose the making of orders under O 15A r 3 so long as certain safeguards are adopted. Those safeguards include an undertaking of confidentiality to the Court by any person who conducts any examination of the hard drive of the relevant computer and any material that might be produced in consequence. The order for access to the hard drive requires an undertaking to the Court by the expert prior to access being given. 7 In the circumstances, I consider that it is appropriate to make the orders sought by the applicant. I certify that the preceding seven (7) numbered paragraphs are a true copy of the Reasons for Judgment herein of the Honourable Justice Emmett.
Counsel for the Applicant: L McCallum
Solicitor for the Applicant: Baker & McKenzie
Solicitor for the Fourth and Fifth Respondents: Pike Pike & Fenwick
Date of Hearing: 19 September 2003
Date of Judgment: 19 September 2003
Grant
Marshall
Orders made preserving electronic and other documents, directing production to Court of documents relating to the email address and identity of the user, prohibiting deletion or tampering with relevant documents, permitting forensic access to the hard drive subject to an undertaking in the form of Annexure B, and annexing a specified forensic image process (Orders 1–6; Annexures A and B).