Apple Inc. v. Liu, No. 5:26-cv-07078-EJD (N.D. Cal. Oct. 13, 2026), full opinion (PDF)
A federal district judge in California has ordered the defendants in a trade secret suit to produce forensic images on an expedited schedule. Apple brought the suit against two individuals it describes as former employees now working at OpenAI, along with OpenAI and io Products. It asked for the discovery while its motion for a preliminary injunction was pending. Apple described the images as ones the defendants rely on to oppose that motion. According to the defendants, Apple had not argued that anything was actually deleted. The court still treated the short life of logs, metadata, and usage records as a reason for early discovery.
What happened
One former employee, Chang Liu, was the focus of competing forensic examinations in the supplemental briefs on Apple's motion. Apple's expert reported that Liu had told Alyssa Peng to have Apple-issued devices restored. The defendants' own expert examined one of Liu's computers. The defendants also argued that Apple did not claim Liu or Peng had actually deleted or restored anything.
The court's analysis
The court applied the good cause standard for expedited discovery. Apple argued that its expert needed the forensic images to test the defense expert's analysis and to look for deletion. In the court's view, the images had become "such a prominent component of the pending preliminary injunction motion" that some of the requested discovery clearly related to that motion.
The court left the experts' dispute over deletion or spoliation for a later stage. Even so, it accepted Apple's argument that logs, metadata, and usage records are transient and easily lost. The conversation between Liu and Peng about restoring Apple-owned devices made the risk of loss more pressing, the court added. It reasoned that this risk can support a finding of good cause without proof of actual deletion.
Apple's broadest requests rested on a defined term, "Apple Originated Information," covering nearly any nonpublic information connected to Apple. The court agreed with the defendants that the definition reached information belonging to third parties. One request would have required the defendants to identify every account and device holding such information. The court described that undertaking as "an extremely burdensome, and perhaps untenable task". It deferred every request and deposition topic relying on the definition, which it considered too vague as written.
The individual defendants and OpenAI must promptly respond to requests for the forensic images they have already collected on the subject matter of Apple's claims. That set includes the images identified in declarations already before the court. Liu must also respond to a request for his messages with Peng on the LINE messaging app. The court separately resolved requests for interview materials, depositions, and research documents.
Why it matters
When forensic images become a prominent part of an injunction dispute, the party holding them should be prepared for a court to order early production. Counsel who rely on a forensic analysis in a declaration should ready the underlying images for production before filing.
A party seeking early forensic discovery can make its case without first proving spoliation. Its motion should pair the general point that logs and metadata are short-lived with specific evidence from the record, such as a conversation about restoring devices.
Expedited requests should name the specific sources an injunction motion already puts at issue, such as particular devices, images, or message threads. A loosely defined term that reaches third-party information risks deferral of every request built on that term, as happened to Apple.
The full opinion is available as a PDF.
