No duty to convert or supply proprietary software for cellphone extractions under Ohio’s Public Records Act

Commentary on State ex rel. Castellon v. Maloney, Slip Opinion No. 2025-Ohio-4687 (Supreme Court of Ohio, Oct. 14, 2025)

Introduction

In State ex rel. Castellon v. Maloney, the Supreme Court of Ohio addressed a modern and recurring problem at the intersection of public-records law and digital forensics. Relator, Estephen Castellon, sought—under Ohio’s Public Records Act (R.C. 149.43)—two categories of records from the Westlake Police Department: (1) the department’s chain-of-custody documentation for his seized iPhone and (2) the “data extraction (dump)” of that device in a readable format. After the department produced a 19.2GB digital forensics case file and a chain-of-custody spreadsheet entry, Castellon initiated a mandamus action, arguing that the chain-of-custody record was incomplete and that the iPhone data was not provided in a human-readable format.

The Court, in a per curiam opinion joined by Chief Justice Kennedy and Justices Fischer, DeWine, Deters, Hawkins, and Shanahan (with Justice Brunner concurring in part and concurring in the judgment only as to Part II(A)(1)), denied the writ and all requests for statutory damages, court costs, and attorney’s fees. The decision clarifies two key points for public offices navigating digital evidence requests:

• A sworn agency affidavit can suffice to prove that all responsive chain-of-custody records have been produced, and a relator must provide clear and convincing evidence to the contrary.
• Under R.C. 149.43, an agency need not convert machine-coded forensic extraction files into another format or supply proprietary software to make them readable; providing the records in the format the agency keeps them satisfies the Act, particularly where the requester did not specify a different format under R.C. 149.43(B)(6).

Summary of the Opinion

The Court denied Castellon’s mandamus petition in full. For the chain-of-custody records, the Court held that the Westlake Police Department established—through affidavit—that it had produced the complete responsive record (a spreadsheet row covering Westlake’s custody of the iPhone). Castellon’s contrary materials (blank forms, department report slides, and general articles on best practices) did not constitute clear and convincing evidence that more Westlake-specific chain-of-custody records exist.

For the iPhone data extraction, the Court determined that the department provided both the machine-coded extraction and a “human-readable” report that nevertheless requires specialized viewing software (Cellebrite’s UFED Reader). Relying on State ex rel. Recodat Co. v. Buchanan and State ex rel. Margolius v. Cleveland, the Court held that proprietary software is not itself a public record and that agencies are not required to convert records to a different medium to improve access. Because Castellon did not invoke his format-selection rights under R.C. 149.43(B)(6), and because the department supplied the records as maintained, there was no violation warranting mandamus.

The Court also denied statutory damages (R.C. 149.43(C)(2)) because no violation of R.C. 149.43(B) occurred, denied court costs (given Castellon’s indigency affidavit), and denied attorney’s fees (he proceeded pro se).

Analysis

Precedents and Authorities Cited

• R.C. 149.43 (Ohio Public Records Act): The Court applied the 2023 Am.Sub.H.B. No. 33 version (effective Oct. 3, 2023), noting the statute was amended effective April 9, 2025 (2024 Sub.H.B. No. 265), but that the earlier version governed here. Key provisions:
  • R.C. 149.43(B)(1): Duty to make copies available within a reasonable time.
  • R.C. 149.43(B)(6): The requester may choose the duplication medium, subject to agency’s ability to reasonably duplicate as part of normal operations; the agency then must provide the record in accordance with the choice.
  • R.C. 149.43(C)(1)(b) and (C)(2): Mandamus as an enforcement tool and prerequisites for statutory damages.
• State ex rel. Wells v. Lakota Local Schools Bd. of Edn., 2024-Ohio-3316: Confirms mandamus as an appropriate remedy to enforce the Public Records Act.
• State ex rel. Griffin v. Sehlmeyer, 2021-Ohio-1419: Sets the relator’s burden—clear and convincing evidence of a clear legal right and a corresponding duty to provide the records.
• State ex rel. Culgan v. Jefferson Cty. Prosecutor, 2024-Ohio-4715: Two pillars used here:
  • A public office has no duty to furnish records not in its possession.
  • When an agency attests it lacks additional responsive records, the relator must prove by clear and convincing evidence that those records exist and are maintained by the office.
• State ex rel. Frank v. Clermont Cty. Prosecutor, 2021-Ohio-623: An agency may establish, by affidavit, that it has provided all existing responsive records.
• State ex rel. Recodat Co. v. Buchanan, 46 Ohio St.3d 163 (1989), limited by State ex rel. Margolius v. Cleveland, 62 Ohio St.3d 456 (1992):
  • Core rule reaffirmed: Proprietary software needed to access public information is not itself a “public record” and need not be provided.
  • Margolius also reinforces that public offices are not required to store records in a particular medium to enhance public access.
• State ex rel. Straughter v. Dept. of Rehab. & Corr., 2023-Ohio-1543: No court costs where relator files an indigency affidavit.
• State ex rel. Huth v. Animal Welfare League of Trumbull Cty., Inc., 2022-Ohio-3583: Pro se relators are ineligible for attorney’s fees—they incur no attorney’s fees.

Legal Reasoning

1) Chain-of-custody documentation

The parties agreed that the chain-of-custody production consisted of a spreadsheet with a single populated row for the Westlake Police Department (the first row being headers). Westlake supported this with Captain Vogel’s affidavit explaining that the single responsive row corresponded to Westlake’s custody of Castellon’s iPhone, and that other rows were unrelated to the case.

The Court emphasized that:

• An agency may establish—by affidavit—that it has produced all existing responsive records (Frank).
• When an agency says it does not have more records, the relator bears the burden of proving by clear and convincing evidence that more responsive records actually exist and are maintained by the office (Culgan).

Castellon’s evidence (department standards slides, blank generic chain-of-custody forms, articles on best practices, and materials describing the complexity of data extraction) did not show the existence of additional Westlake-maintained chain-of-custody entries. The Court reiterates that a relator’s subjective belief that more records exist does not satisfy the “clear and convincing” standard.

2) Digital forensics “data extraction” of the iPhone

The record contained two important factual points: (a) the extracted data is acquired as machine-coded (not human-readable) and (b) the department processed that data into a human-readable “report” using Cellebrite software. The department attested that it produced both the raw extraction and the processed report, and that the report could be opened with Cellebrite’s UFED Reader. Castellon did not rebut these points with evidence.

The Court framed the legal question under R.C. 149.43(B)(6) and the Recodat/Margolius line of cases: Is an agency obligated to convert digital forensic files into a format the requester can read without specialized software, or to supply that software?

• The Court held that proprietary software needed to read digital forensic outputs is not a public record and need not be provided (Recodat; Margolius).
• Agencies are not compelled to store or reformat records in a different medium to facilitate greater access (Margolius).
• Where a requester did not specify a particular format under R.C. 149.43(B)(6), providing the record in the format in which the agency keeps it satisfies the Act.

The Court also noted that Westlake reasonably accommodated the large file size (19.2GB) by uploading to a file-share link provided by Castellon after offering alternatives (flash drive or external hard drive).

3) Remedies: statutory damages, costs, and fees

Because the Court found no violation of R.C. 149.43(B), it denied statutory damages under R.C. 149.43(C)(2). It also denied court costs (indigency affidavit on file) and attorney’s fees (relator proceeded pro se).

Impact and Practical Implications

For public offices and law enforcement

• Affidavits matter: Well-crafted affidavits from custodians or forensic examiners can carry the day on completeness and format issues. Document your process for acquisition, extraction, and reporting and be prepared to attest to what exists and was provided.
• No obligation to reformat: Agencies are not required to convert machine-coded forensic extractions to a different format or to provide proprietary viewers/readers. Providing records in the medium maintained is sufficient, absent a valid R.C. 149.43(B)(6) format request that the office can reasonably accommodate.
• Retention schedules: The case implicitly reinforces that the absence of older emails due to compliance with a records-retention schedule is not itself a violation; however, anticipate that requesters may narrow disputes to extant core records (as here).
• Large-file logistics: Offering multiple delivery methods (secure file-share, external media) is a sound best practice and helps demonstrate reasonableness.

For requesters (defense counsel, journalists, pro se litigants)

• Be specific on format: If you need a readily readable output, expressly invoke R.C. 149.43(B)(6) and request a specific, reasonably duplicable format (e.g., “Cellebrite report exported to PDF/HTML/CSV” or “printed report”). Absent such specificity, the agency may satisfy its obligations by producing the data as it is maintained—even if it requires specialized software to view.
• Ask for the right slice of the chain-of-custody: If you seek a comprehensive cradle-to-grave chain-of-custody across multiple agencies, tailor the request to each agency’s role and timeframe, or make clear you want each agency’s records, not solely one agency’s row in a consolidated log.
• Prove existence, not preferences: To challenge completeness, provide concrete, agency-specific proof that additional records exist and are maintained—policies or generic forms are rarely enough. Consider deposition-like affidavits, metadata, or references to case numbers demonstrating the presence of additional rows or entries.
• Plan for proprietary viewers: Even if proprietary software is not a public record, you may be able to obtain viewer applications independently. But agencies are not obliged to supply them.

For courts and future litigation

• The opinion applies established doctrines to a modern digital-forensics context, signaling that long-standing rules about software and media under Recodat/Margolius remain robust for smartphone extraction datasets.
• The decision encourages precise use of R.C. 149.43(B)(6) and reinforces the “clear and convincing” burden when a relator disputes completeness.
• The approach is likely to reduce conversion disputes in large-scale digital evidence cases, while putting the onus on requesters to make specific and reasonably practicable format selections.

Complex Concepts Simplified

• Mandamus (in public-records context): A court order compelling a public office to perform a legal duty—here, to provide public records when the requester shows (by clear and convincing evidence) a clear right to the records and a corresponding duty to provide them.
• Clear and convincing evidence: A high evidentiary standard requiring a firm belief or conviction about the truth of the facts asserted—more than a mere preponderance but less than beyond a reasonable doubt.
• Chain of custody: Documentation tracing who handled evidence, when, and under what conditions, to ensure integrity. Each agency’s chain typically covers only its period of custody and transfers.
• Machine-coded vs. human-readable: Machine-coded data (binary) requires specialized tools to interpret; a human-readable report is organized for human comprehension but may still need a viewer to render it (e.g., a Cellebrite report readable in UFED Reader).
• Proprietary software: Privately owned software (like Cellebrite’s UFED suite) that is not itself a “public record.” Agencies need not provide such software to enable access to records.
• R.C. 149.43(B)(6) format selection: A requester may choose the duplication medium (paper, same medium as kept, or another medium the agency can reasonably use). Requesters should explicitly invoke this provision to get user-friendly formats when feasible.
• Statutory damages (R.C. 149.43(C)(2)): Available only if the requester made a proper written request, to the correct office, fairly describing the records, and the office failed to comply with R.C. 149.43(B). No damages if there’s no violation.

Key Takeaways

• An agency’s sworn affidavit can prove it has produced all existing responsive chain-of-custody records; conjecture or generic policies do not suffice to show more exist.
• Agencies need not supply proprietary software or convert digital forensic extractions into different formats to make them more accessible. Producing records as maintained satisfies the Public Records Act, especially when the requester did not specify a different medium under R.C. 149.43(B)(6).
• Requesters who want “human-readable” outputs without specialized software should expressly request specific, reasonably duplicable formats (e.g., PDF/HTML exports) under R.C. 149.43(B)(6).
• No statutory damages, costs, or attorney’s fees are available absent a proven violation; pro se relators cannot recover attorney’s fees and indigent relators do not recover court costs.

Conclusion

State ex rel. Castellon v. Maloney clarifies Ohio’s public-records obligations in the age of digital forensics. It reaffirms that (1) relators must carry a clear-and-convincing burden to show the existence of additional responsive records and (2) public offices are not required to convert or reformat machine-coded forensic extractions or supply proprietary software to render them readable. By grounding its analysis in Culgan, Frank, Recodat, and Margolius, the Court extends longstanding principles to the specific context of smartphone data, offering practical guidance to agencies and requesters alike. The opinion’s core message is pragmatic: precise requests—and precise proof—matter. Where a requester articulates a reasonable, specific format under R.C. 149.43(B)(6), agencies must accommodate if feasible; where the requester does not, supplying the records as kept will generally suffice.