Useful Tips in Investigations

Evidence sources in investigations

Quickly identifying and securing all sources of evidence is vital to the successful outcome of any investigation, whether it be a financial investigation or one focused on alleged improper employee conduct. An increasing majority of evidence used in investigations and disputes comes from electronic sources.  The collection and analysis of such electronic evidence in a forensically sound manner is vital.

Overall key issues:

  • Prevent access to evidence until properly dealt with – this will help to safeguard its integrity and evidentiary value
  • Consider isolating physical and remote access to electronic evidence by restricting users’ access via all modes of electronic devices
  • Secure physical sources of evidence
  • Collect, in a forensically sound manner, all relevant electronic evidence – note this requires more specialized techniques than engaging an IT department to copy files
  • Maintain proper chain of custody procedures
  • Consider privacy and confidentiality issues (both contractual and legislative).
Sources of physical evidence Sources of electronic evidence
  • General, personal or group filing cabinets
  • Employees’ desks and other storage devises
  • HR records (policies, employee contracts,  assessments, payroll documents etc)
  • Legal / risk department records (contracts, correspondence, risk analyses)
  • Employee expense claims and related bills including credit card and telephone invoices
  • Computers of relevant staff
  • Handheld devices including mobile phones, iPhones, Blackberries, PDAs
  • Portable/removable hard drives, ‘flash’/‘stick’/‘thumb’ drives, SD cards
  • Email servers and network drives
  • Internet / printer / fax / telephone logs
  • Off-site backup storage discs or tapes
  • Building access swipe card logs
  • CCTV footage.