Navigating the Evidence Collection Process
Once a complaint is filed, the clock starts. Employers need a systematic approach to collecting and preserving digital evidence during an active investigation. In this blog, we outline four practical steps that can help employers gather and preserve evidence in a way that supports a fair, defensible investigation.
The Four-Step Process for Evidence Collection
These four steps align with the Association of Workplace Investigators (AWI) Guiding Principles on documentation and evidence collection. AWI emphasizes a fair and impartial process and documentation of the steps taken during an investigation.
Step One: Issue a Preservation Notice Immediately
Issue a preservation notice, sometimes called an investigation hold or litigation hold, to IT, management, and anyone who may control relevant data. Direct them to suspend any automatic deletion of potentially relevant information. Be specific: identify the relevant custodians, time period, and platforms. A blanket “save everything” instruction is usually less effective than a targeted notice.
FROM THE FIELD: In one investigation, a complainant alleged inappropriate messages over Microsoft Teams during a three-week period. By the time HR contacted IT, the organization’s retention policy had already purged messages older than 30 days. The relevant messages fell just outside that window. A preservation notice issued one week earlier would have preserved them.
Step Two: Map the Evidence Landscape
Before collecting anything, spend 30 minutes mapping every digital system where relevant evidence might exist. This “evidence landscape” typically includes more sources than employers initially expect. Think beyond email and messaging:
- Badge and access logs — physical presence at a location on a specific date
- Calendar entries and meeting invitations — who was invited to or attended specific meetings
- Document audit trails (Google Drive, SharePoint, Dropbox) — who accessed, edited, or downloaded files and when
- Login records — when and from where an employee accessed company systems
- Security camera footage — relevant areas and timeframes
- Time and attendance records — whether a complainant and respondent were on the same shift
- Company vehicle GPS or dash camera footage — if the employer operates a fleet
PRACTICAL TIP: Start every evidence map by asking: “If I were trying to prove or disprove each allegation, what would that proof look like?” Then work backward to identify where that proof might exist.
Step Three: Collect with Chain of Custody in Mind
Workplace investigations are not criminal proceedings, and formal rules of evidence do not apply in the same way. However, investigation findings may be scrutinized in later administrative proceedings or litigation. For that reason, evidence collection should be carefully documented and consistent. The AWI Guiding Principles emphasize documenting investigative steps and the process used to gather information considered.
Basic evidence hygiene includes:
- Documenting who collected the evidence, when, and from what system
- Preserving evidence in its original format (screenshots supplement but do not replace originals)
- Avoiding metadata alteration—do not open, edit, or resave files you intend to rely on
- Maintaining a clear record of where evidence is stored and who has accessed it
CALIFORNIA NOTE: Under FEHA, courts evaluate whether an employer’s investigation was “fair, timely, and thorough” (Gov. Code § 12940(k); Cotran v. Rollins Hudig Hall Int’l, Inc. (1998) 17 Cal.4th 93). A well-documented collection process demonstrates thoroughness and supports the investigation’s credibility.
Step Four: Know When to Bring in a Forensic Expert
Most investigations do not require digital forensics. Consider engaging a specialist when:
- You suspect evidence was deleted after the employee learned of the investigation
- The matter involves potential theft of trade secrets or confidential data
- You need to recover data that standard methods cannot retrieve
- The evidence is on an encrypted or protected system
- The stakes justify the cost—termination risk, litigation exposure, or significant financial impact
Exhaust other evidence sources first. Information that might be recovered through forensics is sometimes available elsewhere—a recipient’s inbox, a screenshot captured by a witness, or a system audit log entry.
The California Legal Landscape
California’s regulatory environment creates investigation-specific considerations that may not apply to other states.
All-Party Consent for Recordings
California is an all-party consent state for recording confidential communications (Penal Code § 632(a)). This means:
- Audio recordings from security systems in areas where employees may have a reasonable expectation of privacy can create liability risk
- Incidental audio from cameras near break rooms, hallways, or outdoor areas could be problematic if it captures a confidential conversation
- Best practice: post conspicuous notices where recording occurs and ensure recordings do not extend to areas where confidentiality is reasonably expected
CALIFORNIA NOTE: Video recording without audio is generally lower risk in common workplace areas. Combining video with audio where confidential conversations may occur increases risk under Penal Code § 632(a). If your security system captures audio, consult employment counsel.
Employee Privacy on Company Systems
The California Constitution recognizes a right to privacy (Art. I, § 1), and courts apply it in the employment context. A clear, well-communicated monitoring policy can reduce privacy risk, but a policy buried in a lengthy handbook may not carry the same weight as a standalone acknowledgment specifically addressing monitoring.
Protected Activity
When reviewing digital evidence, be alert to legally protected activity. California law prohibits retaliation for reporting suspected violations of law (Labor Code § 1102.5), for certain wage-related disclosures (Labor Code § 232), and engaging in lawful conduct during nonworking hours away from the employer’s premises (Labor Code § 96(k)). At the federal level, the National Labor Relations Act protects concerted activity, including certain discussions about working conditions on social media. If evidence suggests protected activity, document it carefully and avoid actions that could appear retaliatory.
Social Media: Labor Code Section 980
Labor Code § 980 generally prohibits employers from requiring or requesting personal social media information. A narrow exception permits an employer to request an employee divulge personal social media that is reasonably believed to be relevant to an investigation of alleged misconduct, and that social media must be used solely for the investigation or a related proceeding.
Important: Even with this exception, employers should avoid demanding login credentials and should proceed cautiously when personal privacy is implicated. If an employee declines to share content voluntarily, document the request and denial, note that the evidence was unavailable, and proceed with what you have.
After the Investigation: Preserving the Record
Evidence preservation does not end when the report is issued. FEHA matters can lead to CRD charges or civil litigation months or years later.
Retention Requirements
California law requires employers to maintain and preserve personnel records and files for a minimum of four years from creation or receipt, and to retain personnel files of terminated employees for at least four years from the date of the employment action (Gov. Code § 12946(a)).
Because FEHA statutes of limitation and litigation can extend beyond four years, we recommend retaining investigation files and all supporting digital evidence for a minimum of five years.
Retained evidence should include original digital files (not just screenshots or summaries), the investigation report, related correspondence, and documentation of the collection process.
PRACTICAL TIP: Create a standardized post-investigation archival checklist. After each investigation, archive all digital evidence, the final report, interview notes, preservation notices, and correspondence in a secure, access-controlled location separate from the employee’s general personnel file.
Five Digital Evidence Mistakes We See Repeatedly
Mistake #1: Never Revisiting Default Retention Settings
Defaults are designed for general business use, not investigation readiness. Review your settings at least annually.
Mistake #2: Waiting Too Long to Preserve Evidence
Every day between a complaint and a preservation notice is a day during which evidence may be lost. Designate a specific individual (and backup) as the point of contact for preservation requests, and ensure HR knows how to reach them.
Mistake #3: Treating All Digital Evidence the Same
An email and a Slack message may have very different retention periods, access controls, and privacy implications. Each platform requires its own collection approach.
Mistake #4: Failing to Document the Collection Process
If you cannot show how, when, and by whom evidence was collected, its value in litigation diminishes. The AWI Guiding Principles emphasize documenting investigative steps and the process used to collect information considered.
Mistake #5: Collecting Only Evidence That Supports the Complainant
A defensible investigation collects and evaluates evidence that tests all parties’ accounts. Badge data placing a respondent at a different location, calendar entries contradicting a timeline, or login records corroborating a respondent’s version must be collected and evaluated. The AWI Guiding Principles emphasize a fair and impartial process for the complainant and respondent. Investigators who collect only one side’s evidence produce reports that will not withstand scrutiny.
Bringing It Together
Digital evidence is central to nearly every workplace investigation. California employers that handle investigations most effectively treat evidence as an organizational discipline: they audit retention settings, maintain clear monitoring policies, train HR on evidence preservation, and establish a rapid-response process with IT before a complaint arrives. The goal is not to turn every HR professional into a forensics expert; it is to ensure that when an investigation is necessary, the evidence has not already disappeared.
The Importance of Preparation
Handling digital evidence effectively is a discipline that should start long before a workplace complaint is filed. By proactively auditing retention settings, establishing clear monitoring policies, and training your HR team, you’ll ensure that when an investigation is necessary, the evidence you need won’t have already disappeared.
Why California Labor Solutions
At California Labor Solutions (CLS), we specialize in delivering unbiased workplace investigations for employers throughout California, with a strong commitment to compliance and professionalism.
We ensure your investigation is not only thorough but also adheres to the necessary legal and regulatory guidelines to minimize risks and potential liabilities.
Need Help with a Workplace Investigation or Want to Evaluate Your Organization’s Investigation Readiness? Contact California Labor Solutions at https://www.californialaborsolutions.com/contact/
Disclaimer
Please note that regulatory updates and advisories from governing agencies may contain ambiguities or be subject to frequent revisions. This material does not constitute legal advice. The information and opinions shared are based on our reasonable interpretation of the agency’s guidance at the time of publication and may change as new developments arise. Outcomes may vary depending on your specific circumstances.