Investigation Techniques: Evidence Collection and Preservation

Proper evidence collection and preservation can make or break an investigation.

Next to investigation interviews, physical and electronic evidence are the most critical pieces in an investigation. Far too often we hear stories about employees destroying evidence when they catch wind of an investigation. When evidence is misplaced or destroyed, it becomes harder to put the pieces of the investigation together.As investigators, you need to take action to preserve evidence as soon as the decision to investigate has been made. It's also important to have easy access to evidence throughout an investigation. Manually keeping track of evidence can be challenging. 

Do you know the difference between evidence types?

Investigators find and use many types of evidence in their investigations. Download this free PDF to learn definitions and examples of 15 common types you might encounter.Get My Cheat Sheet

 Evidence collection and preservation is a huge topic. There are many types of evidence and just as many techniques investigators can use to discover it.This post is focused on the basics:

1. What action to take when an investigation starts.
2. Preserving and keeping track of evidence once it has been collected.

When an Investigation Starts

Lock down access to any emails or files the employee may want to hide or destroy. When an employee is aware of an investigation, they might try to delete evidence from their computer or sabotage any other physical evidence against them.It's probably best to have the IT department involved and create an action plan that's executed each time an investigation is launched. This way, everyone knows what their role is and the plan can be executed seamlessly to ensure evidence is kept intact.Sometimes you have to look at the bigger picture in order to collect all of the evidence you are going to need. It's likely that there's information within your organization that plays a role in an investigation but it isn't directly related to the incident under investigation.In the book "The Essential Guide to Workplace Investigations," Lisa Guerin, J.D, writes:

"In every investigation, ask yourself what types of documents could help you figure out what happened. Think about the records your company keeps - in personnel files, attendance reports, inventories, computer records and so on."

These files don't prove innocence or guilt, but rather provide insight to help connect the dots. Make sure to consult these documents, as well as company policies, and include them in the evidence section of the case file should they support the investigation. RELATED: How to Authenticate Online Evidence (and Why It's Crucial) 

Evidence Collection and Preservation

Case management software simplifies evidence management by taking the hassle out of it. Evidence needs to stay organized. Case management software makes it possible to keep track of both physical and electronic evidence in one place - the case file. When evidence is entered into the case file, electronic documents - emails, PDF's, audio recording, surveillance video and other document types; can be attached directly to the case.Physical evidence is monitored through a barcode system. A barcode is generated to print out and attach to the piece of evidence. This activity is automatically documented in i-Sight, where investigators can attach notes about where the item is stored and any additional details.Rather than having to prepare and maintain your own tracking sheet to manage evidence, i-Sight automatically numbers and categorizes each attachment. Investigators can add additional notes about the evidence, such as where it came from, who found it, etc. Each exhibit contains detailed information about who added the exhibit and when it was added. Every file can easily be downloaded or shared with others as needed.Centralizing evidence helps prevent it from being lost or sabotaged, as well as making it easily accessible to investigators. RELATED: When and How to Search for Online Evidence by File Type