Evidence Collection and Storage in Workplace Investigations

4/4/2026

Evidence gathered in a workplace investigation must be preserved in the condition it was received, logged, stored securely, and tracked through a chain of custody that records everyone who handled it. Chain of custody is the documentation of an item's collection, custody, control, transfer, analysis and final disposition. Without it, an employer may be unable to show that a document, device or recording relied on in a decision is the same one that was collected — and unaltered.

Types of Evidence in a Workplace Investigation

Documentary evidence — policies, personnel files, timesheets, expense reports, performance reviews, handwritten notes, letters.
Electronic evidence — emails, chat and text messages, system access logs, badge records, files on shared drives, social media posts, call records.
Physical evidence — equipment, merchandise, damaged property, notes left in a workspace, company devices.
Recorded evidence — video footage, audio recordings, photographs.

Witness statements and interview notes are part of the investigation file too, but they are created by the investigation rather than collected from the workplace. Capturing the complainant's account is covered separately in documenting the statement of complaint; this post deals with material that already exists and has to be secured.

Preserve First, Then Collect

The first risk is loss. Video systems overwrite footage on a cycle, email retention settings purge messages, devices are reissued, and people delete things. As soon as a complaint is received:

Identify what evidence is likely to exist and where it lives.
Ask IT to suspend automatic deletion for relevant accounts and systems, and to preserve footage before it is overwritten.
Where litigation or an agency charge is reasonably anticipated, issue a written legal hold to the people and departments who hold relevant records, with counsel's involvement.
Secure physical items and company devices before they are reassigned, wiped or returned.

Collecting Evidence Properly

Keep the original state. Collect items as they are. Do not annotate, highlight, staple or reorganize originals; work from copies.
Electronic evidence through IT. Have IT or a qualified forensic resource export or image electronic data using a method that preserves metadata. Forwarding an email or taking a screenshot changes or strips information that may matter later. Where a screenshot is the only option, record who captured it, when and from which device.
Company versus personal property. Company-owned systems and devices can generally be searched under a clearly communicated policy. Personal devices and accounts are different — get legal advice before asking for or accessing them, and never access an employee's personal account without authorization.
Record the context. Note where each item was found, in what condition, from whom it was obtained, and why it was collected.

What Chain-of-Custody Documentation Must Show

For each item, the record should capture:

The conditions under which it was collected.
Where and from whom it was obtained.
The date and time it was collected, and by whom.
The purpose for which it was collected.
Everyone who has handled it, with dates.
Security conditions while it was handled and stored.
Where it is stored and who currently has possession.
How, when and to whom it was transferred each time it changed hands.
Any analysis or copying performed, and by whom.
When and to whom it was returned, or how it was disposed of.
The signature of each person who handled it.

Logging and Labeling

Give every item an exhibit identifier — Exhibit A, B, C, or a case-number sequence — and use that identifier everywhere the item is referenced: interview notes, the evidence log, and the final report. The case file should list each item, its identifier, a short description, where it is stored, and its chain-of-custody record.

For most HR investigations, a simple spreadsheet with those headings is enough. Investigative case management software typically includes an evidence log, and many systems generate an evidence number and a barcode label that can be attached to the item or its storage box. Whatever the tool, one person should own the log for each case.

Storing Evidence Securely

Keep physical evidence in a locked location with restricted access, sealed in labeled containers where practical.
Keep electronic evidence in a restricted folder or system with access logging, separate from general HR shared drives.
Limit access to the investigator and those with a genuine need, such as counsel.
Keep investigation files separate from the employee's personnel file. The personnel file should contain any resulting disciplinary action, not the investigation materials.
Protect any medical or other confidential information found in the evidence according to the rules that apply to it.

Retention and Disposition

No single federal rule sets a retention period for workplace investigation files. Several obligations shape it:

Once a discrimination charge or lawsuit has been filed, relevant personnel records must be kept until the matter is finally resolved, and a legal hold overrides normal deletion schedules.
Records that also qualify as payroll, timekeeping or leave records carry their own retention periods — see FLSA record retention rules.
State laws and the time limits for filing claims usually push employers to keep investigation files for several years after the investigation closes.

Set a written retention period for investigation files with counsel, apply it consistently, and document when and how evidence is returned or destroyed. Returning physical items to their owner, and noting the return in the chain-of-custody record, closes the file on that item.

Common Evidence-Handling Mistakes

Waiting until interviews are done to secure footage or messages, by which time they are gone.
Forwarding emails to the investigator instead of preserving the originals.
Leaving evidence in a manager's desk or an open shared folder.
Gaps in the log where an item changed hands without a record.
Filing investigation material in the personnel file.

Frequently Asked Questions

Does an HR investigation really need a chain of custody?

Yes, whenever the evidence could matter to a decision that may be challenged. The standard is less formal than in criminal cases, but the employer still needs to show the evidence is what it claims to be.

Can we accept screenshots from the complainant?

Yes, and record who provided them and when. Where the original messages are on company systems, preserve those as well.

How long should investigation files be kept?

Set a written period with counsel based on federal, state and claim-filing time limits, and suspend deletion whenever a charge or lawsuit is pending or anticipated.

When should law enforcement be involved?

When the evidence suggests possible criminal conduct. See when to leverage law enforcement agencies.