Investigation Evidence: Collecting, Documenting and Storing It in a Workplace Investigation

Types of Investigation Evidence

This post deals with material that already exists and has to be secured. Capturing the complainant's own account is covered in documenting the statement of complaint, which remains the reference for intake.

Step 1: Preserve Before You Collect

The first risk is loss, and it starts the day the complaint arrives. Before the first interview:

1. List what evidence is likely to exist, where it lives, and who controls it. Build this into your investigation plan and complaint intake form.
2. Ask IT to suspend automatic deletion for the relevant mailboxes, chat channels, and drives, and to export video before the system overwrites it.
3. Secure physical items and company devices before they are reassigned, wiped, or returned.
4. Tell the people involved, in writing, not to delete or alter anything related to the matter.

When a litigation hold is required

A routine complaint does not always call for a formal hold. Once litigation or an agency charge is reasonably anticipated, the duty to preserve applies and ordinary deletion schedules must stop for relevant material. Federal Rule of Civil Procedure 37(e) describes what happens when electronically stored information "that should have been preserved in the anticipation or conduct of litigation is lost because a party failed to take reasonable steps to preserve it" and cannot be restored or replaced. On a finding of prejudice, the court may order measures to cure it. On a finding that the party acted with intent to deprive the other side of the information, the court may presume the lost information was unfavorable, instruct the jury that it may or must presume so, or dismiss the action or enter a default judgment.

A workable hold has five parts:

• A written notice from counsel or HR to each custodian, describing the matter in neutral terms
• The categories of records and the date range covered
• A clear instruction to suspend deletion, including personal habits such as clearing chat history
• A named contact for questions
• An acknowledgment from each custodian, with periodic reminders until the hold is released in writing

Decide with counsel when the trigger has been met. A demand letter, a threat to sue, an attorney's request for the personnel file, or an agency charge are common signals.

Step 2: Collect Without Changing Anything

• Keep the original state. Do not annotate, highlight, staple, or reorganize originals. Work from copies and mark them as copies.
• Record the context. For each item, note where it was found, its condition, who provided it, when, and why it was collected.
• Collect only what the scope requires. Pulling an employee's entire mailbox when the allegation concerns one week invites privacy complaints and buries the relevant material.
• Accept what participants offer, and log it. If a complainant hands you screenshots, take them, record who provided them and when, and then preserve the underlying messages from the company system if they exist there.

Electronic evidence

Have IT or a qualified forensic resource export or image electronic data using a method that preserves metadata such as sender, recipient, timestamps, and edit history. Forwarding an email creates a new message. A screenshot shows what the screen displayed but not when the message was sent or whether it was edited. Where a screenshot is the only option, record who captured it, when, and from which device and account.

Ask IT to document the system, the search terms or date range, who ran the export, and the date. That record becomes part of the chain of custody.

Company systems, personal devices, and personal accounts

Company-owned systems can generally be searched where a clearly communicated policy tells employees they have no expectation of privacy in them. Personal devices and personal accounts are different. The federal Stored Communications Act, 18 U.S.C. § 2701, penalizes intentionally accessing without authorization a facility through which an electronic communication service is provided and obtaining communications in electronic storage there. Logging in to an employee's personal email or social media account with a guessed, saved, or coerced password is the conduct to avoid. State privacy and social media password laws add further limits. Check the laws of each state involved and get legal advice before requesting or accessing personal devices or accounts.

Recordings

Whether a conversation may be recorded without everyone's consent depends on state law, and some states require all parties to consent. Confirm the recording law in each state where a participant is located. If an employee offers a recording, do not refuse to look at it, but check with counsel on how it was made before you rely on it. If you record interviews yourself, do it openly, with consent noted on the recording.

Step 3: Log Every Item and Keep a Chain of Custody

Chain of custody is the record of an item's collection, custody, control, transfer, analysis, and final disposition. An HR investigation is not a criminal case and the standard is less formal, but the underlying question is the same one a court asks. Under Federal Rule of Evidence 901(a), the party offering an item "must produce evidence sufficient to support a finding that the item is what the proponent claims it is." A clean log is the simplest way to do that.

For each item, the record should show:

• What it is, and a unique exhibit identifier
• Where, when, from whom, and by whom it was collected
• Its condition when collected and the reason it was collected
• Every person who has handled it, with dates and purpose
• Each transfer: how, when, from whom, and to whom
• Any copying or analysis performed, and by whom
• Where it is stored now and who can reach it
• When and to whom it was returned, or how it was destroyed

Use the exhibit identifier everywhere the item is mentioned: interview notes, the timeline, and the final report. One person should own the log for each case.

Evidence log template

The entries below are fictional and shown only as an example.

Chain-of-custody record (one per physical or original item)

A spreadsheet with these columns is enough for most HR investigations, and case management software typically includes an evidence log. The tool matters less than filling it in at the moment something changes hands.

Step 4: Store the File Securely and Keep It Confidential

A common mistake is keeping investigation files in the same cabinet or shared drive as personnel files, where any HR or administrative staff member can open them.

Physical material

• Use a separate, lockable cabinet or room, with access limited to the investigators and those with a real need, such as counsel.
• Seal and label original items; store working copies separately.

Electronic material

• Keep a restricted case folder or case management system, separate from general HR drives, with access logging turned on.
• Require strong passwords or single sign-on with multifactor authentication, and encrypt portable media.
• Make sure the case folder is covered by regular automatic backups, so a crash or failed update does not destroy notes.
• Limit administrator access. IT staff who can reset passwords or restore backups should be told in writing that the contents are confidential and that access is logged.

What goes where

• Personnel file. Put any resulting disciplinary document in the personnel file, not the investigation materials.
• Medical information. Under the ADA regulation at 29 C.F.R. § 1630.14(c)(1), medical information the employer obtains about an employee must be kept on separate forms, in separate medical files, and treated as a confidential medical record, with narrow exceptions for supervisors who need to know about restrictions or accommodations, first aid and safety personnel, and government compliance officials.
• HIPAA. HIPAA is often cited here by mistake. The HIPAA rules define protected health information to exclude employment records held by a covered entity in its role as employer, so an employer's investigation file is generally governed by the ADA rule, state law, and company policy instead.

Confidentiality with participants. Share evidence with witnesses only as far as needed to ask your questions. Asking participants not to discuss an open investigation is common, but broad instructions to nonsupervisory employees can raise issues under the National Labor Relations Act. Use narrow wording approved by counsel and confirm the current NLRB standard with labor counsel. Limiting who sees the evidence also limits who is in a position to retaliate; see our guide to workplace retaliation.

Privilege. Giving a finished file to a lawyer does not by itself make it privileged. Whether attorney-client privilege or work-product protection applies depends largely on whether the investigation was conducted at counsel's direction for the purpose of legal advice, and on the jurisdiction. Settle that at the start, and see Upjohn warnings in internal investigations for how it affects interviews.

Step 5: Organize the File for the Report

Evidence that cannot be found cannot be weighed. A simple index keeps the file usable:

1. Complaint and intake record
2. Investigation plan and scope
3. Preservation requests and any hold notice, with acknowledgments
4. Evidence log and chain-of-custody records
5. Exhibits, in identifier order
6. Interview notes and signed statements
7. Timeline matching each allegation to the exhibits and testimony that bear on it
8. Report, findings, and outcome communications
9. Post-investigation follow-up, including retaliation check-ins

The timeline is where evidence turns into findings. Building that fact pattern and timeline from the evidence is one of the Day Two topics in our Internal Investigations Certificate Program. Our posts on credibility assessment and the investigation report template and worked sample pick up from there. If the evidence points to possible criminal conduct, read when to leverage law enforcement agencies before you go further, because the handling rules get stricter.

How Long to Keep Investigation Evidence

No single federal rule sets a retention period for investigation files as such. Several rules set minimum periods.

Section 1602.14 defines final disposition as the date the period for the person to file suit in federal court expires or, where suit is filed, the date the litigation ends. It also says relevant records include those relating to the charging party and to "all other employees holding positions similar to that held or sought by the aggrieved person."

Those are minimums, and they are short. Records in the file that are also payroll, timekeeping, or leave records have their own periods; see FLSA record retention rules and the HR document retention schedule. State laws and claim-filing deadlines usually justify keeping investigation files for several years after closing. Some employers adopt a rule such as the length of employment plus a fixed number of years. That is a policy choice, not a legal requirement; set the organization's period with counsel. Whatever period you choose, write it down, apply it consistently, suspend it whenever a hold is in place, and record when and how each item was returned or destroyed.

Common Evidence-Handling Mistakes

• Waiting until interviews are finished to secure footage or messages
• Forwarding emails in place of preserving the originals
• Leaving evidence in a manager's desk or an open shared folder
• Gaps in the log where an item changed hands with no entry
• Filing investigation material, or medical information, in the personnel file
• Destroying a closed file on schedule while a charge or lawsuit is pending

Frequently Asked Questions

The Bottom Line

Good investigation evidence practice comes down to five habits: preserve first, collect without altering, log every item and every handoff, store the file apart from personnel records with restricted access, and follow a written retention rule that stops for any hold. Run through the Workplace Investigations Checklist at the start of each case so none of them is skipped.

These skills improve with practice on realistic cases. The agenda for the three-day Internal Investigations Certificate Program includes organizing evidence for the report and setting up security protocols for investigative documents, and the course page lists documentation and chain-of-custody forms among the materials.