Leveraging Today’s Technology for Evidence-Gathering, Part 2: Evidence in an Employee’s Control

In our increasingly digital world, much of the evidence in workplace investigations consists of online communications, electronic records, and internet activity. Part 1 of this two-part series focused on identifying and collecting such digital evidence under the employer's control. Part 2 provides an overview of how to identify and collect electronic evidence that an employee may possess.

Because technology evolves so quickly, even moderately tech-savvy witnesses may possess critical evidence without even realizing it, so asking the right questions and providing the right guidance is crucial.

Category #1: Text Messages and Other Instant Messages

Collecting and Capturing Messages

When collecting digital messages—whether exchanged via the device's default text message app or other apps like Facebook Messenger, Instagram, Snapchat, WhatsApp, or Discord—it is important to capture dates, times, and any other details in the texts, such as emojis, memes, or gifs. A simple emoji can completely alter the meaning of a message.¹ Practitioners should consider the following best practices when collecting digital messages:

• Start with screenshots, if feasible. When there are not many messages at issue, this can be a cost effective and efficient approach—but make sure the screen captures show dates, times, and continuity in the conversation.
• When requesting screenshots of a text conversation from one person, consider asking the other party to that conversation for screenshots as well, to check for any discrepancies. Some applications allow users to alter conversations by deleting specific messages.²
• If screenshots do not adequately display the full conversation, consider a screen recording. Using this newer feature on both iPhones and Android phones, witnesses can record their screen as they scroll through a text message conversation, more clearly showing continuity from beginning to end. However, this is a less functional option if the messages need to be used as an exhibit in interviews or attached to a report.
• For longer, more unwieldy text conversations, software such as iMazing or Legal Text Collector can seamlessly export the entirety of the chat, including images. While these apps involve a small cost, they offer major advantages where the texts are voluminous, the embedded images exchanged are relevant, and/or the dates and timestamps of the text messages are informative.
• Keep in mind that platforms that default to "disappearing messages," such as Snapchat, can still allow users to intentionally save certain messages.

Recovering Deleted Messages

Just because messages no longer appear on a device does not mean they are impossible to recover. Here are some tips for dealing with altered or deleted messages:

• First, always check the "Trash" and "Deleted" folders in the messaging application. As noted in Part 1, many messaging applications such as iMessage retain deleted messages for a certain amount of time.³
• Check to see if the deleted messages remain preserved on other devices in the employee's control. This usually happens when devices are synchronized. For example, if an employee deleted a text conversation from the iMessage application on their phone, that same conversation may still be accessible via the iMessage application on their computer or iPad, depending on their synchronization settings.
• Remember that just because someone obtained a new phone does not necessarily mean their messages are no longer accessible. This evidence may be available on backups like iCloud/Google Drive or stored on other devices.
• Check whether texts were saved via SMS transfer tools. Many people use various software to transfer texts from one phone to another, which creates a backup that can be saved on Google Drive or a computer hard drive.
• Consider utilizing a forensic expert if messages have been completely deleted across devices and platforms. Again, because this can present added costs, it is important to evaluate whether the messages are critical to the case. Other, more readily available evidence could offer sufficient proof of what happened.

Category #2: Photographs, Videos, and Audio Recordings

Photographs, videos, and audio recordings on employee personal devices also can offer insightful evidence. Practitioners should consider the following when identifying and reviewing this type of content:

• Review multiple sources. Photos and videos may be stored in various apps beyond the default "Photos" or "Camera" application. Be sure to check photo albums (including collaborative albums or "Shared Albums") in both default and secondary photo apps, "Voice Memos" or other recording apps, media exchanged within chats or messaging apps, photos or videos posted to social media (like Facebook walls or Instagram profiles), media editing apps (like VSCO, Canva, and Facetune), and of course all "Deleted" folders.
• Capture timestamps and locations. Nowadays, most smartphones automatically include geotags on photos, videos, and audio, showing exactly when and where the user captured the content. Geotagged media could, for example, place the parties at the same bar on the date and time frame when alleged harassment occurred.
• Utilize embedded search tools to streamline searches. Embedded geotags and facial recognition can help streamline a search for a particular photo or video. For example, in both Apple's and Google's "Photos" apps, typing the name of a specific location into the search bar will retrieve all content captured in that location.⁴ Most smartphones have a similar facial recognition tool that allows users to filter for content capturing a particular person or pet. On many phones, this is accessible by tapping the "People & Pets" tab or category in the "Photos" app.
• Ensure that the content is authentic and has not been altered. Be on the lookout for photos that have been edited or photoshopped, along with inauthentic photos that are "deepfakes" or AI-generated images. Deepfakes are videos, images, or audio that have been digitally manipulated (often using "face swapping" tools) to misrepresent someone doing or saying something that did not actually occur.⁵ While practitioners can learn how to identify certain visual and audio alterations, sophisticated software also exists to help detect deepfakes and other edits made to photos and videos.
• Consider whether a video or audio recording was taken without consent. As discussed in Part 1, if the recording was nonconsensual, this can result in various evidentiary challenges and potentially expose the person who made the recording to liability under state privacy laws.⁶
• If the content is sensitive, evaluate whether other evidence can support the same finding or conclusion. For instance, if practitioners come across a nude image or video of an employee, they should first see if the employee admits to the existence of this content. If so, the practitioner may be able to exclude the underlying images from the investigation, which could afford the employee a sense of respect and privacy, as well as avoid the appearance of bias or unfairness.

Category #3: Location Tracking Data

Nowadays, most devices store several types of location tracking data through different apps and system services—often without the device owner even realizing it. Here are some common places one can find location tracking data on a smartphone:

• "Significant Locations" or "Google Timeline." Most smartphones track places that the phone frequently visits to provide personalized services like photo memories or predictive traffic routes.⁷ On most smartphones, the "Locations Services" section of the "Settings" app lists all mobile applications on the device that track or access location—which can help practitioners know which apps to check.
• "Find My" applications. Apple's "Find My" feature and Android's "Find My Device" app allow for real-time location tracking of devices.
• Geotags. As previously noted, most smartphones automatically embed location data into photos and videos taken on the device.
• Wi-Fi Connections. Many devices create a log of Wi-Fi networks that the device has connected to.⁸ Such information may indicate whether the device owner has ever been to a certain location (such as someone's home or another office location). However, access to more detailed information, such as timestamps, requires more sophisticated forensic tools.
• Wallet applications and Apple Pay. For wallet applications and contactless payments, some transactions include location tags, depending on whether the merchant uses GPS tagging.
• Social media applications. Most social media platforms allow users the option to add or tag their location to content. Some apps, like Snapchat, have a map feature that continuously shares the user's real-time location to their Snapchat friends.
• Maps, traffic reporting, GPS navigation applications, and tracking devices. Various map and navigation apps, such as Waze, Apple Maps, Google Maps, and MapQuest, may retain route history or information on recent destinations, depending on the individual's settings. Also be sure to ask if the employee owns any location tracking devices, like an Air Tag or Tile, which may reveal other relevant location data.

Category #4: Electronic Receipts and Purchase History

The rise of online shopping, banking, and e-payments can leave behind a detailed digital footprint, creating a permanent record of purchase history and financial activity. While this type of information is directly relevant to claims of unreimbursed expenses, it also may prove useful for other cases, such as those involving allegations of sexual harassment or sexual favoritism.

Electronic receipts are often texted or emailed to the purchaser and can reveal when certain events occurred. For instance, a restaurant receipt could confirm that a "date" in fact occurred between two individuals, or a receipt from a bar could support that two employees were indeed intoxicated at a certain point in time. Similarly, Uber/Lyft receipts could reveal whether one employee went to another's home or another's hotel after a work-related event.

Even the lack of a receipt or purchase record could offer valuable insight. Consider a sexual favoritism case where two employees deny sharing an Uber together after a work event, claiming they took separate Uber rides home. If only one can provide an email receipt from Uber (or relevant ride detail/purchase history from their Uber app), that casts doubt on both their story and their credibility.

Other Types of Data to Consider

Other potential sources of evidence include the following:

• Health applications and fitness trackers may show employee whereabouts or physical activity. For example, if an employee's fitness tracker data (e.g., applications like Strava and Nike Training Club, or fitness trackers like Garmin, Apple Watch, or Fitbit) shows they were at the gym or on a long run, rather than at a company off-site event where alleged misconduct occurred, this could establish that allegations against that employee are inaccurate.
• Call logs and voicemails could corroborate whether certain events occurred. For instance, an excessive number of unreciprocated calls from one employee to another could support a harassment claim. Contrastingly, a significant number of reciprocated, after-hours calls between a supervisor and subordinate could bolster sexual favoritism concerns.
• Electronic calendars can help pinpoint where and when certain events may have occurred, or who attended a meeting in which a harassing comment was made. Consider both work and personal calendars across platforms like Gmail, Outlook, and iCal on Mac devices. Remember that just because someone RSVP'd "yes" or "no" to a specific meeting does not necessarily mean they ended up attending that event.

Conclusion

Part 2 in a nutshell: Although harder to obtain, digital media in an employee's possession can contain a treasure trove of relevant data. Asking the right questions and guiding employees to check various digital content on their devices could make all the difference in obtaining critical evidence.

This concludes our two-part series on leveraging technology evidence for evidence-gathering. Thanks for reading!