Handling Digital Evidence from a Client
A client, a small business owner, hires you to investigate an employee suspected of stealing trade secrets. The client provides you with a USB drive containing files copied from the employee's work computer, including emails, documents, and a folder labeled 'personal.' The client says the USB drive was created by the IT department during a routine backup and that they have the right to review all files on company equipment. You review the files and find evidence that the employee emailed a competitor with confidential information. You also find personal medical records in the 'personal' folder. You prepare a report for the client that includes the incriminating emails and references the medical records. The client wants to use the report in a lawsuit against the employee. The employee's attorney later argues that the evidence was obtained in violation of the employee's privacy rights and that the medical records should be excluded. The client asks you to testify in court about your findings.
1. What are the key issues regarding the admissibility of the digital evidence you reviewed? Discuss chain of custody, authentication, and privacy considerations.
Read the worked answer
The admissibility of digital evidence depends on authentication, chain of custody, and whether the evidence was obtained lawfully. Authentication requires showing that the evidence is what it purports to be. The investigator should be able to testify about how the USB drive was created, who handled it, and whether it was tampered with. A chain of custody log should document every person who handled the drive and when. The client's IT department created the drive, so the investigator should obtain a statement or testimony from the IT personnel about the backup process. The investigator should also create a forensic image of the drive to preserve the original and work from a copy. Privacy considerations: The employee may have a reasonable expectation of privacy in personal files stored on a work computer, depending on the employer's policies. If the employer had a clear policy stating that employees have no expectation of privacy on company equipment, the employer may be able to review all files. However, accessing medical records could violate laws such as the Americans with Disabilities Act (ADA) or the Health Insurance Portability and Accountability Act (HIPAA) if the employer is a covered entity. The investigator should have segregated the personal files and not reviewed them unless necessary. By including references to medical records in the report, the investigator may have violated the employee's privacy and could face civil liability. The evidence may still be admissible if obtained lawfully, but the medical records might be excluded or subject to a protective order.
2. What should you do before testifying in court about your findings? Discuss your ethical obligations and the potential consequences of testifying about the medical records.
Read the worked answer
Before testifying, the investigator should review all documentation, including the chain of custody, the client's policies regarding computer use, and any relevant laws. The investigator should ensure that their testimony is truthful and accurate. They should not testify about matters beyond their expertise or knowledge. Regarding the medical records, the investigator should be cautious. If the medical records are not relevant to the trade secret theft, the investigator should not discuss them. The investigator may be required to disclose that they reviewed the files, but they should not reveal the contents of the medical records unless ordered by the court. The investigator should consult with legal counsel (their own or the client's) about the potential privacy violations. Ethically, the investigator should avoid causing harm and should protect confidential information. If the investigator believes that the evidence was obtained unlawfully, they should discuss this with the client and consider whether to withdraw from the case. Testifying falsely or omitting material facts could constitute perjury or unethical conduct. The investigator should also be prepared for cross-examination about the handling of the evidence and the review of personal files. They should not destroy or alter any evidence.