The Missing Witness and the Chain of Custody
Investigator Lena is hired in a commercial dispute to locate a former employee who may have taken proprietary files. A building manager gives her a USB drive found in a vacated office, saying it 'might be relevant.' Lena takes the drive, plugs it into her own laptop that evening to see what is on it, finds client lists and emails, and copies selected files to her case folder. Two weeks later, opposing counsel demands the drive and challenges its authenticity. Lena's notes say only 'received USB from building manager.'
1. Identify the evidence-handling failures in Lena's handling of the USB drive.
Read the worked answer
Several. First, she did not document the transfer: no date, time, location, building manager identity, or description of the drive and its condition, so the chain of custody has a gap. Second, she plugged an unknown drive into her own laptop, which risks altering metadata and contaminating the device, and raises malware and integrity concerns. Third, copying selected files rather than preserving the whole device image means the original state is not preserved and selection could look like cherry-picking. Fourth, her notes are inadequate to rebut an authenticity challenge. Proper handling would have been to log the receipt in detail, photograph and bag the drive, avoid altering it, and use forensically sound imaging by a qualified examiner, maintaining a written chain of custody.
2. Opposing counsel challenges authenticity. What can Lena do now to shore up the evidence, and what are the limits?
Read the worked answer
Lena can reconstruct what she can: obtain a written statement from the building manager describing where and when the drive was found, document her own actions and timeline, and preserve everything still in her possession, including her laptop state and the copied files with metadata. She can have a qualified forensic examiner attempt to verify the drive's contents and timestamps, but the examiner cannot undo the earlier contamination or the gap in custody. She should be candid that the chain has weaknesses rather than assert a clean provenance she cannot support. The limits are real: the evidence may be excluded or given reduced weight, and she should not attempt to create a cleaner paper trail after the fact. Fabricating or backdating documentation would be far worse than the original error.