The Deleted Email Trail
A mid-size manufacturer suspects a procurement manager, Owen, of steering contracts to a vendor owned by his brother-in-law. You are asked to collect evidence. Owen is still at work and has not been notified. The IT director offers to 'pull everything off his laptop right now' and to log into Owen's email to forward you the relevant messages. The company has a written acceptable-use policy stating that systems are company property and may be monitored, and Owen signed an acknowledgment. The legal team has not yet issued a litigation hold. Owen's laptop is encrypted, and he is known to delete email aggressively. You have 48 hours before a scheduled reduction-in-force that could affect Owen.
1. Design the evidence-collection sequence for the next 48 hours, addressing the IT director's offer and the litigation-hold gap.
Read the worked answer
The IT director's offer is well-intentioned but procedurally risky; redirect it into a defensible process.
Sequence:
- Notify legal immediately and request a litigation hold before collection. The RIF timeline is exactly why spoliation risk is high - a hold preserves the duty to retain even if Owen is later terminated.
- Preserve, don't browse. Rather than having IT 'log in and forward' emails, capture a forensic image of the laptop and a server-side export of Owen's mailbox. Forwarding alters metadata and breaks chain of custody.
- Document authority. Rely on the signed acceptable-use acknowledgment, but have legal confirm the monitoring scope in writing before the image is taken.
- Chain of custody. Record who collected, when, what tool, hash values of the image, and where it is stored. Two-person verification at handoff.
- Handle encryption. If the laptop is powered on, consider whether live capture or a memory image is warranted before shutdown; coordinate with a forensic specialist rather than guessing.
- Deletion is a finding, not a dead end. Server-side mail retention and backup tapes may recover deleted messages; note the aggressive-deletion habit as potentially relevant.
- Sequence relative to the RIF. Do not let the RIF become a pretext to destroy or lose access to evidence - collect and preserve first.
2. Owen's brother-in-law relationship is the heart of the conflict allegation. What evidence would actually establish favoritism versus mere relationship?
Read the worked answer
A family relationship is a conflict to disclose, not proof of wrongdoing. To establish favoritism you need to show the relationship influenced decisions.
Evidence that would matter:
- Did Owen disclose the relationship? Check conflict-of-interest disclosures and whether he recused from the vendor selection.
- Competitive process: Were there competing bids? Were the brother-in-law's bids consistently selected despite higher price, weaker terms, or missed deadlines?
- Comparators: How did this vendor's pricing and performance compare to other vendors for similar goods?
- Decision trail: Emails, meeting notes, and approval records showing who advocated for the vendor and on what stated basis.
- Timing: Did the relationship or vendor activity coincide with favorable changes (scope increases, waived penalties)?
What would NOT establish it: the relationship alone, or a single favorable decision that has a legitimate business explanation.
Model answer conclusion: pursue the documentary decision trail and comparator pricing; the relationship is the hypothesis, the bid history and approvals are the test.