The Break-Room USB and the Unsigned Note
A regional credit union suspects a teller, Ms. Ortiz, of skimming cash from the vault. The branch manager calls you, the credit union's paralegal, after hours. The security guard hands you a plastic bag containing a USB drive found in the break room, a printed spreadsheet with daily cash totals, and a handwritten note. You also have access to CCTV footage from the vault room; the DVR clock is 11 minutes fast and the branch manager says the system automatically overwrites after 30 days. The teller was interviewed by the branch manager without counsel present and admitted "taking a little extra now and then" but refused to sign a statement. The USB drive contains a folder named "vault" with files last modified on dates matching the shortages. The credit union wants to refer the matter to prosecutors and terminate Ortiz. The spreadsheet has no author metadata and the note is unsigned.
1. Identify the chain-of-custody and authentication problems with the USB drive, the printed spreadsheet, and the handwritten note, and explain how you would fix them.
Read the worked answer
The immediate problem is that the guard handed you an unsealed plastic bag with no log showing who found the items, where, or when. That gap undermines chain of custody for all three items. For the USB drive, I would photograph it, assign an evidence number, seal it, and create a forensic image with a hash value before reviewing it. I would preserve the original and work only from the copy. Authentication can be established through the person who found it and through the file metadata, but the metadata should be captured by a forensic tool, not by opening the files. For the spreadsheet, a printed copy with no author metadata is difficult to authenticate. It may qualify as a business record if a custodian testifies it was kept in the regular course of business, or as a party admission if Ortiz authored it; otherwise, I need testimony linking it to her or to the vault system. The unsigned note requires handwriting authentication or a witness who recognizes the writing. I would create a complete evidence log and obtain statements from the guard and branch manager.
2. Ortiz admitted "taking a little extra now and then" to the branch manager, without counsel. Analyze whether that statement is admissible and what you should do next.
Read the worked answer
Miranda does not apply on these facts because the branch manager is a private employer, not a state actor. The absence of counsel during a private workplace interview is not automatically a constitutional violation. However, admissibility still depends on voluntariness. If the manager threatened termination, promised leniency, or otherwise coerced the statement, a court could exclude it in a criminal case as involuntary, and it could also be challenged in the employment proceeding. The statement is also ambiguous: "a little extra now and then" does not establish a specific amount or intent. I would preserve the manager's contemporaneous notes, interview the manager about the exact words and circumstances, and avoid any further interview of Ortiz without counsel. I would not rely on the admission alone; I would corroborate it with the USB files, cash records, and CCTV. If prosecutors become involved, I would flag the voluntariness issue rather than assume the statement is usable.
3. The CCTV DVR clock is 11 minutes fast and overwrites after 30 days. What steps should you take to preserve and authenticate the footage, and what foundation will you need?
Read the worked answer
I would preserve the footage immediately, before the 30-day overwrite. I would export the relevant clips in native format with the player, record the export hash, and photograph the DVR clock and system settings showing the 11-minute offset. I would also preserve system logs and maintenance records. For authentication, the credit union will need a witness who can explain how the system works, that it was operating properly, and that the export accurately reflects the recorded images. The 11-minute discrepancy is not fatal if documented; the witness can explain the offset and correlate the DVR time with real time using the alarm or transaction records. I would create a chain-of-custody log for the export and keep the original DVR storage if possible. If the footage is later offered at trial, the foundation should cover the camera location, the recording process, the export method, and any editing.