The Locker Search and the Phone
You are hired by a family-owned HVAC company to investigate missing copper fittings. The owner gives written permission to search a shared break-room locker assigned to a suspect, a 19-year-old apprentice. After hours, you find a canvas bag with $2,300 in cash, a notebook containing passwords, and a personal smartphone. You photograph the items on the table, unlock the phone using a password written in the notebook, scroll through text messages, copy images to a USB drive, return the phone to the locker, and give the USB to the owner. The apprentice is fired the next morning. Two weeks later, his mother demands the phone and threatens a lawsuit; the owner asks you to 'clean up' your file to show a proper chain of custody.
1. Identify the evidence-handling errors and their consequences.
Read the worked answer
The errors begin with the absence of a scene record: no photograph of the items in place before they were moved, no evidence log, no sealed bag, no witness, and no hash value for the USB. Returning the phone to the locker breaks continuity and destroys the ability to show that the device was not altered. Unlocking a personal phone with a password found in a notebook may exceed the consent the owner gave; employer consent to search a shared workplace locker is not necessarily consent to rummage through a personal device. Scrolling texts and copying images without a defined scope also creates a privacy claim.
The consequences are predictable: the apprentice can attack authenticity, argue the images were planted or altered, and bring invasion-of-privacy and wrongful-termination claims. The employer may face a spoliation argument because the original phone was returned and the USB is the only copy. A board complaint is also possible. The shared locker may reduce the apprentice’s expectation of privacy in workplace property, but that does not automatically cover a personal phone or the notebook passwords. The file should show exactly what was searched, why, and under whose authority.
2. What should you do now, including responding to the owner’s request to 'clean up' the file?
Read the worked answer
Do not alter, backdate, or recreate the file. Write a contemporaneous memo describing what you found, where, when, who was present, how the phone was accessed, and what was copied. Preserve the original USB, your notes, and any photographs; do not overwrite or 'improve' them. Ask the owner to preserve the phone and the locker contents, but do not personally demand the phone from the mother without counsel’s advice. Notify the owner that the request to clean up the file is improper and could amount to evidence tampering or a false report. If the owner insists, withdraw and document the instruction.
Route the mother’s demand to the company’s attorney or insurer. If litigation is reasonably anticipated, issue a written litigation hold. If a crime is suspected, consider referring the matter to law enforcement and let them handle the phone with proper process. Be transparent with counsel about the chain-of-custody gaps; hiding them will be worse than disclosing them.
3. How should digital evidence be handled in a future case?
Read the worked answer
Use a written search protocol and consent form that specifies the place, items, and scope, including whether personal devices may be examined. Photograph items in place, assign evidence numbers, log every transfer, and seal physical items. For a phone or computer, do not scroll through it casually; preserve the device, keep it powered or in a Faraday bag as appropriate, and have a qualified examiner make a forensic image with a hash. Record the hash before and after, limit access, and keep the original in secure storage. Return an original only with a signed receipt and counsel’s approval, and never return the only copy.
Separate relevant data from personal data and document any redactions. If the matter may become criminal, coordinate with law enforcement rather than conducting your own extraction. Produce a report that states what you did, what you did not do, and the limits of your examination. That report protects the client and your license.