The Warehouse Laptop and the Master Key
Renee is a PI retained by a regional retailer after $18,000 of electronics disappeared from a Las Vegas warehouse. The warehouse manager learns that employee Greg has been placing company laptops in his locker and taking them home. The manager opens Greg's locker with a master key, finds a company laptop and a personal phone, and hands both to Renee. Renee interviews Greg in a closed office with the manager present. Greg admits taking two laptops, signs a handwritten statement, and says the phone is his and contains personal photos. The manager asks Renee to "go through the phone and the laptop tonight" and to email a report to the insurer by morning. Renee has no written consent to search the phone.
1. Was the locker search and the seizure of the phone lawful? What should Renee do about searching each device?
Read the worked answer
The locker search depends on the employer's written policy and the scope of consent. An employer may generally consent to a search of company property, including a company locker, if the policy clearly says lockers are company property and may be inspected. But the personal phone is different. Greg had a reasonable expectation of privacy in his own phone, and the manager's master key does not authorize a phone search. Renee should not go through the phone without Greg's voluntary written consent or a warrant/lawful court order. The laptop, if company-owned, can be inspected under company policy, but Renee should limit the search to company data and avoid personal files. The admission and handwritten statement should be documented, including who was present and whether Greg was free to leave.
2. How should Renee preserve the laptop, phone, and statement to withstand a chain-of-custody challenge?
Read the worked answer
Renee should treat the laptop as evidence: photograph it as found, record who had it and when, place it in an evidence bag, and start a chain-of-custody log with every transfer. She should not boot the laptop or open files on the personal phone; booting can alter metadata and destroy evidence. If forensic examination is needed, a qualified examiner should create a write-blocked image, calculate a hash value, and work from a copy. The phone should be powered down or placed in a Faraday bag if there is a risk of remote wiping, and only examined with consent or legal process. The handwritten statement should be preserved in original form, signed and dated, with a photocopy for the file. Any gap in custody must be explained in the report.
3. What should Renee's report say, and what should it avoid saying?
Read the worked answer
The report should be factual and chronological: the theft allegation, the employer's policy, the locker search, what was found, Greg's statements, the consent issue for the phone, and the evidence handling. Renee should not write conclusions beyond the evidence or describe the phone as "searched" if it was not. She should identify the client as the retailer, note the manager's role, and flag the limited consent for the phone. If the insurer is a separate client, Renee must confirm who is entitled to the report and avoid disclosing information beyond the engagement. The report should be delivered by the deadline only if the evidence has been properly preserved; if not, Renee should explain the delay rather than fabricate completion.