The Laptop and the Desk Drawer
A 40-person accounting firm reports $87,000 in duplicate vendor payments and points to one bookkeeper. The managing partner hands you a signed authorization for "full access to everything" and the bookkeeper's company laptop. Imaging the drive reveals client files, a cached personal Gmail session, personal medical PDFs, and a desktop chat app. You also want the firm's paper checkbook and the bookkeeper's personal cell phone from her unlocked desk drawer while she is at lunch; she returns early and asks what you are doing. The imaged drive then sits on a $60 external drive in your glovebox for two days before you deliver copies to the client's outside counsel and to a detective handling a parallel criminal referral.
1. Define the actual scope of the consent you hold and explain what you must not open, even though the authorization says "everything."
Read the worked answer
Consent is bounded by the consent-giver's authority, not by the adjectives in the document. The managing partner can authorize access to the firm's systems, the firm's data, and firm-owned equipment used for firm business. He cannot authorize you to rummage through an employee's personal accounts or personal health information that happens to sit on the same drive.
- In scope: vendor files, payment records, email on the firm's system, the bookkeeper's business documents, logs, and the accounting application data.
- Out of scope / stop-and-segregate: the cached personal Gmail session, the medical PDFs, and personal chat content. Do not open them to "see if they're relevant." The moment they appear, stop the review of that folder, document what you saw and where, and notify the client and counsel so they can decide.
- Why it matters: unrelated personal data creates a privacy claim against you, complicates the criminal referral, and can be used to argue the whole search was overbroad. It also risks capturing privileged material if any client of the accounting firm is involved.
Practical: obtain a written scope memo from the client before imaging, and a second written instruction when personal data surfaces. "Full access to everything" is a red flag in a file, not a permission slip.
2. The checkbook is firm property; the personal cell phone is not. What is your move at the desk drawer, and how do you document the items you do take?
Read the worked answer
At the drawer:
- Checkbook: firm property used in firm business → within the authorized scope. Photograph it in place, then take it, and give the managing partner a receipt.
- Personal cell phone: not firm property and not covered by the managing partner's consent. Do not take it. Do not scroll it. If its contents matter, the paths are the employee's written consent, a civil subpoena, or a law enforcement warrant. An unlocked phone in a drawer is the single fastest way to convert a strong fraud case into a conversion and privacy claim.
Documentation for each item taken:
- Unique item number and description (including serial numbers and condition).
- Date, time, and exact location of collection; who was present.
- Photographs before the item moves.
- Collector name and credential.
- Packaging: sealed, tamper-evident bag, seal number, initials over the seal.
- Transfer log: every handoff with date, time, from, to, purpose, and both signatures.
- Storage location between transfers.
For the digital image: write-block the source, compute a SHA-256 hash at acquisition, record the tool and version, hash again at each transfer, and keep the original image untouched while working from a copy.
3. The two-day gap in your glovebox and the dual delivery to counsel and to a detective both become issues. How do you handle the employee's question at the drawer, and how do you fix the custody problem?
Read the worked answer
The employee at the drawer: do not lie, do not block her, do not touch her, and do not improvise an interrogation. Say you are conducting an investigation at the firm's direction and that questions about her employment should go to the managing partner. If she asks to leave, let her leave. A confrontation with an unrepresented employee, in front of a witness, is where improvised investigations generate the assault and false-imprisonment claims.
The glovebox gap: it is a defect in the record, so the answer is candor, not reconstruction.
- Disclose the gap in the custody log with dates and times, and state where the drive was and who had access.
- Explain why it happened (no evidence locker) and what changes now: same-day transfer, locked storage, chain-of-custody form at every step, no evidence in personal vehicles overnight.
- Recompute the hash on delivery to prove the image is unchanged. If the hash matches the acquisition value, the gap is a documentation problem rather than a contamination problem - which is exactly why you hash.
Dual delivery: two independent recipients means two separate logged transfers, two receipts, and two hash verifications. Never send the only copy, and never deliver to law enforcement without the client's written direction.