The Harassment Investigation with Screenshots, Time Zones, and a Fake Facebook Profile
Morgan is a licensed PI retained by an Oregon employer to investigate a harassment complaint. A complaining employee voluntarily hands Morgan her personal iPhone and says, 'Copy whatever you need.' Morgan scrolls through six text threads, takes 41 screenshots, emails them to the client's HR director, and returns the phone. Morgan does not preserve the original device, export the messages, or record hash values. Two weeks later the accused supervisor is fired and sues. Opposing counsel contends the screenshots are incomplete, the timestamps are wrong because the phone was set to Eastern time, and Morgan 'friended' the accused supervisor on Facebook using a fake profile to view a private group where the supervisor joked about the complainant. Morgan's report states the supervisor 'admitted' harassment, but the quoted message actually says 'I probably shouldn't have said that.'
1. Identify the evidence-handling deficiencies and explain how Morgan should have preserved the text messages.
Read the worked answer
The main problem is that screenshots are a weak copy, not the original. Morgan should have preserved the phone or made a forensic image/export with metadata, recorded the device model, iOS version, time zone, and account, and logged every transfer with hash values. Returning the phone without an image allowed the data to change and gave opposing counsel an argument that the screenshots are incomplete or altered. The wrong time zone issue can be explained by documenting the phone's settings at the time of collection, but the failure to do so now hurts authentication. To fix it, Morgan should try to re-obtain the device with consent, make a forensic copy, and prepare a declaration describing the collection. He should not delete duplicates or edit images; he should preserve everything and explain the duplicates.
2. Was using a fake Facebook profile to view a private group permissible?
Read the worked answer
The fake Facebook profile is a problem. Even if the supervisor's group was not visible to the public, using a false persona to gain access can violate the platform's terms, misrepresent Morgan's identity, and raise fraud or unauthorized-access concerns. It can also taint the evidence: opposing counsel will argue the messages were obtained by deception, and the supervisor may have privacy or Stored Communications Act claims. Oregon's PI statutes prohibit dishonest or fraudulent conduct in the course of an investigation, and a license can be disciplined for it. A cleaner approach is to use lawful open-source research, identify himself when required, and avoid connecting with a represented party. If the group was truly public, Morgan should document how he accessed it without deception.
3. How should Morgan characterize the quoted message in the report?
Read the worked answer
The report must quote the message exactly. 'I probably shouldn't have said that' is not an admission of harassment; it is ambiguous and may be an admission of poor judgment. Writing that the supervisor 'admitted' harassment mischaracterizes the evidence and violates the duty to report accurately. Morgan should include the full message, surrounding context, date, time, and source, and let the reader draw conclusions. If Morgan believes the message is relevant, he can explain why, but he must label it as his inference, not as the speaker's admission. He should also correct the earlier report in writing, because a misleading report can damage the client's case and expose Morgan to discipline.