The Thumb Drive, the Screenshot, and the Unlocked Locker
You are retained by a warehouse operator after $18,000 of copper fittings disappeared over six weeks. On day two, a shift supervisor hands you a thumb drive he says he found in the break room, plus a screenshot of a text thread he photographed over a suspect's shoulder. On day three, during a walk-through with the plant manager, you see a torn glove and a shipping label behind a trash compactor inside the fenced yard; the plant manager says to 'just grab it.' You then learn the suspect's personal locker is unlocked and the plant manager wants you to open it before the suspect's shift ends.
1. Evaluate each item of evidence and state what you may lawfully do with it.
Read the worked answer
Thumb drive. The chain starts with the supervisor, not you. You may accept it, but you must (1) interview and memo the supervisor on exactly where, when, and how he found it; (2) not plug it into any agency computer - unknown media carries malware, and booting or opening files alters access metadata; (3) if content matters, have it forensically imaged by a qualified examiner with a hash recorded; (4) recognize it may contain personal or privileged material, so scope the review to the theft issue.
The screenshot. The supervisor's over-the-shoulder photography is his act, and it is legally exposed - a personal phone screen carries a strong privacy expectation. You should not have directed it and must not repeat it. You may receive it, but flag to counsel that its provenance invites suppression and possibly an ethics complaint. Take a written declaration from the supervisor describing precisely how he obtained it; do not 're-create' the image or ask him to do it again.
The glove and label in the fenced yard. The yard is the client's premises and the plant manager has authority to consent, so retrieval is permissible. But photograph the items in place first - wide shot, mid, close-up with a scale - record date, time, location, and who directed retrieval, then collect with gloves into a sealed, labeled container.
2. Describe the chain-of-custody documentation you would create for the items you take, and explain what a break in the chain actually affects.
Read the worked answer
Each item gets a unique evidence number and a page in a master evidence log recording: description, where and when found, by whom, who directed collection, photographs taken in place, packaging method, seal number, and storage location.
Every transfer is signed and dated by the releasing and receiving party with purpose stated - 'released to forensic examiner for imaging,' 'returned to evidence locker.' Photograph the sealed package showing the seal intact before each opening. Digital items get a hash value recorded at acquisition and re-verified on each transfer. Storage is a locked cabinet with limited keyholders, and the log is maintained contemporaneously, not reconstructed at trial.
A break in the chain does not automatically exclude the item. Its practical effect is to give opposing counsel an argument that the item was altered, substituted, or contaminated - an attack on weight, foundation, and credibility. A single undocumented gap on a $18,000 theft case can convert a clean exhibit into a settlement conversation, which is why the log is written as you go.
3. What do you advise about the unlocked locker, and why?
Read the worked answer
Advise the plant manager not to have you open it.
Three reasons. First, a personal locker - even unlocked, even in a workplace - may support a reasonable expectation of privacy, and the employer's authority to search depends on a written policy that reserves that right, notice to employees, and consistent past practice. If the policy is missing or was never distributed, the search is a gift to defense counsel. Second, you are not law enforcement; you have no authority to conduct a search, and opening the locker personally makes you the witness whose conduct is on trial rather than the thief's. Third, if the workforce is represented, a collective-bargaining provision may govern.
The lawful path: retrieve the policy and confirm its terms in writing; if it authorizes employee-locker searches, have the employer's management conduct the search with an HR witness and you present only as an observer documenting what is found, photographed in place before removal. If the policy is silent or absent, obtain the suspect's consent in writing or refer the matter to counsel and law enforcement. Document the advice you gave and the reason - if management searches anyway, you want the file to show it was their decision, not your instruction.