What do I do if something is on a computer during a workplace investigation?

What do you do if you need something off a computer? If it's just something like a PowerPoint or a chart or an email you ask for it, and the witness or accused or reporting party, whoever can often provide those things to you. But sometimes the person's unwilling to provide it, or even they don't have the technological knowledge to get it for you. Again, if it's a file that we're after sometimes, we can just engage the clients IT to help us do that.

But if it's a series of activities or a body of documents we need to know about that is somewhat outside the scope of our IT department, or this issue is likely going to be caught up in either criminal or civil litigation, we need to get a credentialed forensic IT person involved. So somebody with that forensic credentialing can go in and capture the data that we need for our investigation in a way that does not disturb that data and preserves and captures all the other logistics about that data, like the last time it was accessed before us when it was moved around, how it was created, how things were edited, what networks had it when items were transferred.

So a credentialed forensic person will be able to document all those things in a way that will be useful at that high criminal standard and also helpful at our civil bar.