KEY TAKEAWAYS:
- Digital evidence from a wide variety of online sources is commonplace in workplace investigations.
- AI tools that can quickly and easily create fake text messages and email exchanges, pose significant challenges in verifying evidence authenticity.
- Evidence collection methods directly impact reliability, requiring screen recordings and metadata verification.
- Securing digital content quickly is essential.
- Consideration of privacy and criminal laws and proper documentation of digital evidence handling is crucial for maintaining integrity and admissibility.
- Ensure procedural fairness by giving participants the opportunity to respond to relevant digital evidence that conflicts with their version of events.
Digital evidence in workplace investigations
Q Workplace Solutions (QWS) Investigators Caroline O’Connor and Emma Kirkland presented on the complexities of navigating digital evidence at the 2025 Association of Workplace Investigators (AWI) Australia & New Zealand Chapter Conference in September in Auckland.
Their session, ‘The Digital Trail’, explored the increasingly complex landscape of collecting and analysing digital evidence during workplace investigations.
They shared their first-hand experience collecting and assessing digital evidence through a recent case study that required navigating multiple sources of digital evidence including Google Maps Timeline (which, if activated, automatically tracks and saves a person’s visits and trips to their devices), Facebook, CCTV, and weather data.
Challenges in digital evidence reliability
Critical to workplace investigations is the challenge of verifying digital evidence when AI and online tools can readily create fake written and visual content. AWI 2025 Conference presenters Johanna Drayton and Jordan Boyle from Dyhrberg Drayton Employment Law demonstrated the ease with which this can be done during their session on ‘Evaluating Evidence in the Age of AI’.
During the QWS session, Emma demonstrated how her thorough examination of text messages provided by different interviewees revealed critical discrepancies. One party’s submission of PDF documents allegedly containing copies of screenshot text messages and CCTV weeks after the evidence was initially requested were less reliable than those provided spontaneously, on request, by the other party to the same text message chat.
Bringing a critical mindset to a workplace investigation
Workplace investigators do not need to have extensive knowledge about every online social sharing platform, nor the digital tools that can be used to track people’s locations or create fake content.
However, workplace investigators are called on to examine and verify the evidence they consider, including digital evidence. Bringing a critical mindset to every investigation will help investigators ask the right questions to test the veracity and reliability of that evidence.
Think outside the box: Digital evidence extends beyond obvious sources like emails and text messages. Consider alternative sources of evidence including platforms where relevant communications might exist, such as social media, online gaming, and platforms where fake digital evidence can be created. This is an evolving area that requires ongoing vigilance and training.
Establish relevance: Clearly establish how the digital evidence is relevant to the matter under investigation.
Secure content quickly: With “disappearing” content common on many platforms, secure evidence as soon as possible through screenshots, screen recordings, or other preservation methods. Be aware that some platforms notify other parties when screenshots are taken. Therefore, consider alternative means of capturing that evidence to avoid notification.
Consider how evidence is provided: The method of evidence collection can significantly impact the reliability of that evidence. Consider:
- using screen recordings of live demonstrations from smartphones
- checking metadata where available
- asking interviewees to show digital evidence directly on their device
Test evidence veracity: As with any form of evidence, but especially with digital evidence that can be easily manipulated and fabricated, always verify the authenticity of the evidence. And keep in mind when a forensic expert might need to be briefed.
Understand evidence types: Digital evidence can serve as both direct evidence (proving a fact directly) and corroborative evidence (supporting other statements). It can also help assess the reliability and credibility of other evidence.
Interpret digital communication accurately: As language evolves keep in mind the meaning of words, phrases and emojis can change. Resources like those created by the Australian Federal Police at https://www.thinkuknow.org.au/ can help interpret these elements.
Navigate legal boundaries: Always be mindful of the intersection with criminal and privacy laws when collecting and using digital evidence (including audio recordings).
Maintain chain of custody: Document how digital evidence was handled from collection to analysis, in order to preserve its integrity and admissibility.
Document thoroughly: Investigation reports should clearly set out how digital evidence was obtained or provided, and how it was considered, weighed, and relied on in reaching conclusions.
Ensure procedural fairness: Always give participants an opportunity to respond to material evidence, including digital evidence, particularly when it contradicts their account. Inform participants who provide digital evidence that the investigator may need to share that information with other participants.
Looking forward
As sources of digital content rapidly change and the capability to manufacture, fabricate and manipulate content has never been faster and easier, it’s more important than ever for investigators to keep current with technological advancements and to scrutinise digital evidence.
The enthusiastic participation and shared experiences from 2025 AWI conference attendees reinforced that investigators across Australia and New Zealand face similar challenges in navigating the digital landscape.
At Q Workplace Solutions, we remain committed to developing and adopting best practices for handling digital evidence that balance thoroughness with fairness and privacy considerations.
We would like to thank AWI’s Australia & New Zealand Chapter for hosting an excellent conference and the opportunity to share our experiences and learn from our colleagues. We are looking forward to the next conference in 2027.
This article was co-written by Q Workplace Solutions Investigator Emma Kirkland.
More information
Caroline O’Connor and Emma Kirkland are workplace investigators with Q Workplace Solutions – an independent national firm which specialises in complex and high-stakes workplace investigations. For more information about our services call 1300 944 049 or follow us on LinkedIn for more investigations insights.
