What is a formal document prepared by a forensics specialist to document an investigation?

1. Analogical Evidence

Analogical evidence, as the name suggests, compares similar things in order to clarify or explain what has happened.

For example, say you’ve previously investigated harassment incidents between Isha and Larry. Even if you don’t have hard evidence of harassment, you can use past incidents to assume that Isha’s complaint that Larry harassed her (again) is true.

Another example: A location of your company in Omaha, Nebraska is a hot spot for employee theft. You plan to open another location in the same neighborhood of the same city with a similar makeup of employees (e.g. gender, race, age, etc.). Based on the incident data from the first location, and the similarities between the two, you should put extra anti-theft measures in place.

While not clear enough evidence to use in court, this kind of data can be useful for increasing credibility by drawing parallels when there isn’t enough clear-cut information to prove something in a workplace investigation.

2. Anecdotal Evidence

Anecdotal evidence comes in the form of retellings of events from parties involved in the investigation.

In your workplace investigations, examples might include:

• Written complaints or reports
• Accounts from the reporter, accused person, and witnesses as told in interviews
• Stories shared between an employee and their manager or coworkers

This type of evidence can be written in emails, instant messages, or on paper, or shared aloud in person or over a phone or video call. If you’re collecting verbal anecdotal evidence, be sure to record the call or interview. This ensures that you don’t forget any details and can save you if you’re faced with legal challenges from an employee (such as wrongful termination).

Anecdotal evidence isn’t used in court but can sometimes help in a workplace investigation to get a better picture of an issue.

The biggest problem with this kind of evidence is that it is often “cherry picked” to present only anecdotes that support a particular conclusion. Consider it with skepticism, and in combination with other, more reliable, kinds of evidence.

RELATED: 48 HR Investigation Questions to Get the Best Information

3. Character Evidence

Character evidence is a testimony or document that is used to help prove that someone acted in a particular way based on the person’s morals, personality, or propensities.

While this can’t be used to prove that a person’s behavior at a certain time was consistent with his or her character, it can be used in some workplace investigations to prove intent, motive, or opportunity.

For instance, do Rakim’s coworkers describe him as quiet and agreeable? If you then receive a complaint that he yelled at another employee, the behavior goes against the character evidence you have on him.

Or, another employee has accused Morgan of stealing cash from her till. Others share that she is often late for her shift, bad-mouths the company, and is rude to customers. This character evidence suggests that she is not committed to her job and may not feel remorse for stealing from the company.

Prevent incidents and issues, and protect your employees, brand & bottom line.

i-Sight’s case management solution boosts the efficiency and consistency of your investigations. Real-time reporting provides the data you need to uncover and prevent incidents. Spend less time on investigations, more time on prevention, and risk management. Request your demo of i-Sight to find out how users are saving time, closing more cases, reducing risk, and improving compliance.

Request a Demo

4. Circumstantial Evidence

Also known as indirect evidence, circumstantial evidence is used to infer something based on a series of facts separate from the fact the argument is trying to prove.

It requires a deduction of facts from other facts that can be proven and, while not considered to be strong evidence, it can be relevant in a workplace investigation, which has a different burden of proof than a criminal investigation.

For this type of evidence, let’s say Manpreet, a woman of Indian descent, was on track for a promotion, but the position was given to Adam, a white man with five years less experience. According to Cornell Law School’s Legal Information Institute, examples of circumstantial evidence for discrimination could include different treatment of Manpreet by her manager, hostility toward her, and suspicious timing of the promotion (e.g. not according to your regular promotion schedule).

While none of these actions are necessarily discrimination on their own, together they paint a strong picture that Manpreet was discriminated against in her promotion competition.

5. Demonstrative Evidence

This type of evidence includes items that directly demonstrate a fact. Demonstrative evidence falls into two categories:

1. Physical evidence: pieces of evidence you can see and touch, such as a sack of stolen inventory found in the employee’s locker
2. Illustrative evidence: charts, graphs, photos, models, or recordings, such as a video of an employee harassing another employee

This is one of the most reliable types of evidence to use in your investigation. While there are some cases where demonstrative evidence can be explained away, this is rare. Collect as many pieces as you can to strengthen your investigation and make the right final decision.

Do you have trouble keeping track of or hunting down this type of evidence during your investigations? i-Sight’s centralized platform lets you keep all relevant evidence and information right in the case file. Nothing will be lost or forgotten about, and you’ll save time by keeping all your evidence in one place.

6. Digital Evidence

Digital evidence can be any sort of digital file from an electronic source. This includes email, text messages, instant messages, social media posts, files and documents extracted from hard drives, electronic financial transactions, audio files, and video files.

Digital evidence can be found on any server or device that stores data, including some lesser-known sources such as home video game consoles, GPS sport watches and other wearable tech, and internet-enabled devices used in home automation.

This type of evidence is often found through internet searches using open source intelligence (OSINT).

RELATED: 101+ OSINT Resources for Investigators

Challenges of Digital Evidence

Collecting digital evidence requires a skillset not always needed for physical evidence. There are many methods for extracting digital evidence from different devices and these methods, as well as the devices on which evidence is stored, change rapidly.

Investigators need to either develop specific technical expertise or rely on experts to do the extraction for them.

Preserving digital evidence is also challenging because, unlike physical evidence, it can be altered or deleted remotely. Investigators need to be able to authenticate the evidence, and also provide documentation to prove its integrity.

To combat this challenge, when you uncover a piece of digital evidence, document it right away. Take a screenshot or screen capture video that clearly shows the time and date. That way, if the accused person deletes the item, you have proof that it was there.

Once you have your documentation record (e.g. image or recording), pop it into your case management system right away. With i-Sight, not only can you store your records right in the case file, but these actions will be added to the case action timeline so you can prove what pieces of evidence you uploaded and when.

Need help tracking down digital evidence?

In this free webinar, you’ll learn where and how to find the most helpful information on your subject in the shortest amount of time.

Watch the Webinar

7. Direct Evidence

The most powerful type of evidence, direct evidence requires no inference and directly proves the fact you are investigating. The evidence alone is the proof, if you believe the accounts.

“Usually,” say the experts at Kraut Law Group, “direct evidence will be eyewitness testimony regarding something that was actually observed.”

Some examples of direct evidence in your workplace investigations could include:

• A victim’s complaint that a coworker made a discriminatory comment toward them
• A witness’s account of another employee not abiding by safety protocols
• A customer’s report that they were harassed by an employee

8. Documentary Evidence

According to the Legal Information Institute, documentary evidence is “a broad term that includes almost anything on paper.” However, it also includes documentation of facts found in other forms such as film and audio tapes.

In your investigation, types of documentary evidence you might use include:

• Ledgers and books (e.g. accounting logs)
• Video or audio recordings (e.g. surveillance footage, Zoom meeting recordings)
• Photos or screenshot images (e.g. photo of harassment incident taken by a bystander)
• Physical copies or computer printouts of documents, files, records, messages, or emails (e.g. employee records, past case files)
• Notes, letters, or other written correspondence (e.g. notes passed between coworkers, termination letters)

9. Exculpatory Evidence

This type of evidence can exonerate the accused person, usually the defendant in a criminal case. Prosecutors and police are required to disclose to the defendant any exculpatory evidence they find or risk having the case dismissed.

In the case of workplace investigations, exculpatory evidence is anything you can find that suggests the accused employee didn’t commit the bad behavior.

For example, Harold accuses Frank of harassing him around noon on March 10th. However, Madeline claims she eats lunch with Frank at that time every day, so he couldn’t have been interacting with Harold, otherwise she’d have witnessed it.

This information provides an alibi for Frank and can lead you to the conclusion that the harassment didn’t take place.

10. Forensic Evidence

Forensic evidence is scientific evidence, such as DNA, trace evidence, fingerprints, or ballistics reports, and can provide proof to establish a person’s guilt or innocence. Forensic evidence is generally considered to be strong and reliable evidence and alongside helping to convict criminals, its role in exonerating the innocent has been well documented. The term “forensic” means “for the courts”.

The use for this type of evidence in workplace investigations is generally limited to serious cases that may end up in court.

For instance, workplace violence, accidents that lead to injury or death, or extreme cases of harassment (especially sexual harassment) might require forensic evidence to be collected and analyzed to reach a conclusion.

Forensic evidence (or lack thereof) played a part in the Theranos fraud case. Investigators wanted to access the company’s test results database, as blood tests were reported as extremely inaccurate. When they tried to retrieve the database, “the data disappeared.”

A computer forensics expert then attempted to retrieve the data from Theranos’ hard drive, but found it was protected by multiple passwords and couldn’t be opened. During this part of the investigation, Theranos shut down the facility that housed their database, making that data lost forever to both the company and investigators.

The fact that the company would destroy a key tool of their business processes (and potential forensic evidence), coupled the the timing of the shut down, made federal investigators so suspicious they wrote a filing about it.

11. Hearsay Evidence

Hearsay evidence consists of statements about the incident made by witnesses who are not present. These statements can be written or oral.

In a workplace investigation, this type of evidence mostly consists of conversations between parties involved in the incident. Essentially, it’s information shared outside of the confines of your formal investigation interviews.

For instance, conversations between the victim and accused person, victim and their manager, or accused person and a coworker all fall into the category of hearsay evidence.

While hearsay evidence is often not admissible in court, it can be relevant and valuable in a workplace investigation where the burden of proof is less robust than in court.

Are you including all your evidence in your final investigation report?

Without documentation of the evidence and an explanation of how you used it to reach your conclusion, you risk having your investigation challenged by management or one of the parties. Make sure your investigation report is thorough and compliant by using our free template.

Get the Template

12. Physical Evidence

As would be expected, evidence that is in the form of a tangible object, such as weapons, body fluids, and markings, is considered to be physical evidence.

Physical evidence is also known as “real” or “material” evidence. It can be presented in court as an exhibit of a physical object, captured in still or moving images, described in text, audio, or video or referred to in documents.

The amount of physical evidence you find and use in your workplace investigation depends on the type of incident you’re investigating. For example, if an employee claims they were verbally harassed by their coworker, there might be very little physical evidence to support that.

However, if an employee reports seeing their coworker break into your petty cash safe, you might find fingerprints or tool marks on the safe, or metal shavings on the floor, that corroborate the story.

13. Prima Facie Evidence

Meaning “at first sight,” this is evidence presented before a trial that is enough to prove something until it is successfully disproved or rebutted at trial. This is also called “presumptive evidence.”

Prima facie evidence only applies to workplace investigations that potentially need to go to trial. This might include incidents with criminal implications (such as workplace sexual assault) or cases that can’t be settled internally (i.e. when an involved party doesn’t agree with the outcome).

Let’s say Milo claims that Brian slapped him in the office lunch room. Milo’s piece of prima facie evidence is a video of the incident that his coworker took on their phone. This evidence would be enough to prove the assault occurred unless Brian can show that the video was falsified or the incident didn’t happen the way it looks in the recording.

14. Statistical Evidence

Statistical evidence uses numbers (or statistics) to support a position. This type of evidence is based on research, polls, or other forms of data analysis.

During your workplace investigation, you might have to use statistical evidence to help you decide whether or not the incident occurred.

As an example, let’s again look at Manpreet’s discrimination claim. To determine if she was discriminated against in her promotion competition, analyze the historical promotion data for her position. Who has held the position before her? Has it ever been a woman or a person of color, or an employee like Manpreet who is both?

If the data shows that the position has always been held by men and/or white people, you can use this as statistical evidence to support the discrimination claim.

Analyzing your statistical evidence can be a daunting task. To make the process faster and easier, use a case management tool. i-Sight’s reporting feature lets you sort your case data into easy-to-understand visuals, including graphs, charts, and heat maps. You’ll be able to deep-dive into your data, including location, incident type, and employee, with just a few clicks.

15. Testimonial Evidence

One of the most common forms of evidence, this is either spoken or written evidence given by a witness under oath. It can be gathered in court, at a deposition, or through an affidavit.

In your workplace investigation, you’ll gather testimonial evidence of sorts during your investigation interviews. This consists of formal accounts shared between involved parties and the investigator.

This type of evidence differs from hearsay evidence as the former is made up of correspondence with the investigator, while the latter is shared outside the interview room.

“The new wave of complaints seen by employers are more complex and nuanced, readily voicing concerns about systemic and pattern and practice discrimination which employers, in the eyes of the complainants, have perpetrated for far too long,” say Andre’ Caldwell and Monique Gougisha Doucette of Ogletree Deakins.

As you go through your workplace investigation, try to collect as many types of evidence as you can. A weak investigation with little evidence puts you at risk of lawsuits, non-compliance fines, and distrust from your employees. The stronger the case you can build for your conclusion, the lower your chances of these negative consequences.

You’re facing more incidents than ever, each with higher risk than the last. i-Sight can help you uncover, investigate, and prevent incidents. Create cases instantly, attach evidence, streamline your processes and report in seconds to spot trends and prevent future issues.

What are the six phases of the forensic investigation process?

How do you conduct a forensic investigation?

What are the steps to a forensic process?

What are the 7 steps in identifying analysis at a forensic case?