Internal investigation: how to preserve evidence of employee misconduct

What an internal investigation is and what triggers one

An internal investigation is a fact-finding process an organization runs on its own initiative to establish whether an employee broke the law, a policy or the code of conduct. Tips are the most common trigger: the ACFE’s Occupational Fraud 2026 report found that 43% of frauds were detected through tips and that 55% of tips came from employees. TrueScreen certifies the chats, emails, photos and videos a tip brings with it, recording how and when each was captured.

An internal investigation usually starts with a specific report, and the evidence behind it is often months old by then.

In a corporate internal investigation, other common triggers are audit findings, customer complaints, safety inspections and log anomalies. The ACFE report, based on 2,402 cases in 143 countries, puts the typical fraud at 12 months before detection, with a median loss of $104,000. Throughout the HR investigation process, the employee has the right to hear the allegations and respond, and the role of works councils varies by country. Whether the last step is called a disciplinary hearing or not, it rests on what the file can prove.

Why misconduct evidence fails when it is challenged

Misconduct evidence fails when the employer cannot show that an item is authentic, complete and unchanged since it was collected. Under US Federal Rule of Evidence 901(a), for example, “the proponent must produce evidence sufficient to support a finding that the item is what the proponent claims it is,” and other legal systems ask similar questions. TrueScreen follows the principles of ISO/IEC 27037 when it acquires content, computing cryptographic fingerprints at capture and documenting the process in a technical report.

A challenge to misconduct evidence usually targets authenticity, integrity or chain of custody.

Authenticity asks whether the item is what you say it is. A screenshot shows pixels, not the account or the phone behind them, which is why FRE 901 accepts “evidence about a process or system” as a way to authenticate. Integrity asks whether anything was cropped, edited or removed: an exported chat is a text file anyone can change, and an email printed to PDF loses its headers. Chain of custody asks who held the item and when; under ISO/IEC 27037:2012, a gap at any stage from collection to preservation gives the other side room to argue. See our guides to the digital chain of custody, to digital evidence preservation and to evidence in workplace disputes.

TrueScreen

TrueScreen, the forensic acquisition and certification platform

Acquire and certify digital content with legal value, right from the source.

Discover more →

How to preserve chats, emails, photos and videos before acting

Preserving misconduct evidence means capturing each item at its source, with a record of how and when it was captured, before anyone takes a disciplinary step. ISO/IEC 27037:2012 splits the handling of digital evidence into four stages: identification, collection, acquisition and preservation. Content captured in real time is certified as a forensic acquisition and carries higher evidentiary value than an imported file. TrueScreen captures chats by recording the phone screen in its app or by opening WhatsApp Web in the Forensic Browser, and certifies emails forwarded to a dedicated address from senders enabled for it.

Each type of evidence has its own weak point, so each needs its own capture method.

The table shows how evidence is usually gathered in an employee misconduct investigation, where that breaks down and what to do instead.

Lawful sources and privacy come first

Certified evidence from an unlawful source is still unlawful evidence. The colleague in the WhatsApp case belongs to the group and shows the chat voluntarily, so she is a lawful source; an employee’s personal phone is off limits. In Europe, GDPR article 88 lets member states set specific rules for employee data, alongside transparency and data minimization. The UK regulator’s guidance on monitoring workers allows covert monitoring only in exceptional cases of suspected crime or gross misconduct, time-limited and never in private areas. If the case started from a report, Directive (EU) 2019/1937 adds confidentiality for the reporter and protection from retaliation. The employer remains the data controller, and TrueScreen acts as processor.

1. 1

   Secure the evidence as soon as you learn of it

   Capture the evidence the day it reaches you, while the chat still exists and the scene looks the same. The certified date works both ways: it proves the evidence existed that day, and that the employer had it from that day. Depending on the jurisdiction, an unexplained gap of weeks before the first disciplinary step can weaken the employer’s position, so plan the next steps at once.

2. 2

   Capture in real time instead of importing

   An imported screenshot or chat export can still be certified, but the certificate proves only what the file contained from that moment on, not how or when the conversation took place. In the site supervisor’s case, the inspector shoots photos and videos during the inspection with the TrueScreenmobile app, which checks device, environment and metadata before sealing, certifies the GPS position and rejects mock locations (more in our guide to certified photos).

3. 3

   Keep the package intact and ready for review

   File each certified package exactly as produced and work on copies. Anyone can verify it with standard tools, so counsel or an expert can check it without taking your word for it.

Investigation interviews: notes, recordings and consent

An investigation interview is the meeting where the investigator hears the employee under investigation or a witness and records what each says. Its record is often the most contested document in the file, and under GDPR article 88 each EU member state may set its own rules for employee data. TrueScreen certifies interviews held on Zoom, Google Meet, Microsoft Teams, Slack and Cisco WebEx through a virtual assistant that records audio and video once participants admit it.

The interview record should be something both sides can check: signed notes in a room, a certified recording online.

Interview notes signed by the interviewee

Two company attendees work best: one asks, one writes. Read the notes back, let the interviewee correct them and ask them to sign; if they refuse, note it. A scan of the signed notes can then be certified as a file.

Can an employer record an investigation interview?

In many jurisdictions an employer can, as long as everyone is told before the recording starts. Consent is a weak legal basis in employment because of the imbalance between the parties, so the employer should set the legal basis, purpose and retention period with its DPO or counsel, and collect consent where local law or policy requires it. Our analysis of recording a meeting without consent covers the GDPR side.

Interviews held online

For an employee investigation run over video, paste the meeting link into the Portal or the app and a TrueScreen virtual assistant joins. Participants must admit it, it records audio and video, and certification starts when the meeting ends. A meeting that has already ended can’t be certified; an optional transcript arrives afterwards in PDF and JSON, never live. The organizer informs participants and collects consent where required. More on online meeting certification and certified meetings in employment disputes.

How is evidence in an internal investigation certified?

TrueScreen, the Data Authenticity Platform, certifies chats, emails, photos, videos and online meetings with a forensic acquisition sealed by an official digital seal and a qualified timestamp, recognized internationally. The seal is a qualified electronic seal and the timestamp a qualified electronic timestamp under the EU eIDAS Regulation (No 910/2014), and anyone can verify the package with standard tools.

Certification records how and when each item was captured; whether the conduct is misconduct is for the employer, and later the tribunal, to decide.

Chats and emails

Chat certification is the forensic acquisition of a conversation as it appears on screen: the TrueScreen App records the phone while you scroll, and the Forensic Browser captures WhatsApp Web with attachments and network traffic. With Mail Certification, you forward a message or copy the workspace’s dedicated address, with nothing to install, and TrueScreen certifies only emails from senders enabled for that address; the original is kept as .eml, each attachment gets a SHA-256 fingerprint, and the report includes SPF, DKIM and DMARC results and all original headers.

Legal value and limits

Content certified with TrueScreen carries full legal and evidentiary value worldwide, evaluated case by case: admissibility and weight vary by jurisdiction, and no outcome is guaranteed. Under eIDAS a qualified timestamp or seal has no fixed expiry: validity is assessed when the evidence is checked, and long-term verifiability can be renewed through re-timestamping and preservation.

Tampering is prevented during acquisition and detectable afterwards, but certification guarantees the how, not the what: a certified photo proves when and where it was taken, not what the scene means. Any evidence can be challenged, and certification doesn’t replace a forensic expert. In the supervisor’s case, counsel checks the certified photos, the online interview and the signed notes before the first disciplinary step.

Conclusion