Mobbing and workplace harassment: how to collect digital evidence with legal value

An employee who suffers mobbing or harassment almost always arrives at a lawyer's office with a phone full of proof: screenshots of hostile emails, photographs of chat threads, saved voice messages, maybe a discreet recording of a meeting. The material feels overwhelming. It rarely is, in legal terms.

The reason is uncomfortable. Proof that a person collects about themselves, on their own device, is easy to challenge. Opposing counsel does not need to prove it was manipulated; often it is enough to argue that it could have been, that the date is uncertain, or that the file has no verifiable origin. When that argument lands, months of carefully saved evidence can be set aside before its content is ever examined.

So the real question for anyone documenting workplace abuse is not "how much can I collect?" but "how do I collect it so that it holds?" The answer lies in changing the moment certification happens: not after the fact, but at the instant of capture. This is where a forensic approach to digital evidence in employment disputes makes the difference between a story and a case.

This deep dive is part of our guide to certified employment disputes, focusing on one specific aspect: how to collect and certify mobbing and workplace harassment evidence with legal value.

Why mobbing and harassment evidence rarely reaches court intact

Mobbing and harassment are not proven by a single dramatic message. They are proven by a pattern: repeated, systematic conduct spread over time, a plurality of episodes that are individually minor but coherent when read together. That legal structure has a direct technical consequence. Each episode must be reliably dated and demonstrably unaltered, because the case is built on the sequence, not on any one item.

Self-collected screenshots, chats and emails: the three weak points

Ordinary evidence fails on three fronts. The first is integrity: a screenshot is a picture of a screen, trivial to crop, edit or reconstruct, and it carries nothing that proves its content matches what was really displayed. The second is origin: a photo of a chat does not establish which account sent the message, on which platform, or that the conversation was not staged. The third is date: file metadata can be edited, timestamps depend on device settings, and "last modified" tells a court almost nothing about when the event actually occurred.

Voice messages and audio recordings inherit all three problems and add another. An exported audio file can be trimmed or spliced, and without a sealed reference there is no way to show the version presented in court is the version originally received.

The evidentiary burden of proving the material was not altered

Admissibility of digital evidence generally turns on four qualities: authenticity, integrity, provenance and relevance. Self-collected material is strong on relevance and weak on the other three, which is exactly where disputes concentrate. The practical burden falls on the person making the claim: you must be able to show the material was not altered between the moment of the event and the moment it reaches the file. Screenshots and phone exports cannot carry that burden, because nothing in them is anchored to an independent, tamper-evident reference. Building a sound record of digital evidence in employment disputes starts by closing precisely this gap.

What digital evidence to collect and how to certify it at the source

The fix is not to collect differently in kind, but to certify at the source. Every relevant item should be captured through a forensic methodology that seals it the instant it is acquired, so its integrity and date are fixed before anyone can question them.

Harassing emails, workplace chats, voice messages and recordings: what to preserve

In a harassment or workplace dispute, several categories of material typically matter. Emails carrying threats, exclusion, humiliating instructions or retaliatory decisions, preserved with their headers and any attachments. Workplace chat conversations from internal messaging tools, captured as full threads rather than isolated fragments, so context and chronology survive. Voice messages, which often carry tone and intent that text does not. And recordings of meetings or exchanges where the conduct occurs directly.

The guiding principle is completeness with context: capture the whole item, its metadata and its surroundings, not a cropped excerpt. A single sealed thread showing a month of escalating messages is worth far more than a dozen loose screenshots.

How TrueScreen certifies the evidence: forensic capture, hash, qualified timestamp and chain of custody

TrueScreen acts at the source. It captures the email, conversation, attachment or recording with a forensic methodology, and at the moment of capture it fixes each item with a cryptographic hash and a qualified electronic timestamp. The hash is a digital fingerprint: if a single bit of the file later changes, the fingerprint no longer matches, which makes any alteration immediately detectable.

The qualified timestamp and qualified electronic seal are issued by a qualified trust service provider that TrueScreen integrates via API. Under the eIDAS Regulation (EU) 910/2014, these qualified services carry a legal presumption of integrity and of the accuracy of the date and time. TrueScreen is not itself a trust service provider: it applies a digital seal to your content and binds in the QTSP's qualified timestamp, so the guarantee comes from a recognised third party while the capture stays forensic. Each acquisition also generates a verifiable chain of custody documenting how the item was obtained and preserved. You can see how the platform approaches this at TrueScreen.

From collection to litigation: using certified evidence in workplace disputes

Certified items change what the evidence can do in a proceeding. Instead of defending each screenshot against the suspicion of tampering, the discussion moves to what the messages actually say and what pattern they reveal.

Building a systematic, dated record of the conduct

Because mobbing turns on repetition over time, the goal is a chronological dossier: each certified item carrying its own sealed date, arranged into a timeline that shows escalation and persistence. When every episode is individually anchored to a qualified timestamp, the sequence itself becomes hard to dispute. A defence can contest interpretation, but it can no longer wave away the dates or claim the record was assembled after the fact. The systematic nature of the conduct, the very thing the claim must establish, becomes visible and verifiable.

ISO/IEC 27037 and the chain of custody

Forensic soundness is not improvised; it follows recognised standards. ISO/IEC 27037 provides international guidelines for the identification, collection, acquisition and preservation of digital evidence, and the chain of custody it describes is what lets a court trust that an item is what it claims to be. Capturing evidence in line with ISO/IEC 27037 means each step is documented and each item is traceable from acquisition onward. Combined with the eIDAS presumption of integrity, this gives the record two independent supports: a documented process and a qualified guarantee, both anchored at the source rather than reconstructed later.