Short answer: Preserve the evidence before you do anything else. Secure the records and devices, stop any routine deletion, and don't open, copy or “check” files yourself — because simply looking can change a file's history and weaken it as evidence. Confrontation comes last, not first.

By the time an owner is ready to confront someone, the damage to the evidence is often already done — not by the employee, but by the well-meaning boss who spent the weekend going through files. Here's how to keep what you'll need.

Why evidence is more fragile than it looks

Digital evidence carries its own history. A file records when it was created, last modified and last opened, and what produced it. That history is often the whole point — it can show a document was back-dated or altered. But opening a file, copying it, or logging into an account updates those timestamps. Do it casually and you can overwrite the very detail that proved your case, and you hand the other side an easy argument that the evidence was tampered with.

What to preserve, and how

  • Company devices and accounts. Laptops, phones, email and file-sync accounts the person used. Secure them; don't start browsing them.
  • Financial and system records. Accounting data, ledgers, approval logs, access logs — exports and backups, kept intact.
  • Backups. Suspend any automatic purge or overwrite cycle so nothing rolls off while you're deciding what to do.
  • Physical documents. Invoices, contracts, notes — kept as originals, not annotated.

Where a device or account is likely to be central, the clean approach is a forensic image: an exact, verified copy taken so that work is done on the copy and the original is never altered. That's the standard digital forensics exists to meet.

The mistakes that destroy a case

  • Logging into the employee's accounts to “have a look”.
  • Forwarding or printing files to build your own bundle.
  • Letting IT wipe or reissue a device before it's imaged.
  • Deleting or moving files to “secure” them.
  • Confronting the person while systems are still open to them.

Why sequence matters

Preserve, then examine, then decide, then act. Confrontation is a doorway that only opens one way — once the employee knows, evidence can vanish and stories can align. Everything you might later want, whether for a recovery claim, a police referral or a defensible dismissal, depends on the material you locked down before that door opened.

Frequently asked questions

Can't I just screenshot everything as proof?

Screenshots can help, but they're weak on their own — easily disputed and stripped of the underlying metadata that makes evidence persuasive. Preserving the source records is what holds up.

Does opening a file really change the evidence?

It can. Access and modification timestamps update, and on shared systems other processes may write to the file too. That's why examination is done on a forensic copy, not the original.

How quickly do I need to act?

Preservation is urgent; confrontation is not. Secure the records and backups as soon as you have a genuine concern, then take your time on the decisions.

This article is general information, not legal advice. If you think you'll need the evidence to stand up, preserve it properly before you touch it — we can help you do that quietly. Start a confidential conversation.