Use case
Workplace misconduct investigations.
Harassment, time theft, policy violation, misuse of company resources. We surface the digital evidence the HR file needs.
Signs you may need this
Common indicators we hear from counsel and corporate clients.
- Allegations of harassment via company systems
- Inappropriate content on a work device
- Policy violations involving email or messaging
- Whistleblower complaint with a digital component
- Conflicting accounts requiring objective evidence
Scope of this work
What we cover and what we typically find.
- Email, Slack, and Teams message threads relevant to the complaint, with metadata to authenticate them.
- File access patterns and login records that establish what an employee did, when, and from where.
- Browser activity and downloaded content where misuse of company resources is at issue.
- Application usage records and timestamps that support time-theft or productivity analysis.
- Personal-account activity on company devices where the matter touches BYOD or shared resources.
How we approach it
A defensible, repeatable process.
- Scope with HR, counsel, and the security team. Define exactly what is in scope and what is not.
- Preserve relevant endpoints, mailboxes, chat history, and audit logs immediately.
- Examine the artifact set with documented methodology, working within PIPEDA and BC PIPA constraints.
- Report findings with a timeline, exhibit indexing, and a clear methodology disclosure.
What we deliver
Concrete outputs from a typical engagement.
- 01
Forensic image of relevant devices and accounts
- 02
Communication recovery and analysis
- 03
Timeline of events with chain-of-custody
- 04
Examiner report suitable for HR or arbitration
- 05
Expert testimony if matter proceeds
- A preserved evidence set covering all in-scope sources.
- A written examiner report tying findings to specific artifacts and timestamps.
- An exhibit index for HR or counsel use.
- Affidavit support if the matter moves to a labour board, civil court, or arbitration.
- A chain-of-custody record from intake through archive.
Services typically engaged
Forensic services we draw on for this scenario.
Computer Forensics
Forensic imaging and analysis of Windows, macOS, and Linux systems for litigation, internal investigations, and expert witness work.
Learn moreMobile Forensics
iOS and Android extraction including chip-off, JTAG, and ISP techniques for damaged or locked devices that conventional tools cannot read.
Learn moreCloud Forensics
Defensible collection and analysis of Microsoft 365, Google Workspace, AWS, Slack, Teams, and Salesforce evidence under legal hold.
Learn moreExpert Witness
Court-qualified expert witnesses delivering affidavits, expert reports, and trial testimony in Canadian civil and criminal matters.
Learn moreCommon questions
Workplace Misconduct questions we hear most.
Can we examine an employee's communications without telling them?
Often yes, on company-issued devices and accounts where there is a legitimate workplace purpose. PIPEDA and BC PIPA constrain the scope of access. We design every engagement to fit those constraints.
Can you work on an active complaint without compromising fairness?
Yes. Workplace investigations require fairness to both sides. Our forensic record is independent of the outcome; the report documents what we found and the methodology that surfaced it. Counsel and HR handle the fairness analysis.
What if the complaint involves a personal device?
BYOD adds constraints. The employee retains a privacy interest in personal content even on a device used for work. Forensic access is usually limited to work-related apps and accounts. We design BYOD engagements to fit that constraint.
Can the report support a wrongful dismissal defence later?
Yes, when the engagement is structured to that standard from the start. Defensibility, chain of custody, and methodology disclosure all matter. We work to that standard regardless of expected outcome.
Related scenarios
Other use cases that often arise alongside this one.
Have a workplace matter that needs forensic evidence?
Tell us about the situation. Our team will reach out as soon as possible.