Workplace Investigations | Digital Evidence

Who We Work With

HR and People TeamsWhen a complaint or suspicion turns on messages, email or what someone did on a company device.

Employment LawyersEvidence gathered under your instructions, so findings can be kept confidential and relied on if the matter is litigated.

External Workplace InvestigatorsForensic support alongside your interviews: we establish the digital facts, you make the findings.

Boards and Senior LeadersComplaints about executives or directors that need to be handled independently of management.

Typical Matters

→Bullying and harassment. Messages on Teams, Slack, email, SMS and social media, including deleted and edited messages.
→Data taken before resignation. Files copied to USB, personal email or cloud storage, and client lists taken to a competitor.
→Policy and code of conduct breaches. Inappropriate material, misuse of systems and undisclosed conflicts of interest.
→Timesheet and attendance fraud. Logins, device activity and location records compared with hours claimed.
→Misuse of company devices and accounts. Unauthorised access, shared credentials and activity outside work hours.
→Complaints against senior staff. Handled independently, with the evidence preserved before anyone is told.

How We Support the Investigation

We preserve evidence quietly and early, before the person involved is told, so nothing can be deleted in the meantime. Company laptops, phones, mailboxes and collaboration platforms are copied forensically and verified, and the original devices can go back into use.

We report facts, not conclusions about the person. Our findings show what the data establishes and what it cannot, so the investigator or decision-maker can weigh it fairly alongside interviews. Where you want the work kept confidential, we can be engaged through your lawyers.

If the matter goes further, to the Fair Work Commission, a tribunal or court, the same evidence and chain of custody carry through, and we can give expert evidence. See expert witness.

Before You Act

01Don’t Reissue the DeviceLaptops and phones are often wiped and reissued within days of someone leaving. Set them aside instead.

02Keep the Mailbox and AccountsStop the account being deleted, and suspend auto-delete and retention policies for email, Teams and Slack.

03Don’t Investigate It YourselfIT browsing through a device changes dates and can make findings harder to rely on. A forensic copy comes first.

04Write Down the TimelineKey dates, who is involved and what you need to establish. It lets us scope the work on the first call.

Common Questions

Can you examine a company device without the employee knowing?+

Company laptops, phones, mailboxes and collaboration platforms can be copied forensically before the person involved is told, so nothing is deleted in the meantime. Check your IT and privacy policies with your lawyer first.

Can the work be kept confidential?+

Yes. Where you want the work kept confidential, we can be engaged through your lawyers.

Can deleted Teams, Slack or email messages be recovered?+

Often. Deleted and edited messages can survive on devices, in mailboxes and in retention copies. Suspend auto-delete and retention policies as soon as possible.

Do you decide whether the complaint is substantiated?+

No. We report what the data establishes and what it cannot. The investigator or decision-maker weighs it alongside interviews.

Will the evidence hold up at the Fair Work Commission or in court?+

The same evidence and chain of custody carry through to the Fair Work Commission, a tribunal or court, and we can give expert evidence.

Related Services

Corporate and in-house investigations · Computer forensics · Email and cloud forensics · Mobile phone forensics

Digital Evidence for Workplace and Internal Investigations