Evidence, Its Collection, Preservation, Analysis, and Introduction at Trial

For the record, what is evidence, anyway? All types of legal matters are pursued based on the amount of available evidence. Evidence is defined as something physical and testimonial, material to an act. In order to pursue any legal action, administrative, civil or criminal, there needs to be a sufficiency of evidence supporting an allegation or complaint.

Evidence is something that must be collected in order to prove an event actually happened. The process by which evidence is collected usually follows one or more of these methods:

• Obtained by means of witness examination or deposition

• Obtained by means of interview or interrogation

• Obtained by means of conducting an inspection

• Obtained by means of legal discovery

• Surrendered to an investigator

• Through a search where authorized consent was obtained

• Obtained through the execution of search warrants

• Obtained by means of legal search without a search warrant

• Through court order or summons

• Obtained through a grand jury subpoena

• Obtained by means of a judicial subpoena

Evidence collection is a science governed by laws and regulations and refined by the courts. Unlike some movies and television shows, investigators, law enforcement authorities, and private investigators cannot legally enter into a room or an office uninvited, without a search warrant, and begin rifling through desks and cabinets, and downloading computers. Acts such as these hold our attention, but have dire consequences for the investigators and their evidence. The reason is simple. The evidence that is seen, seized, or derived from an unlawful search and seizure is considered "fruits of a poisonous tree" and will be excluded from any legal proceedings. In addition to having the evidence excluded from the case, investigators and possibly their managers or departments will be fired and sued into oblivion.

As a matter of course, investigators and attorneys have to answer this question with electronic evidence collection: Do the investigators have the right and authority to search and seize the computer, its contents and media, and search the surrounding area? An organization's policies and procedures likely grant this right. If employees understand and acknowledge that they do not have a reasonable expectation of privacy in the workplace, then the investigator's job is relatively simple. However, even with regard to employees that have waived their reasonable expectation of privacy, it is possible that they might have reserved their right to privacy by exchanging private e-mail, using instant messaging, or installing personal software. If their employer failed to take sufficient steps to discover and preclude these prohibited practices, it may be possible that a reasonable expectation of privacy exists. In such cases, investigators might find they cannot routinely search an employee's workstation, office, or e-mail stored on the company's servers. Regardless, investigators still must be very careful and consult with legal counsel before entering an office or equipment room and begin to search or seize evidence.