How to Preserve Original Messenger and Email Evidence in Harassment Investigations

📌 Principles to determine first

Rather than simply preserving messenger and email data by pasting screenshots, you must record the original format, collection path, time of collection, and the person in charge. By maintaining the originals exactly as they are and performing marking, masking, and alignment only on the copies for review, you can reduce content omissions and controversies regarding editing during the investigation process.

This article focuses on the stage of initially securing digital evidence and transferring it to the investigation file after a report is received, rather than the long-term retention period or access rights of investigation materials in general. Unlike the previously published 'Standards for Access Rights and Retention of Investigation Materials,' the key elements are collection, originality, and version linking.

🧭 1. Narrow the scope of your evidence preservation request first.

Requiring the whistleblower to submit all messenger and email communications may result in the excessive collection of private data and third-party information. We first verify the duration, channel, participants, expressions related to the claims, and the scope of attachments of the conversations in question, and then request only the necessary scope.

If there is a high probability of deletion or account access is about to be terminated, the date of the retention request and the target system are recorded first. However, the company must not access personal accounts or personal devices without authorization, and must verify the employment rules, information protection regulations, consents, and scope of authority.

💾 2. Separate the original from the review copy.

The original file is saved in a read-only location immediately after acquisition and is not arbitrarily renamed or resaved. Highlights, translations, explanatory notes, and privacy masking marked by the investigator are performed on a separate copy for review.

The source folder contains original files, export results, attachments, and collection records, while the review folder contains excerpts by issue and interview materials. Between the two folders, a comparison table linking the original filenames and the review filenames is maintained.

✉️ 3. Please check the information in the email body as well.

If you capture only the visible body of an email, the sender and recipient addresses, time of dispatch, CC recipients, attachments, and delivery path may be omitted. If possible, use the original download or export functions provided by the system; if these are not available, record the entire header and attachment list separately.

Since the delivered email may become mixed with the initial message during the delivery process, the start and end of the thread, as well as any missing parts, are checked. Attachments are linked to the same case number to ensure they are not separated from the email, and the original files are preserved even for those that do not open before arbitrary conversion.

💬 4. Please leave the context in messenger conversations.

If you submit only a single cut-out sentence, it is difficult to determine the order of the conversation, the intervals between responses, the participants, and whether deletion was necessary. Ensure that the necessary context before and after the issue, channel name, participants, date, and time are visible, while hiding irrelevant conversations from the review version.

If there are multiple captured images, the order is displayed and duplicate or missing sections are checked. If possible, the exported file and the screenshots are saved together, and information that affects the meaning, such as emoji reactions, replies, and edit indicators, is also retained.

🔐 5. Fill out the collection record sheet.

You must record who requested what materials from whom, when, and how they were received to explain the flow of the research data. Even if the content of the files appears identical, they should be managed as separate items if the submitter, collection time, or path differs.

When using technical verification methods such as hash values, the calculation tool and the time of generation are recorded. Even without technical verification, the priority is to consistently operate procedures for preserving the original, recording access logs, version comparison, and prohibiting alterations.

👥 6. Connect submitter verification with an interview

We do not determine the meaning of the content solely based on the fact that the materials have been received. During the interview with the submitter, we verify the circumstances under which the materials were generated, the participants in the conversation, the possibility of omissions, the out-of-screen context, and the meaning of the attachments.

When presenting materials to the opposing party, unnecessary third-party information and the need to protect the whistleblower are considered. While guaranteeing an opportunity for rebuttal, the unconditional reproduction and distribution of the entire original document are avoided, and the scope necessary for the purpose of the investigation is determined.

For example, if a complainant claims that the team leader repeatedly sent insulting messages after a meeting, we do not simply accept a single screenshot containing the insulting expression. We verify the meeting date and time, when the message was initiated, the channels involved, replies and follow-up instructions, and the existence of relevant work materials, and determine the necessary timeframe. We assign a number to each piece of secured material, such as E-01 or E-02, and record in a comparison table how it relates to the alleged complaint.

If the accused submits a separate email thread or a pre-revision file, neither document is immediately selected as the final version. The creation time, recipient, delivery path, and attachment version of each document are compared, and the discrepancies are converted into interview questions. While the fact that the content conflicts is recorded, definitive expressions such as "manipulation" or "concealment" are not used in filenames or meeting materials until an investigation conclusion is reached.

Reviewing the internally shared copy within the investigation team is facilitated by indicating an index by issue, document number, and page or message location. However, documents with conversation content re-entered for convenience cannot replace the original. The summary table must link the location of the original with the date verified by the reviewer, and a second person in charge should compare it to ensure that citations match the original text.

After the investigation is completed, check whether any files remain in the personal PC download folder, email drafts, printouts, or messenger transmissions. Official originals and investigation records that must be preserved are gathered in an approved location, while temporary copies are organized in accordance with company regulations. The retention period and decision regarding disposal are determined separately, taking into account the nature of the case, potential for disputes, employment rules, and legal review.

To secure data using the administrator functions of a collaboration tool, a company must first verify the permissions and purpose for using those functions. The IT representative receiving the investigation request does not need to know the conclusion of the case; they extract only approved items from the designated period and account and securely deliver the results to the investigator. The fact that the inquiry was conducted with administrator privileges, the scope of the inquiry, the extraction method, and failed items are recorded in the collection log.

For accounts of employees scheduled to leave, review both the necessity of retention and the account termination schedule. Rather than simply keeping the account active, transfer necessary data to an approved repository and minimize access permissions. If the system is subject to automatic deletion or retention policies, record the policy name and expiration date, and verify with the IT administrator that the retention measures have actually been applied.

If voice messages, meeting recordings, or text within images are involved in the issue, the file format and playback environment must also be recorded. While audio may be transcribed into documents or translated into foreign languages ​​for the convenience of the investigation, the transcriber, date of creation, and location of the original source must be indicated on the transcript or translation. Expressions with unclear meanings should not be arbitrarily determined by the translator but must be verified during the interview in conjunction with the original text.

In the evidence list, the status of each document can be indicated as 'Original verified,' 'Copy secured only,' 'Verified solely by submitter's statement,' or 'Requesting additional materials.' This allows investigators to assess the necessity of supplementation without mistakenly assuming all materials have the same level of reliability. For documents that could not be secured, the request date, the reason for non-securing, and the alternative verification method are also recorded.

In the investigation results report, source numbers are cited only to the extent necessary, and the entire original text is not repeated. The sentences used for judgment, their context, and their relationship with other interviews and regulations are explained, and parts that cannot be verified solely from the data are marked as limitations. The mere existence of digital records does not automatically determine the operational necessity of the act, the power dynamics of the relationship, or the presence of distress.

When notifying the complainant and the respondent of the deadline for submitting materials, the channels and formats for submitting additional materials are also provided. If new materials are submitted late, existing material numbers are not reused; instead, a new number and receipt date are assigned. For materials submitted immediately before the conclusion of the investigation, their relevance and the opportunity for the opposing party to verify them are reviewed before excluding or accepting them as is.

⚠️ 7. Common Errors

The most common errors are deleting the original while keeping only the screenshot, the investigator directly highlighting the original file, separating attachments from the email to lose the source, and failing to record the submission path and time.

In addition, definitively changing file names to 'evidence of harm' or sending materials to all investigation participants before verifying the facts may compromise objectivity and confidentiality. Use neutral case and material numbers and restrict access to the minimum number of personnel involved.

✅ 8. Final inspection before commencing the investigation

The investigator checks the preservation status of the original, markings for the reviewed version, missing sections, links to attachments, masking of personal information, and verification of viewing permissions and the submitter. If the materials are incomplete, their limitations must be specified in the investigation record and evaluated in conjunction with other interviews and documents.

🔗 Related Nudge EAP Guide

❓ Frequently Asked Questions

📚 Source and Information