Name three common sources of digital evidence in a corporate investigation.

• A. Email, file shares/servers, and endpoint devices (PCs/phones)
• B. Social media, printed documents, and conference room cameras
• C. Public websites, press releases, and marketing brochures
• D. Video surveillance, notebook diaries, and spoken interviews

Answer: (A)

Digital evidence in corporate investigations comes most reliably from internal IT data sources that document communications, data storage activity, and user actions. Email captures messages and attachments and carries metadata like timestamps, recipients, and threads, which helps establish who communicated with whom and when. File shares and servers hold documents, version histories, access logs, and permission changes, offering a clear record of data handling, file movements, and who accessed what. Endpoint devices such as PCs and phones preserve local files, application traces, browser histories, caches, logs, and other artifacts that reveal user activity and sequence of actions. Together, these sources are widely available across most organizations, under direct control, and rich with time-stamped information that can be used to reconstruct events and verify conduct.

Other sources mentioned—like social media, printed documents, conference room cameras, public websites, press releases, marketing materials, video surveillance, notebooks, and spoken interviews—can be relevant in certain investigations but are either external, non-digital, or not as universally accessible for routine corporate inquiries.