Gathering physical, documentary and electronic evidence

By the afternoon of the first day, Elena's team had a folder of witness statements, about 80 photographs and a rough sketch. Those told them what the scene looked like. They did not yet explain why the warning light was dark, why the walkway was blocked, why Jordan was reversing out of a lane that had not existed a month earlier, or why two earlier near misses had changed nothing. Answers to questions like those come from the rest of the evidence: the equipment, the records and the data that every modern workplace generates.

This lesson covers the three types of evidence that do not talk: physical evidence (parts and position), documentary evidence (paper and its electronic equivalents) and electronic data from machines and systems. It also covers how to handle evidence so that it stays reliable, including labeling, storage and chain of custody. Interviews, the fourth type of evidence, have their own lesson.

Physical evidence

Physical evidence includes the equipment involved, any parts that failed, the materials being handled, personal protective equipment, tools, and the condition of the workplace: floors, lighting, guarding, signs, markings and housekeeping. It also includes position: where every relevant object and person was at the moment of the incident. Physical evidence is valuable because it does not forget or change its story, but it can be moved, cleaned, repaired or thrown away, so it must be protected early.

At aisle 14, Luis Ortega examined the forklift with the investigation team watching. The truck was a counterbalance model with a cold-storage package: a heated cab, a reversing alarm and a blue warning spotlight mounted at the rear that projects a dot on the floor several meters behind the truck when it reverses, to warn pedestrians. The reversing alarm worked. The blue light did not. When Luis opened its connector, he found corrosion on the pins and a film of ice inside the housing. Moisture from repeated trips between the warm dock and the freezer had condensed in the connector and then frozen. The light had not been switched off. It had failed.

The team then examined everything else in the area. The convex mirror at the aisle end was frosted over and had no heater. The painted pedestrian walkway along the far side of the travel aisle was faded near the staging lane, and a stack of about thirty empty pallets, roughly two meters high, sat across it. The overhead lights in that section were on their night setting. Luis measured the light level with a meter at floor height: about 60 lux in the travel aisle, compared with about 150 lux when he returned during the day shift. Sam pointed out that the freezer evaporator fans above aisle 14 were loud; Luis took a sound level reading of 84 dBA at the aisle end.

Marie's personal protective equipment told its own story. She had been wearing the standard freezer suit, which is dark blue, with the hood up and a fleece neck warmer, and safety boots with steel toe caps. She had no high-visibility vest, because the standard vests did not fit over the bulky freezer suits and pickers had stopped wearing them in the freezer months earlier. The steel cap had protected her toes; the wheel had crushed the bones behind it.

Documentary evidence

Documents show how work was supposed to happen and, often, how it actually happened. Useful documents in most investigations include written procedures and work instructions, risk assessments, training and competency records, maintenance and inspection records, pre-use checklists, previous incident and near-miss reports, shift schedules and staffing levels, production targets, change records, purchase orders, contracts with suppliers and agencies, and the minutes of safety committee meetings. Elena's rule is to ask for more than seems necessary, because the document that matters is often the one nobody thought was relevant.

The documents for aisle 14 filled in several gaps. The pre-use checklist for Jordan's forklift had been signed every shift for the previous two weeks, including the night of the collision, with every box ticked 'OK'. But the checklist had no line for the blue warning light, which had been added to the trucks the year before; nobody had updated the form. The maintenance request system showed that a day-shift driver had reported the light as 'not working' six days earlier. The request was marked 'parts on order'. Nobody had taken the truck out of service or told the night shift.

Jordan's training file contained a certificate from the staffing agency showing he had completed forklift operator training, a one-day agency safety orientation, and a four-hour site familiarization at Harrowgate Foods Inc. covering the building layout, emergency exits and the freezer rules. It did not include a practical evaluation on the site's own trucks or routes, which Harrowgate Foods Inc.'s procedure required within the first week. The space for the evaluator's signature was blank.

The site's change records were thin, but Grace found an email from five weeks earlier. A new customer had started shipping through the distribution center, and to handle the volume, operations had converted the end of aisle 14 into a temporary staging lane for outbound pallets. The email said 'temporary, about four weeks'. It said nothing about traffic flow, pedestrians, sightlines or the walkway on the far side of the aisle. The safety committee minutes for the following month did not mention the change. Harrowgate Foods Inc. had a management of change procedure, but it was written for equipment changes at the manufacturing plants and had never been applied to a layout change in a warehouse.

Finally, the near-miss log showed the two earlier reports from aisle 14, both from pickers, both describing a forklift reversing out of the new staging lane and stopping close to them. Both had been closed within a day by the night supervisor with the action 'drivers reminded to look behind'.

Electronic data

Modern equipment and systems record a great deal of data that can reconstruct an incident with a precision no witness can match. Forklifts increasingly carry data loggers or telematics units that record operator log-ins, speed, impacts, seat-belt use and pre-use check completion. Warehouse management systems record every scan, pick and task assignment with a time stamp. Building systems record door openings, lighting settings and temperatures. Security cameras record video. Phones and radios record calls and messages. Each of these sources needs to be identified and saved quickly, because many overwrite themselves.

The forklift's data logger showed Jordan logged in at 10:58 p.m., an impact sensor event at 2:14:52 a.m., and a reversing speed of about 6 kilometers per hour in the seconds before the impact, well within the site's 8 kilometer per hour limit in the freezer. The camera footage from the staging lane showed the truck reversing out in a smooth arc into the travel aisle, and Marie walking along the travel aisle toward the dock, head down, scanning a label on a pallet as she walked, her hood up. She entered the frame about four seconds before the impact. Neither looked toward the other.

The warehouse management system added the context that the video could not. At 1:52 a.m., Jordan's task screen had shown an urgent replenishment: twelve pallets for a customer truck booked to leave at 3:00 a.m., marked with a red priority flag. At 2:06 a.m., the dispatcher had sent a message to all drivers in the freezer: 'need lane 14 cleared by 2:30 for the 3:00 truck'. Marie's pick list for the same period routed her through aisle 14 to the dock three times, because the system planned the shortest walking path and did not know about the staging lane. Neither worker was doing anything unusual. Both were doing exactly what their screens told them to do.

Electronic evidence has to be collected carefully. Export it in its original format where possible, along with any information about when and how it was recorded, and keep a note of who exported it and when. Check that clocks on different systems agree; the security cameras at the distribution center were running 47 seconds behind the forklift data logger, which Luis worked out by matching the moment the truck stopped. If data is printed or screenshotted, keep the original file too. And record the settings that affect what was captured, such as the camera retention period and the logger's speed threshold.

Handling evidence properly

Evidence is only useful if people can trust that it is what the investigators say it is and that it has not been altered. That trust comes from careful handling. Every item removed from the scene should be labeled with a number, a description, where and when it was found, and who collected it. It should be stored securely, protected from damage and further change. The movement of each item should be recorded in a simple chain of custody log showing who had it, when and why.

Luis removed the corroded connector from the warning light, put it in a sealed plastic bag, labeled it E-07 and recorded it in the evidence log. He did not try to clean it. Marie's cut freezer boot became E-03, kept in a cardboard box in Elena's office. The original pre-use checklists became E-11; Elena photographed them and gave copies to the team, but kept the originals locked away. Documents and data that could be changed later, such as the maintenance request record, were exported and saved the same day.

Some investigations, especially after a death or a serious injury that might lead to litigation, are coordinated with the company's legal counsel, and investigators may be advised about how to organize notes and reports. That is a legal question beyond this course. Whatever the arrangement, OSHA compliance officers can request documents during an inspection, and nothing an employer does should obstruct them or alter records. Elena gave the officer copies of everything she requested and kept a list of what was provided and when.

Facts, inferences and gaps

As evidence comes in, it helps to sort it into three columns. Facts are things the evidence directly shows: the light connector was corroded; the walkway was blocked; the logger recorded an impact at 2:14:52. Inferences are conclusions drawn from facts: the light had failed at least seven days earlier, because even the oldest saved footage, from seven nights before, showed the truck reversing without a blue dot. Gaps are questions the evidence cannot yet answer: had Jordan been told how the blue light worked and what it was for? Did any supervisor know the walkway was blocked?

Keeping inferences separate from facts protects the investigation from its own momentum. Early in an investigation, teams form a theory and then tend to notice evidence that fits it and overlook evidence that does not. Writing gaps down as questions gives the team a list of things to check in interviews, which is where lesson 6 picks up.

Keeping a chain of custody

Elena keeps a simple evidence log as a spreadsheet. A short script checks it for the two most common problems: items with no recorded collector, and gaps where an item's custody is not accounted for.

# Evidence log for the aisle 14 investigation (simplified).
# Each movement: (item, from_person, to_person, time)
movements = [
    ("E-03 boot",          "paramedic", "Ken",   "02:40"),
    ("E-03 boot",          "Ken",       "Elena", "03:25"),
    ("E-07 light connector", "",        "Luis",  "11:10"),
    ("E-07 light connector", "Luis",    "Elena", "11:45"),
    ("E-11 checklists",    "dock office", "Elena", "09:05"),
    ("E-11 checklists",    "Grace",     "Elena", "15:30"),
]
holder = {}
for item, frm, to, t in movements:
    if not frm:
        print(f"{t} {item}: no collector recorded")
    elif item in holder and holder[item] != frm:
        print(f"{t} {item}: gap, last held by {holder[item]}, now from {frm}")
    holder[item] = to
print("current holders:", holder)

11:10 E-07 light connector: no collector recorded
15:30 E-11 checklists: gap, last held by Elena, now from Grace
current holders: {'E-03 boot': 'Elena', 'E-07 light connector': 'Elena', 'E-11 checklists': 'Elena'}

The check flagged two entries. The connector had no 'from' entry because Luis removed it from the truck himself; Elena added 'removed from forklift FT-12 by Luis Ortega' to close the gap. The checklists showed Grace handing them to Elena in the afternoon even though Elena had collected them in the morning. Grace had borrowed them to make copies for the safety committee and returned them; that went into the log too. Small gaps like these rarely matter, but in a serious case, unexplained gaps are exactly what an opposing lawyer or a skeptical worker will ask about.