How the reaction becomes the matter
Clearing out a message thread, wiping a phone before handing it over, asking a colleague to remember a meeting a particular way, or giving an investigator an answer that is not accurate can each become the subject of a charge on its own. That can happen even where the underlying inquiry goes nowhere and nobody is charged with whatever was first being looked into. Most of it is not done with any criminal purpose; people tidy up, they get defensive, or they try to be helpful and overstate what they actually remember. The trouble is that from the outside, ordinary housekeeping and deliberate concealment can look much the same, and the explanation has to be reconstructed long after the fact. That is why, on learning of an investigation, the safest thing to do is usually nothing at all until you have advice.
Preserve, and stop discussing it
Preserving means more than simply not deleting. Turn off anything that purges messages or mail automatically, leave routine backups alone, and do not reorganize files, replace a device, or let a retention policy cycle something out while a matter is live. If your employer has issued a hold notice, follow it exactly and ask rather than guess wherever it reads unclearly. At the same time, stop discussing the investigation with colleagues, including the ones you trust and the ones who were in the room, because a conversation meant to compare recollections is easily described afterward as coordinating an account. Private notes to yourself about what you genuinely remember are a different thing, and they are worth making while it is fresh.
Letting counsel make the contact
People often worry that hiring a lawyer, or having one call an investigator, makes them look as though they have something to hide. It does not, and investigators deal with counsel as a matter of course. Once a lawyer is involved, contact can be routed through that person, which takes away the pressure of being asked something in a hallway or on a phone call with no time to think. Being invited in for an interview, being served with a request for documents, and being told you are only a witness are different situations, and it is worth knowing which one you are in before you respond to any of them. If you have been charged with obstruction of justice, or you sense the questions moving that way, the earlier that conversation happens the more room there usually is in how you respond.
