DJM is absolutely right....

Even if this is an "internal" investigation if it ends up in any form of disciplinary action then the "offender" might take your company to court... At which point your "internal" investigation is elevated to the level of a full blown forensic investigation... Which neither you or I want to be in the witness chair for...

You need to consult with your administration and determine the best course of action... But be up front with them about _your_ limitations... They need that information because they are going to pay the bill if it ends up in court.