I would just second the fact that, as a TIXC, you really need a trusted person in your IT department (typically the director of IT) that you often call on to help gather, archive or preserve electronic evidence. Often (perhaps at the very first report of a potential concern) this involves having this IT person start archiving a University employee's email to ensure evidence is not deleted or lost.

Thanks so much, @Ryan! Great point!