Interview witnesses or suspects

I have to interview a witness about a data breach that happened last month; the security lead wants a clean verbatim transcript for the incident report and the legal team needs any admissions highlighted. Schedule a 45‑minute session with Jordan Patel for Thursday at 10 a.m., ask open questions about what they saw and heard, confirm timestamps, and record the interview only after Jordan signs the consent form — stop and summarize at 15 and 35 minutes to check accuracy.

Before I sit down with a reluctant suspect, make the questions less confrontational and more likely to get usable detail — put the facts we already know first, surface the single inconsistency I should probe, flag where my tone could make them clam up, and suggest two ways to reframe accusatory questions into curiosity that still tests veracity.

I just spoke with Jordan Patel for 20 minutes. Jordan admitted seeing a device in the office but denied touching it; system logs show an unknown login from their workstation at that time. I am worried calling them out will shut down the rest of the testimony and ruin chances to corroborate. I cannot tell whether Jordan is lying, confused, or protecting someone. What is the likeliest explanation and the best next move to get truthful detail without losing access?

Across four interviews over the past six months, witnesses give clear sensory detail but stop short of timeline anchors and decline follow‑up calls, delaying closure and letting evidence go cold. I keep losing momentum when I push for precise times. What single habit should I change in scheduling and question sequence to get time anchors reliably, and how do I implement it starting next week?