Finding evidence is Wilsberg's daily bread. But obtaining evidence to prove an employee's theft is not.