As a word of warning I would say If you have to ask these questions, you better not act upon the responses…
Not only will lack of experience, training and equipment possibly damage the evidence or lead to incorrect conclusions, but you being clearly involved in this can easily impair your judgment and opens your case to claims about you not being impartial. Assuming your suspicions are correct, it would be a shame if a well-intended but poorly executed investigation backfires.
Yikes…. a girl turned up to work 1hr 45 mins late and she's got the weight of the computer forensics community bearing down on her. I mean, there are times computer forensics is so important in solving the time discrepency of a suspects movements but wow… being late for work? Just sayin…
Even before reading the OP's reply I would not have a problem using whatever tools I had to get to the truth. Being late is not the issue, lying about it is (certainly would be for me). If an employee lies about something as seemingly insignificant as being late for work, what would this employee not lie about? Honesty, integrity, professionalism and accountability are but some of the virtues that every good employee -has- to have.. if you make a mistake, accept responsibility and move on, but to change the time/date on your system to "prove" deceit? ..thats is more than just a simple lie.
Thanks Forensic Ranger….that's my perspective in a nutshell.