She needs to subpoena the CCTV footage from all cameras 1 hour before the incident and 1 hour after the incident. If this chain has a red star in their logo, you need to move fast, they don't save footage that long. They also usually have CCTV in the camera control room and the holding area. It is key to obtain all footage.
She will also need to subpoena the employee who helped her out and have her deposed and/or testify on her behalf.

