Digital Forensics In Corporate Fraud Investigations

CORPORATEFRAUD · AGUIDEFORUKLAWYERS Digital Forensics in Corporate Fraud Investigations Following the Money, the Documents and the Deception Through the Estate COMPUTERFORENSICSLAB § ABOUTTHEAUTHOR PRE PA REDBYCOMPUTERFORENSICSLABE - DISCOVERYTEAM FINANCIAL-SYSTEMS FORENSICS CPR PART 35 EXPERT REPORTS FULL CHAIN-OF-CUSTODY DOCUMENTATION § CONTENTS In this guide 01 Executive summary 02 The problem in plain English: fraud is documented by its own machinery 03 The fraud-pattern evidence map: schemes and their artefacts 04 The covert phase: preserving without alerting 05 Financial-systems forensics: ERP, accounting data and the communications join 06 Document authenticity: fabrication, backdating and alteration exposed 07 Deployment: civil, criminal, regulatory and the sequencing problem 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist § 0 1 · ORIENTATION Executive summary THEHEADLINEPOINT : FRAUDINVESTIGATIONSSUCCEEDBYJOININGTHREERECORDS THEFRAUDSTERKEPTSEPARATE : THEMONEY ' STRAILINTHESYSTEMS , THE DOCUMENTS ' TRUEHISTORYINTHEIRMETADATA , ANDTHECOMMUNICATIONSAROUND BOTH : PRESERVEDCOVERTLY , JOINEDFORENSICALLY , DEPLOYEDINTHERIGHTORDER § 0 2 · FIRSTPRINCIPLES The problem in plain English: fraud is documented by its own machinery § 0 3 · THEMAP The fraud-pattern evidence map: schemes and their artefacts § 0 4 · THEQUIETFORTNIGHT The covert phase: preserving without alerting § 0 5 · THEMONEY ' SOWNRECORDS Financial-systems forensics: ERP, accounting data and the communications join § 0 6 · THEQUESTIONEDDOCUMENTS Document authenticity: fabrication, backdating and alteration exposed § 0 7 · THEAUDIENCES Deployment: civil, criminal, regulatory and the sequencing problem § 0 8 · THEWIDERMAP Source architecture: where else the evidence lives QUESTION MESSAGING FINANCIAL PLATFORM COUNTERPART Y REGISTRIES / DELETED/ SYSTEMS LAYER RECORDS OSINT RECOVERABLE DEVICE / LAYER § 0 9 · INTHEWILD Worked examples EXAMPLE1 · THEVENDORTHATSHAREDASORTCODE EXAMPLE2 · THECOVENANTCERTIFICATEBUILTINONEEVENING EXAMPLE3 · THEMANDATECHANGENOBODYVERIFIED § 1 0 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations § 1 1 · INTERROGATORIES & DRAFTINGAIDS Questions to ask · Suggested wording Ask your client Ask your opponent (in ensuing proceedings) Ask your eDiscovery / forensic provider SUGGESTEDWORDING · INSTRUCTIONFORAFRAUDINVESTIG AT ION § 1 2 · QUICKCONTROL Checklist and red flags · When to involve a digital forensic expert The fraud-investigation checklist Red flags When to involve a digital forensic expert § 1 3 · COMMONQUESTIONS Frequently asked questions We suspect fraud but are not certain. Should we investigate before involving lawyers? How do we investigate without the suspect finding out? Can forensics really prove a document was backdated or fabricated? Should we report to the police, and when? The books themselves may be doctored. What can we trust? How fast can freezing-order evidence be ready? § 1 4 · REFERENCE Glossary Sources and authoritative references DISCLAIMER § HOWASPECIALISTLABORATORYCANASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY