In a world where technology is constantly evolving and being
utilised, computer forensic techniques and E-discovery play an increasingly
important role in forensic accounting. Fraud, in particular, is a problematic
area of crime that commonly requires both computer forensic and forensic
accounting expertise.
E-discovery is the process of identifying, preserving and
presenting electronically stored information that may be relevant to criminal
or civil litigation. In fraud, E-discovery is rapidly being depended on by
forensic accountants and the Court to recover evidence that may not have been
found through analysis of non electrical evidence such as paperwork.
E-Discovery of relevant evidence
Metadata is detailed information stored in relation to an electronic item when it is opened, saved or created by a user on a computer device. Some metadata cannot be viewed without the use of specialised analysis tools. Therefore, it must only be recovered by an experienced investigator using computer forensic techniques.
Metadata is crucial when analysing potentially relevant
items on an electronic exhibit. It can reveal time and date attributes, the
original and last author of an item, its save path, the program used to create
or open the file and more. Dates of access are especially significant due to
their ability to indicate the last time a file or item may have been opened by
a computer user.
Documents located on an exhibit may contain invoice, trading
or bank account details that can ultimately be linked with a suspect or confirm
the innocence of a person. Spreadsheets are a popular and commonly used type of
document for storing financial details that can provide a wealth of information
regarding the activities of a suspect. Upon recovering potentially significant
documents for a fraud case, findings can be sent to a forensic accountant for
further analysis.
Internet history can also provide an investigator with
evidence regarding online banking or other financial activities. When a user
enters form data such as banking details to access their account online, this
information is sometimes stored on the drive in different forms. It is then
possible through use of forensic techniques to identify relevant information
that could be useful to forensic accountants such as sort codes or account
numbers. Internet history records can be attributed to individual users using a
computer system.
Communication between a suspect and others potentially
involved in a fraud case can be uncovered through analysis of instant messaging
programs or Email messages. Instant messaging programs are increasingly popular
and some social networking sites such as MySpace and Facebook incorporate their
own ‘chat’ tools into their websites. In the instance that suspects were
through to have been communicating over social networking sites, it is
sometimes possible to recover fragments of conversation or their online
profiles. Such information could aid a forensic accountant if the conversation
was money or fraud related.
Other instant messaging programs can be installed to a
computer device rather than through an online application. In these instances,
it is sometimes easier to recover conversation logs if they have been saved to
an exhibit. Files can also be transferred between contacts over an instant
messaging client that could potentially aid an investigation if the item is
relevant to the case (invoices, bank statements etc).
Emails provide an examiner with Email addresses that a
suspect has been using as well as detailed correspondence. This correspondence
may be able to confirm whether a person has been posing as someone else,
attempting to involve potential victims into a fraudulent operation or details
of illegal activities. Another aspect of Email includes attachments which may
contain relevant files to a fraud case. In the event that potentially
significant attachments are found, a record should be kept of the Email address
that sent the Email containing the attachment, the recipient of the Email and
what the attachment contained. This detailed summary and the attachments can
then be sent to the forensic account who determines whether they are relevant
or not in terms of finance.
Emails and instant messaging can provide detailed
information on those who may be involved in a fraudulent operation, especially
in situations where invoices or bank account details reveal a different name of
address from that of the original suspect. Although these details may be fake
as part of the operation, such data can still help a forensic accountant piece
together an entire chain of events.
After exhibit investigation
All recovered information is then sent to a forensic accountant for further analysis after it has been exported from the exhibit in a forensically sound manner. If the forensic accountant obtains new information from analysing the electronic items and they suspect that more related data may be located on the drive, the investigator can return to the exhibit and retrieve the information if possible.
Conclusion
Forensic accountancy commonly depends on the expertise of computer forensic investigators to retrieve potentially relevant information to a fraud case from an electronic exhibit. Investigators are able to recover hidden information from an exhibit in a forensically sound manner so that any material retains perfect integrity. An increasing use of technology would indicate that more people will use computer devices and related programs to commit fraud.