Friday 16 August 2013

eDiscovery and Forensic Accounting

In a world where technology is constantly evolving and being utilised, computer forensic techniques and E-discovery play an increasingly important role in forensic accounting. Fraud, in particular, is a problematic area of crime that commonly requires both computer forensic and forensic accounting expertise.
E-discovery is the process of identifying, preserving and presenting electronically stored information that may be relevant to criminal or civil litigation. In fraud, E-discovery is rapidly being depended on by forensic accountants and the Court to recover evidence that may not have been found through analysis of non electrical evidence such as paperwork.

E-Discovery of relevant evidence

Metadata is detailed information stored in relation to an electronic item when it is opened, saved or created by a user on a computer device. Some metadata cannot be viewed without the use of specialised analysis tools. Therefore, it must only be recovered by an experienced investigator using computer forensic techniques.

Metadata is crucial when analysing potentially relevant items on an electronic exhibit. It can reveal time and date attributes, the original and last author of an item, its save path, the program used to create or open the file and more. Dates of access are especially significant due to their ability to indicate the last time a file or item may have been opened by a computer user.

Documents located on an exhibit may contain invoice, trading or bank account details that can ultimately be linked with a suspect or confirm the innocence of a person. Spreadsheets are a popular and commonly used type of document for storing financial details that can provide a wealth of information regarding the activities of a suspect. Upon recovering potentially significant documents for a fraud case, findings can be sent to a forensic accountant for further analysis.

Internet history can also provide an investigator with evidence regarding online banking or other financial activities. When a user enters form data such as banking details to access their account online, this information is sometimes stored on the drive in different forms. It is then possible through use of forensic techniques to identify relevant information that could be useful to forensic accountants such as sort codes or account numbers. Internet history records can be attributed to individual users using a computer system.

Communication between a suspect and others potentially involved in a fraud case can be uncovered through analysis of instant messaging programs or Email messages. Instant messaging programs are increasingly popular and some social networking sites such as MySpace and Facebook incorporate their own ‘chat’ tools into their websites. In the instance that suspects were through to have been communicating over social networking sites, it is sometimes possible to recover fragments of conversation or their online profiles. Such information could aid a forensic accountant if the conversation was money or fraud related.

Other instant messaging programs can be installed to a computer device rather than through an online application. In these instances, it is sometimes easier to recover conversation logs if they have been saved to an exhibit. Files can also be transferred between contacts over an instant messaging client that could potentially aid an investigation if the item is relevant to the case (invoices, bank statements etc).

Emails provide an examiner with Email addresses that a suspect has been using as well as detailed correspondence. This correspondence may be able to confirm whether a person has been posing as someone else, attempting to involve potential victims into a fraudulent operation or details of illegal activities. Another aspect of Email includes attachments which may contain relevant files to a fraud case. In the event that potentially significant attachments are found, a record should be kept of the Email address that sent the Email containing the attachment, the recipient of the Email and what the attachment contained. This detailed summary and the attachments can then be sent to the forensic account who determines whether they are relevant or not in terms of finance.

Emails and instant messaging can provide detailed information on those who may be involved in a fraudulent operation, especially in situations where invoices or bank account details reveal a different name of address from that of the original suspect. Although these details may be fake as part of the operation, such data can still help a forensic accountant piece together an entire chain of events.

After exhibit investigation

All recovered information is then sent to a forensic accountant for further analysis after it has been exported from the exhibit in a forensically sound manner. If the forensic accountant obtains new information from analysing the electronic items and they suspect that more related data may be located on the drive, the investigator can return to the exhibit and retrieve the information if possible.

Conclusion

Forensic accountancy commonly depends on the expertise of computer forensic investigators to retrieve potentially relevant information to a fraud case from an electronic exhibit. Investigators are able to recover hidden information from an exhibit in a forensically sound manner so that any material retains perfect integrity. An increasing use of technology would indicate that more people will use computer devices and related programs to commit fraud.