Cyber Crime & Forensic Fraud Investigations
Handling and preserving digital evidence
Computer Fraud Investigations in London
Electronic evidence plays a critical role in corporate crime investigation. The proper handling of digital evidence is often the key factor in detecting and halting fraud, recovering losses and assisting legal remedies.
Well intentioned IT departments have been the cause of many cases collapsing very early on as they lack the specific training required to preserve the very fragile forensic artefacts surrounding key data. Simply powering on a Windows computer changes over 600 dates and times, and that’s before any user logs in.
Case study 1
First Response was instructed by a UK subsidiary of a multinational company connected to the motion picture industry. An anonymous email to the parent company named a specific financial controller who, it was claimed had been falsifying sales, purchase and credit notes in order to syphon money from the company over a 3 year period. The email further alleged that the fraudsters had hidden the trail with stock accruals and pre-payments. Prior to a full audit the UK managing director authorised a covert forensic examination of the financial controllers company assets and his data on the company network. Two laptop computers, various removable media and the relevant areas of the server were forensically copied and analysed. The resultant data, including the forensic images was then made available to the auditors to assist their on-going investigation.
Case study 2
An HR Manager asked First Response to assist in a case where an employee was suspected of running his own business in competition with his employer, from his desk. It transpires this is not an uncommon occurrence and we have dealt with many similar incidents since! Analysis of the employees computer, which we accessed covertly over the corporate network provided a detailed chronology of the employee’s activities and uncovered extensive evidence of theft and deception. We provided a full report and briefing to the HR Manager, who was open about her lack of IT awareness – we later assisted with her interview of the employee, interjecting when he attempted to cover his tracks with elaborate technical diversions which the HR Manager couldn’t follow. The employee was immediately dismissed and various company databases were recovered from his home. A brief appeal process began but was quickly dropped once the employee’s legal team saw our report.