Material on this website is © 2012 Deloitte Global Services Limited, or a member firm of Deloitte Touche Tohmatsu Limited, or one of their affiliates. See Legal for copyright and other legal information.
Deloitte refers to one or more of Deloitte Touche Tohmatsu Limited, a UK private company limited by guarantee, and its network of member firms, each of which is a legally separate and independent entity. Please see deloitte.nl/about for a detailed description of the legal structure of Deloitte Touche Tohmatsu Limited and its member firms.
In The Netherlands the services are provided by independent subsidiaries or affiliates of Deloitte Holding B.V., an entity which is registered with the trade register in The Netherlands under number 40346342.
Forensic Intelligence and Forensic InvestigationFact finding in digital and paper documents |
Abstract
In a fraud investigation the use of digital forensic expertise and our forensic laboratory helped investigators find unrelated information en correlate events relating to the activities involved in the fraud.
Challenge
To find facts relating to financial fraud in an organization where management was suspected of defrauding the company. Three members of management were suspected of conspiring to defraud the company. The fraud consisted of fraudulent declarations, kick backs and financial misstatements. A preliminary investigation showed that digital information was deleted one week prior to the start of the investigation.
Approach
At the beginning of the investigation we made exact digital copies (images) of personal computers of employees suspected of any involvement. We also copied personal space and company wide server data and contents of e-mail boxes. We analyzed the files, undeleted any information available, cracked documents and analyzed log files. All information is then fed into the case specific forensic intelligence database. This database is a searchable collection of information. The database is searchable for the investigators.
Solution
Our investigating team queried the database on-line and found electronic documents, paper documents and e-mails relating to suspected events. Based on the contents, location or sender and receiver addresses new searches were initiated and the investigators found more facts otherwise not easily detected. The investigation also showed that deliberately deleted documents - just days before the investigation started - were easily recovered, because copies of the documents were send by E-mail, stored on the network or found in the PC as print files. Our approach to collecting electronic files, E-mails messages and paper documents and analyze all these different types of information has helped the team to find more facts in less time.