Computer forensics

Computer forensics plays a critical role in fraud investigations. Carol Ko talks to industry experts

The digital smoking gun

I t was a BlackBerry that helped prosecutors convict Du Jun, a former Morgan Stanley Asia Ltd.

managing director, in the biggest insider trading case in Hong Kong.

Du was found guilty in September of nine counts of insider dealing involving HK$86 million worth of CITIC Resources Holdings shares and one count of asking his wife to trade in the shares prior to the announcement of an oil asset acquisition deal. During the trial, the Beijing-born investment banker, who was advising CITIC on the deal, denied having read e-mails containing confidential information

involving the company, which he then used to trade in its shares for profit.

But the prosecutor was able to use Du’s BlackBerry logs to prove the e-mails containing confidential information “were opened and scrolled down manually as the recipient read them.” The electronic device eventually became an important part of the prosecution’s case against the banker, who was jailed for seven years and fined HK$23.3 million.

“Without the use of computer forensics and e-discovery techniques, the true nature of this Morgan Stanley employee’s activity may never have

been known,” says Erik Laykin, managing director of the global electronic discovery investigation practice at Duff & Phelps LLC, a New York-based company that provides financial advisory and investment banking services.

“Through the preservation, examination and presentation of forensically preserved e-mail evidence, the prosecution was able to establish the nature of the conspiracy and show how it even included Du’s wife,” he says.

Computer forensics is the branch of forensic science pertaining to legal evidence, such as financial databases,

[ 24 ] A Plus + November 2009

Illustrations by Martin Megino

November 2009 + A Plus [ 25 ]

[ 26 ] A Plus + November 2009

Computer forensics

spreadsheets, e-mails, journals and SMS messages, found in computers and digital storage mediums. It examines the context, the status (active or deleted), location and usage of this evidence, and is a tool used to achieve electronic discovery, which deals with the use of digital information before a trial starts in a lawsuit. As a result, computer forensics and e-discovery usually go hand in hand in the investigations of accounting fraud, but are often misunderstood as having a similar or identical function.

Richard Williams, head of computer forensics business at Deloitte & Touche Financial Advisory Services Ltd. in

Hong Kong, says in many instances, the reconstruction of evidence from fragmented sources can produce what he calls the “smoking gun” for successful prosecutions.

A recent investigation of a U.S. CPA in California found he had established a shadow company bearing the same name as one of his clients in order to skim a big portion of the client’s federal tax refund. For years, the accountant had been stealing several million U.S. dollars from the client by misreporting the true value of the tax refund and depositing the difference in accounts that he controlled with the same name as his client’s firm.

While investigators initially acted on an anonymous tip, it was through the work of a computer forensics team, who performed a detailed analysis of electronic documents, historical records and other preserved materials, that a case was brought against the fraudster.

Computer forensics vs. forensic accounting The job of computer forensics experts is to analyze recovered data and evidence, then match the information found in e-mails against those in spreadsheets to determine if fraud has been committed and if yes, how and by whom, according to Paul Jackson,

November 2009 + A Plus [ 27 ]

chief inspector of forensics and training at the technology crime division of the Hong Kong Police Force.

“Forensic accountants can certainly help to explain the nature of the fraud, but as for [an] understanding of the bigger picture, I think it needs a computer forensics analysis and analysts to be able to look at all the elements of the computer usage that surrounds the fraud,” says Jackson, who is also president of the Asia Pacific chapter of the High Technology Crime Investigation Association.

Electronic evidence including e-mails, user files in the suspect’s computer hard drives, files on the corporate network and any shared work space, and archived data in the back-up system along with relevant financial data in the accounting system should be quarantined and secured by forensic technology, according to Jackson.

Failure to do so will give ammunition to the defence counsel in the face of a court case. He or she “could argue, ‘Well, hang on, you haven’t accounted for every second of your possession of that evidence. And therefore, if you can’t account for it, then theoretically somebody

could have [been] involved with that evidence and changed [it],’” he says.

The chain of evidence collection is crucial in any litigation involving electronic data, as demonstrated by the Morgan Stanley insider dealing case.

“The most important part of the work that I do is the collection [of electronic evidence],” says Alan Jeffries, head of technical services at risk consultancy International Risk Ltd. “If the collection is wrong, or incomplete, or there’s an error, then whatever I find afterwards is of no relevance, as that evidence has reasonable doubt associated with it.”

For Jeffries, the most important questions are: How the information was collected, how it was documented, where the photographs were, and which machines, or computers, held the evidence. The type of software is also important.

John Tudorovic, executive director of forensics at Ferrier Hodgson Ltd., agrees that data should only be acquired by trained and qualified information technology forensics experts. “This ensures data is not altered during the acquisition phase and chain of custody issues are

addressed. This is a critical step if the electronic evidence will be used in any court proceedings,” he says.

“Just switching a machine on will change a lot of time and date stamps on the files,” Jeffries says. “So what we’ll tell our clients all the time is, ‘Don’t get your IT people to look at it. Get it secured.’ And when I say ‘secured,’ if it’s on, leave it on so we’ll be able to capture the RAM (random-access memory).

“But also remove the network cable so no one can connect to it remotely, like remote desktop or some kind of remote administration-type package… the other reason for removing the network cable is because anti-virus programmes update themselves – if they are connected to the Internet, they can therefore change data.”

Greed avenueJoseph M. Quiazon, managing director of fraud investigation and dispute services at Ernst & Young Advisory Services Ltd., says fraud risk always exists and cites Alan Greenspan, the former chairman of the U.S. Federal Reserve. “He said, ‘It’s not that people have become any more greedy, it’s just that the avenue to express that greed has grown enormously.’”

To deal with a suspected employee fraud, Laykin of Duff & Phelps gives a list for senior management to consider: Should regulators be involved? Can the fraud be contained to one group of employees? Are third parties such as investors, members of the board, suppliers or rivals involved? Worse yet, is it the action of members of the C-suite or general management?

A case in point is a mainland manufacturing company, where management told its staff to inflate the company’s revenue through fictitious sales in the previous few years, according to Ferrier Hodgson’s Tudorovic. A computer forensics team inspected the

Just switching a machine on will change a lot of time and date stamps on the files. So what we’ll tell our clients all the time is, ‘Don’t get your IT people to look at it. Get it secured.’ And when I say ‘secured,’ if it’s on, leave it on so we’ll be able to capture the RAM.

Computer forensics

[ 28 ] A Plus + November 2009

It’s not that people have become any more greedy, it’s just that the avenue to express that greed has grown enormously.

e-mails and files of a number of key personnel of the company and found that they were sending customers e-mails via their personal accounts with invoices for fictitious sales attached. Further analysis of the electronic data revealed that a number of the customers were actually companies registered by the firm’s employees on the instruction of management.

In a climate where corporations are downsizing while facing increasing pressure to keep earnings up, e-discovery, computer forensics and technical

investigations are the last line of defence that chief executives, CFOs and governance committees have, Laykin says.

It would be a good idea for management to review risk management techniques and audit and survey every system, from physical security logging to accounting and financial transactional systems and logistics or manufacturing, Laykin says. “[These] smart internal controls can help to mitigate much of the risk associated with accounting and financial fraud.”

................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Conduct fraud awareness training and education• Assessfraudrisk,putinplace

areportinglinethatprotectswhistle-blowersandencouragethereportingofinappropriateorcriminalbehaviour.

• Ensurepolicyisfollowedandsegregationofdutiesandothergovernanceandcontrolsare inplace.

Hold management meetings regularly• Holdmeetingsbetween

appointedmembersofthechiefinformationofficer’steamandtheCFO’steamtoidentifyweaknessesforelectronic dataandthemannerinwhichthatdatamightbeacquiredandprocessed.

• Setupkeywordsforsearchingofelectronicdata.

Have a contingency plan in place• Expecttheworstandputa

Dos and don’ts of computer forensics

contingencyplaninplaceincaseoffraud.

Touch no computers• Neverplayaroundwiththe

computersuspectedofbeinginvolvedwithfraudulentactivitiesandreviewtheforensicallyimagedcopyinstead.Improperlyobtainedevidencecandiminishitsvalue.

• Largercompaniesmayhaveaforensicinfrastructurethatallowsyoutoaccesseverycomputerthroughacentrallycontrollednetwork.Soyoucantakesnapshotsorforensicimagesofthecomputerwithouthavingtobephysicallyatthecomputer.

Report only on a need-to-know basis• Don’tactemotionallyor

respondhastilytoavoiddamagingvaluableevidence.

Treat every case as if it will go to court • Allsortsofmistakescanbe

madeintheinitialprocessthatcandamageacaseincourt, sowaitfortheinvestigatorstogetthere.

HereareafewtipsforCFOsandITexecutivesdealingwithsuspiciousemployeefraud:

SAP Business One 會計管理方案

HK$98,800 都可以用到 SAP ?

* 應收 / 付帳* 成本會計* 財務報告* 週期性交易記錄* 財務預算* 發票管理* 現金流量表* 外匯計算

HK$ 98,800*SAP Business One

業務管理方案

* 業務流程管理* 銷售與分銷* 採購與倉存管理* 財務管理* 客戶關係管理* 生產管理* 人力資源管理* 銀行業務* 成本控制* 報表* 物料需求計劃

HK$ 188,800**備註:本公司保留對此優惠之最終批核權

查詢電話

為何選擇

被喻為業務管理方案翹楚 具37年ERP行業方案的經驗 快速實施 (短至3週以內便可使用) 簡易用戶介面 有助提高工作效率及生產力 多角度分析財務及商業狀況 可擴展至其他SAP ERP 方案 支援多種語言 經驗豐富支援團隊 靈活報表,可供管理層即時資料

®

即 買 即 用

包括軟件

系統安裝

軟件培訓

熱線支援服務

售前熱線講解

............

............

............

............

包括軟件

系統安裝

軟件培訓

上門支援服務

售前上門講解

............

............

............

............

C

M

Y

CM

MY

CY

CMY

K

AMS-Nov.pdf 21/10/2009 10:31:41 AM