Computer Forensics: An Important Tool for Uncovering Fraud

Posting by Alex Helfand. ENCE, Computer Forensic Specialist P: 301.272.6022 | E: helfand@bbcpa.com

In a world so dependent on technology, it is becoming more important than ever for computers to be investigated as part of accounting fraud cases.  It may be obvious to assume that when looking at a hard drive, an investigator will be able to see the files saved on the computer.  However, there is much more value to performing a computer forensic investigation than the aforementioned.

Recover Deleted Files

Someone committing fraud might believe they are savvy enough to know how to delete all electronic evidence that could possibly be found on their computer.  However, despite deleting files and emptying the recycling bin, most files are still located somewhere on the hard drive.  Using specially programmed computer forensic software, like EnCase ® and FTK. a trained computer forensic investigator can uncover these deleted files.  A computer forensic investigation can identify the content of these deleted files and use them as evidence in a case; often these deleted files are the most valuable, as the perpetrator was trying to delete these for a reason.

Additionally, by using computer forensic software, an investigator can recover a file’s metadata, such as the created, last written, and last accessed dates.  This type of data can be used to prove or disprove a suspect’s claim regarding evidence found on the hard drive.

Uncover Internet History and Emails

Computer forensics can assist in other areas of an investigation.  When investigating the files on a hard drive, an investigator can pick up clues for other investigators.  When looking through emails, there may be indicators to bank accounts or other names associated with the perpetrator, leading to a break in the case.

Computer forensic investigators can also work hand-in-hand with forensic accountants from the start of an investigation.  Forensic accountants can give computer forensic investigators specific keywords to search for on a hard drive, saving time and effort.  Likewise, a computer forensic investigator may reveal clues that forensic accountants can use to further an investigation.  For example, if financial statement fraud is being committed, there might be emails that explain how the perpetrator planned on committing the fraud.  This synergistic relationship can be crucial to solving many different types of fraud, such as embezzlement, extortion, and credit card frauds.

In today’s technologically saturated world, digital evidence has never been more important.  By recovering deleted files and creating helpful synergy and collaboration, computer forensic examiners will continue to provide key evidence for many cases.

3A%2F%2F1.gravatar.com%2Favatar%2Fad516503a11cd5ca435acc9bb6523536%3Fs%3D100&r=G /%

Alex Helfand

An EnCase® Certified Computer Forensics Examiner, Alex is a unique asset for our forensic accounting team. He is brought in to forensic investigations to acquire and analyze data from a variety of digital sources, including desktop and mobile devices. Alex works on engagements for real estate owners and lessors, general contractors, small businesses in a variety of industries, not-for-profits, and employee benefit plans. His background includes finance and tax accounting, as well as computer programming and information technology, allowing him to approach engagements with an innovative, technologically-focused perspective.