Computer forensics, fraud investigation and litigation support

Bright Pharmaceuticals suspects that its procurement manager has been inflating suppliers' invoices and taking the difference. Some invoices carry forged electronic signatures. The only proof lies in e-mails, spreadsheets, logs and the manager's laptop.

The forensic accountant has to get that evidence out of the machines without changing it, follow a clear process from the first allegation to the final report. Prepare the evidence so that it will be accepted in court.

This topic covers computer forensics, electronic evidence of fraud, the techniques used, the types of electronic data, the stages of a fraud investigation, the limits of electronic evidence, and litigation support by forensic accountants. The previous topics covered forensic services and economic damage, and the next covers hidden assets.

Key terms in plain English

Syllabus check

This topic is in syllabus area D, forensic accounting services (15% of marks). It covers:

• computer forensics and Electronic evidence retrieval for fraud
• the process of investigating fraud
• litigation support

CAMA 2020 and fraud investigation

The Companies and Allied Matters Act 2020 (CAMA 2020) is the company law of Nigeria. The sections below apply to this topic.

The rules in more depth

What computer forensics is

Computer forensics is the process of using computers to collect, analyse and preserve electronic data in order to investigate cyber crimes, intellectual property theft and other digital offences. It is applied in two main areas:

• Investigation. Electronic fraud does not happen without electronic equipment, so one source of evidence is the computer or mobile phone of the suspect. The professional follows set procedures to search for information in ways that make the findings usable as evidence.
• Data recovery. The professional takes broken hard drives, crashed servers and other affected devices and retrieves lost data. This matters to a business that has had a system crash.

Electronic evidence retrieval for fraud

Electronic evidence retrieval of fraud is the use of digital tools and techniques to identify, collect and analyse electronic data to detect and investigate fraud. It is a form of computer forensics in which evidence is sought in e-mails, business communications and other electronic data, for use in litigation or court proceedings. It is needed because of the growth of electronic devices and digital communication in personal and business life. The reasons are:

• digital evidence is important in legal proceedings;
• electronic data may be too complex to handle without specialised tools to collect, analyse and produce it;
• litigation support: identifying relevant evidence, preserving data and producing important documents;
• regulatory requirements: organisations must comply with rules on data retention and production in response to legal or regulatory requests; and
• accuracy: electronic evidence retrieval gives accurate analysis of data.

Computer forensic techniques

Types of electronic data

Electronic data is information stored, processed or transmitted in digital form by electronic devices, systems or networks. In a fraud, the main types are:

• E-mails, which may contain fraudulent communication, such as phishing e-mails that look legitimate and ask for sensitive information, used for example to obtain banking login details.
• Electronic documents, such as files and PDFs, which may show forged documents or altered financial records.
• Spreadsheets, which may have hidden columns or rows or altered formulas.
• Databases, which may contain altered data or show unauthorised access.
• Computer logs, which may show unauthorised access or hidden files.

Other sources include metadata (who created or changed a file and when), mobile phones and messaging applications, cloud storage, CCTV and access control records, and accounting system audit trails. The investigator makes a forensic image, an exact copy, of the device and works on the copy, so the original is untouched, and records a hash value, a digital fingerprint, to prove later that the copy is identical.

The process of investigating fraud

There is no fixed method, and firms use their own procedures, but any process includes these stages:

1. Receipt of the allegation, from a whistleblower, management or a law enforcement agency.
2. Initial assessment, to judge how credible the allegation is and its possible impact on the organisation.
3. Planning and preparation, including the resources needed, timing and the investigation team.
4. Evidence collection, collecting and preserving all relevant and reliable evidence: documents, electronic data and written testimony.
5. Data analysis, to find patterns, anomalies and potential evidence of fraud.
6. Interviews and interrogation of witnesses, suspects and other relevant parties to gather more information.
7. Analysis and conclusion, weighing all the evidence to prove or disprove the allegation.
8. Reporting and recommendations, preparing the report with the findings and recommending further action.

Applying it to procurement fraud. For the allegation that the procurement manager inflated invoices, the investigator would:

• protect the evidence, such as locking the manager's e-mail and computer
• review the approved supplier list and vendor master file for new or related suppliers
• compare invoice prices with contracts, price lists, quotes and market prices
• compare quantities invoiced with goods received notes and actual stock
• check the electronic signatures and their logs against who held the tokens, and look at the metadata of the invoice files
• analyse payments for duplicates, round amounts, split orders and payments to bank accounts linked to the manager or relatives
• compare the manager's lifestyle and assets with income
• interview procurement staff, suppliers and the finance team, and then the manager
• report the amount of the loss, how the fraud was carried out and who benefited

Limitations of electronic evidence

• Data volume: large volumes make it hard to find and collect relevant evidence.
• Data complexity: specialist skills are needed to analyse complex data.
• Data security: the data can be sensitive and needs measures to stop unauthorised access, and unencrypted data is easy for anyone to get.
• Data quality: poor data reduces effectiveness.
• Timing: delay gives a fraudster time to tamper with data or erase it, and large volumes take time to analyse.

Litigation support

Litigation support is the help a forensic accountant gives to lawyers and courts in a financial dispute. The services include:

• helping lawyers to understand the financial issues and to frame questions for witnesses;
• collecting, preserving and producing documents and electronic data that may be used as evidence;
• quantifying damages and losses and testing the other side's figures;
• preparing reports and clear visual exhibits for the court;
• acting as an expert witness, giving independent opinion and testimony, and being cross-examined; and
• helping settle the dispute, for example by mediation or arbitration, by giving the parties a reliable estimate of the claim.

A forensic accountant who is a witness has a duty to the court that overrides duty to the client. The accountant must be independent, honest, competent and objective, must state the limits of the work, and must not advocate for the client. The next topics on professional negligence and the expert report cover these duties.

In Nigeria, evidence in civil and criminal cases is governed by the Evidence Act, which has specific provisions on electronic records. The accountant should work with the instructing lawyer to meet them.

Chain of custody and admissibility

For electronic evidence to be accepted, the investigator should show that it was collected lawfully, that it was not changed, and that the person who handled it can be identified at every stage. Each device is labelled, photographed, sealed and logged. Access is restricted. Tools used are recognised and the steps are repeatable. The investigator writes contemporaneous notes.

A break in the chain, or a failure to image the device before examining it, may lead a court to give the evidence little weight or reject it.

Worked examples

1. Data carving may recover the deleted file from the disk.
2. The investigator works on a forensic image and records the hash value.

1. The log shows it was applied from the manager's computer.
2. This supports the allegation of forgery and points to the person responsible.

1. The initial assessment, planning and evidence preservation come first.
2. Interviewing the suspect too early warns him, and he may destroy evidence.

1. Timing is a limitation: evidence has been lost.
2. The investigator uses other sources: back-ups, cloud copies, bank records and third-party confirmations.

How to score full marks

• Define computer forensics and its two areas.
• List the eight stages in order and apply them to the scenario.
• Give the four techniques and five data types.
• Mention limits and the chain of custody.

Common mistakes in the exam

• Examining the original device instead of a copy.
• Interviewing the suspect first.
• Giving stages with no link to the scenario.
• Forgetting that the expert's duty is to the court.

Quick revision

• Investigation and data recovery.
• Carving, file analysis, network traffic, memory.
• Allegation, assess, plan, collect, analyse, interview, conclude, report.
• Limits: volume, complexity, security, quality, timing.

Practice questions

Questions 1 to 10 are multiple choice. Questions 11 to 13 are written. Try each before opening the answer.

Model answers

Spotted a mistake? Tell us and we will check it.