Electronic Fingerprints

The fingerprints of most modern fraudsters will be found in the electronic records their scams leave behind. Chris Wheeler, head of Pinsent Masons' groundbreaking in-house Forensic Accounting Team in London, discusses some ways of detecting fraudulent acts through examination of electronic evidence.

Electronic data identification and capture is now a necessary and unavoidable consideration in fraud investigations.

Until recently documentary evidence of a fraud was only likely to be found amongst a small number of sources such as diaries, paper correspondence, bank records, phone records and the like. Some information might have been held on computer hard and floppy disk drives but this was usually the extent of electronic investigations. With the rapid development of communications technology in the past 10 years edata is now a common facet of all walks of life and even the most technically inept fraudster makes use of such technology in one form or another. For today's fraud investigator the potential sources of evidence which need to be considered are hugely diverse.

Everyday access leaves a trail

Stop for a moment and consider your own work environment. It is a fair assumption that you will store and access data via a variety of electronic sources. These will probably include: computer hard drives; an array of network servers (such as emails, document management, network management, internet proxy servers etc); portable tape and flash drives; PDAs; fax machines; and even photocopiers. Memory cards used in mobile phones and digital cameras are now capable of storing substantial volumes of data as are personal media players. In fact the mobile phone's memory is increasingly becoming an exit route for many companies' trade secrets.

However, not only do these devices store vast amounts of data they often also provide an electronic chronology of who created, used, accessed, changed or deleted such data, who they shared it with and when they did it by virtue of the meta data such 'transactions' leave behind. Attempts to delete or conceal this information are often unsuccessful as the interconnectivity of devices means the trail may be left in places which...