A Client Example: How One Client Used Computer Forensics to Uncover the Most Significant Embezzlement in Its History
Universal Advisor, 2007 Issue No. 2

Please also read the companion piece, "Computer Forensics: Clamp Down Before It's Too Late"

Because these matters command the highest level of client confidentiality, our client has chosen to remain anonymous.

What events alerted you to suspicious activity?

Our credit card company representative had been reviewing employee cards for unauthorized activity. We were alerted that one staff member, in particular, appeared to be using the company card for personal purchases.

What led you to pursue computer forensics?

We wanted to determine how the employee was tracking or detailing the charges. In addition, we wanted to find out if they were working alone or if others were involved in the scheme as well. We felt that the information housed on the employee’s computer could be a good start toward answering those questions and uncovering other relevant information.

Why did you partner with Plante & Moran?

We’ve worked with Plante & Moran for more than five years now, and we’ve always been pleased with their services. We really liked their consolidated approach.

Initially we considered using an outside boutique forensic firm, but because Plante & Moran brought both certified fraud experts and experts in computer networks and security to the table, we didn’t have to. This ended up saving us some money, as boutique firms are always more expensive because of their purported expertise and specialization.

What did the investigation reveal?

It’s interesting, because you can review documents in the accounting office and interview people, but sometimes the most compelling evidence is housed on the laptop that the perpetrator used. That was certainly the case here. Scott [Petree] was able to capture an image of the perpetrator’s laptop, leaving all the original data intact — he didn’t even have to turn the computer on. A lot of the spreadsheets that had helped conceal this scheme were housed in the deleted documents; the data was extremely helpful — you could see that the material had been deleted mere days before we retrieved the laptop. All of this has been instrumental in building our case. We’re very pleased with the information the team was able to uncover.