Computer Forensics: Clamp Down Before It’s Too Late
by Scott Petree & Karl Zager
Universal Advisor, 2007 Issue No. 2

Please also read the companion piece, "A Client Example: How One Client Used Computer Forensics to Uncover the Most Significant Embezzlement in Its History"

It could happen to anyone. In the midst of what you thought would be a cursory review of a competitor’s website, you come across something very familiar — data that, until recently, had been safely housed within your organization. Then it clicks; six months ago, a critical employee left your company in favor of greener pastures. She had access to that data, you’re sure of it! Except that there’s no way to prove it. You’re six months too late.

At its most basic, computer forensics is the investigation of a computer system and its contents to uncover information, most commonly evidence to support a company’s suspicion of wrongdoing, and preserve that information in a way that allows it to be admissible in court, if necessary. Although we don’t like to think about it — these types of staff transgressions are often thought to occur only at “other organizations” — it happens more than you’d think.

According to an FBI computer crime survey, 44 percent of organizations that knew about security incidents reported those incidents as originating from within their organizations. The 2006 Association of Certified Fraud Examiners’ Report to the Nation states that U.S. organizations lost 5 percent of their annual revenues to fraud, or an estimated $652 billion, in 2006. Given that computers have become such an integral part of doing business, organizations must consider ways to protect and preserve that information to protect them in the event these thefts do occur.

When Should You Consider Computer Forensics?

There are a number of occasions when computer forensics should be considered. In the event a critical employee should leave your company, it’s a good idea to have an outside expert take a computer image of the staff member’s computer. This way, should data show up at a competitor, you have evidence that it may have originated at your organization. In addition, it can be helpful to monitor your current staff. For example, if you have a particularly high-performing sales-person relative to the rest of your organization, computer forensics can ensure that he’s doing so within the rules of your organization, versus promising things or cutting deals that he shouldn’t be.

Computer forensics can also be helpful for sexual harassment claims, as e-mails and other data can be mined to uncover evidence. Organizations can provide computer forensic experts with specific criteria to search for, such as a person’s name or any document containing patent-related information.

Finally, it’s common for staff members under suspicion to delete any evidence of wrongdoing; they believe that fraudulent activity can be erased with a few clicks. However, computer forensics specialists can often retrieve “irretrievable” data and access password-protected data via special software.

Don’t Go It Alone

One of the biggest mistakes organizations make is employing their own, in-house IT staff to assist with uncovering computer-stored information. When it comes to formal or informal disputes, it’s imperative that an organization provide proof that the computer data submitted is legally credible evidence — untouched and unaltered. The best advice is not to touch the system and risk spoiling the evidence, not even to shut the system down. If you must turn the system off, unplug the power, and then call a computer forensics professional.