A Digital Forensics Analyst ( DFA ) is required when an investigation involves the retrieval and examination of "electronic evidence". A DFA should be consulted at the early stages of most investigations, especially where it is suspected proprietary information has been internally / externally compromised or stolen.
Digital Forensic Analyst Vs Corporate IT Department Personnel:
Corporate management quite often turn to their internal I.T. department personnel when "suspected employee irregularities" surface. This is a "huge mistake", as IT personnel are not trained investigators or DFAs. Once the IT personnel become involved, evidence becomes tainted and not preserved, thus creating serious legal ramifications down the road.
With the exception of major financial institutions and some government agencies who have highly trained resources on staff, I.T. personnel should not be used to investigate suspected irregularities for the following reasons:
- They are not trained to handle & preserve evidence
- They are not trained in "Forensic Methodologies", or to use Forensic Tools (which are capable of recovering deleted files, discovering concealed files, and much more)
- They are not equipped with a Forensic Lab or Tools
- They are not perceived to be an unbiased analyst
- They are known for unintentionally destroying evidence ( for example, turning on suspect computer )
It is our belief that the "investigative team approach" is the most effective solution when problems surface. Berkeley's investigators work in tandem with Digital Forensic Analysts ( DFAs ), since most "serious crimes against business" these days involve direct or circumstantial evidence often hidden and stored on company desktop and / or laptop computers or other related devices. Throughout the forensic examination, our DFA will provide the client with guidance and assistance in protecting all property and assets against costly lawsuits and other forms of liability related to e-mail use, file retention and workplace privacy issues.
While teamed with an experienced Fraud Investigator, the DFA will locate and securely extract crucial hidden data during the analysis phase of the investigation, providing tremendous insight in discerning what information is of value, and what is irrelevant.
A proper examination conducted by a professionally qualified DFA will provide valuable insight into determining what evidence is available, where that evidence may be found, and most important, how to effectively secure and analyze the evidence with minimal disruption to day-to-day business operations, while maintaining the necessary chain of custody and continuity of evidence requirements.
Berkeley International Intelligence provides expertise to clients in relation to all aspects of the "electronic discovery process", including forensic drive imaging, data capture and analysis, tape restoration, recovering deleted files and partitions, and restoring formatted drives, identifying and restoring data to strengthen their position in relation to commercial litigation and Labour Law issues, while at the same time exposing potential or actual security breaches.
DFAs are also capable of cracking passwords, tackling encryption issues, and are well versed in the methods employed by criminals to conceal, transfer, alter, and destroy electronic information.
Some "Crimes" Investigated / Uncovered by DFAs:
- Theft of Trade Secrets / Proprietary Information / Sensitive Data
- Corporate Espionage
- Electronic Sabotage
- Suspicious Activities
- Fraud / Kick Backs / Embezzlement
- Suspect Contractor Relationships / Secret Commissions
- Conflicts of Interest
- Expense Accounting Irregularities
- Misappropriation of Corporate Assets
- Breach of Shareholder / Employment / Non-Competition Agreements
- Workplace Bullying & Harassment
- Libel & Slander
- Threats / Extortion & Harassment Against Management & Personnel
- Termination / Wrongful Dismissal Issues
Digital Forensic Analyst's Professional / Ethical Requirements when examining Equipment owned by the client, but used by Employee under Investigation:
Our DFA will require a "signed release" from the client, which will outline certain facts; that they do in fact own the Desktop / Laptop / PDA device being released for examination, that they are in fact in a position of authority within the organization to request such an examination, and that the examination request is for legitimate & lawful purposes.
In the event our DFA uncovers data that could eventually become evidence in future legal proceedings, copies of this evidence will be retained in our files, together with any related reports or documents. All data, reports and associated documentation are stored in a highly secure location and manner, under the control of Berkeley International Intelligence Inc.
NOTE: Our DFAs are "legally, ethically & morally obligated" to report any and all findings of "child pornography" to Law Enforcement Authorities.
How Digital Forensic Analysts preserve
Information Developed for Court Purposes:
Once all pertinent information has been extracted and properly investigated, Berkeley will provide the client with a comprehensive report of our findings. The report would be created on a self-loading & interactive CD-Rom, unless instructed otherwise, to allow for an effective and organized presentation. This enables the viewer to preview most electronic files and documents in their native format ( Many files and documents lose value, and are not effectively represented with standard printing formats ). Any Multimedia files will also be viewable from the CD-Rom. An HTML (website) format is used to facilitate the various components of the report, to simplify navigation for the viewer.
In the event the evidence is to be used in court, a very detailed report will be created, that will contain ( a ) original information conveyed by the client ( b ) additional references to each artifact, which will allow for easy verification of the findings during the discovery & trial process.
Officer / Director Liability - Criminal Activity
& Financial Losses Covered Up / Kept Secret
Everyone in the corporate world is fully aware of the massive accounting frauds that floored giant companies "Enron" and "WorldCom". These two high profile scandals are perfect examples of why corporate Officers and Directors have a fiduciary responsibility to the owners, shareholders and various stakeholders of both private and public companies, to act on and investigate all incidents of suspected irregularities or wrongdoings which have had a "financial effect" on the organization. The Officers and Directors should act diligently and expeditiously, utilizing all investigative resources at their disposal, to minimize any potential losses or damages to the corporation.
As technology continues to create increased threats and vulnerabilities to all organizations, it is critical that management understand the fundamentals of countering these threats, and to be proactive in establishing relationships with investigative resources such as Berkeley International Intelligence Inc. The consequences for neglecting to take immediate action can lead to inconclusive or erroneous results, wrongful dismissal lawsuits, bad publicity and shareholder disappointment. In the event the suspected incidents involve a "public company", the OSC and / or the SEC automatically commence their own investigation which may result in a "cease trade order" and possible criminal charges.