Forensic Technology Deloitte Forensic Conference of Regulatory Officers

  • Slides: 18
Download presentation
Forensic Technology Deloitte Forensic Conference of Regulatory Officers - CORO 2012 9 November 2012

Forensic Technology Deloitte Forensic Conference of Regulatory Officers - CORO 2012 9 November 2012

Agenda • • • Background What is Computer Forensics Defining the value of Forensic

Agenda • • • Background What is Computer Forensics Defining the value of Forensic Technology Data sources Computer Forensics scenarios in trust accounts • • Email & Smartphone investigation Computer Forensic Analysis • Questions 2 © 2012 Deloitte Global Services Limited

What is Computer Forensics? The process of identifying, preserving, analysing and presenting digital evidence

What is Computer Forensics? The process of identifying, preserving, analysing and presenting digital evidence in a manner that is legally acceptable in any judicial or administrative hearing Source: “What is Forensic Computing? ”, Australian Institute of Criminology, Trends & Issues No. 118, June 1999. 3 © 2012 Deloitte Global Services Limited

Computer forensics is about the relationship between IT & the law of evidence. 4

Computer forensics is about the relationship between IT & the law of evidence. 4 © 2012 Deloitte Global Services Limited

Key assumptions arising from this relationship • • • The examination results will be

Key assumptions arising from this relationship • • • The examination results will be tendered in evidence The forensic methodology and technology will be tested The computer forensic examiners credibility will be challenged Why Computer Forensics? • • • The computer is potentially a crime scene • • • Computers record many actions …. without the knowledge of the user 5 Majority of documents and records now stored in electronic form No investigation/litigation can be complete without the examination of all evidence Allows recovery of deleted and hidden documents Provides evidence which is accepted in court © 2012 Deloitte Global Services Limited

Computer Forensic Workplace relations issues 6 Theft of IP Misuse of IT resources Fraud

Computer Forensic Workplace relations issues 6 Theft of IP Misuse of IT resources Fraud & contract disputes Insolvency assistance © 2012 Deloitte Global Services Limited

Data Sources Servers 7 Backup tapes Databases Laptops Desktops © 2012 Deloitte Global Services

Data Sources Servers 7 Backup tapes Databases Laptops Desktops © 2012 Deloitte Global Services Limited

Where does Forensic Technology provide value to lawyers? Expert review of evidence through: -

Where does Forensic Technology provide value to lawyers? Expert review of evidence through: - Computer Forensics - Data analysis - Forensic Accounting Client Conferences Information Gathering Expert statements to support court applications Computer forensic and investigative support for Anton Pillar orders Legal Review Identify potential involvement of technology - on both sides of the matter Identify and secure evidence - Apply forensic methods - Awareness of legal issues Presentation of expert evidence Court Hearings, Negotiation, Mediation Submissions for Court Orders Electronic Discovery Cost Recovery Execution of Court Orders 8 Import collected evidence and facilitate electronic discovery Quantification of economic loss © 2012 Deloitte Global Services Limited

Scenario 1: Email & smartphone Investigation M An organisation has lost a senior employee

Scenario 1: Email & smartphone Investigation M An organisation has lost a senior employee to a competitor, and suspect the person has taken confidential business information upon leaving Forensic Activities 1. Recovering email correspondence from multiple available sources 2. Searching email & smartphone for unauthorised distribution of sensitive data 3. Reviewing conversations to identify the context of communications Results • Confirmation that sensitive files have been emailed to a ‘home’ account • Identification of additional parties involved in the disclosure • Corroboration of computer forensic evidence found at other sources • Confirmation of the possible presence of evidence held by the person 9 © 2012 Deloitte Global Services Limited

Scenario 2: Computer Forensic Analysis M An organisation has identified that serious misconduct is

Scenario 2: Computer Forensic Analysis M An organisation has identified that serious misconduct is occurring, and need to confirm the persons involved and extent of misconduct Forensic Activities 1. Forensic imaging of individual’s work computers 2. Recovery of deleted and fragmented files 3. Keyword searches for related material 4. Extraction of Internet history and application usage records 5. Reconstruction of the user’s computer activities Results • Confirmation of the presence of inappropriate information on the computer • Understanding the context of the information • Identifying additional sources of electronic evidence • Confirming the need for law enforcement involvement 10 © 2012 Deloitte Global Services Limited

11 © 2012 Deloitte Global Services Limited

11 © 2012 Deloitte Global Services Limited

12 © 2012 Deloitte Global Services Limited

12 © 2012 Deloitte Global Services Limited

© 2012 Deloitte Global Services Limited

© 2012 Deloitte Global Services Limited

© 2012 Deloitte Global Services Limited

© 2012 Deloitte Global Services Limited

© 2012 Deloitte Global Services Limited

© 2012 Deloitte Global Services Limited

© 2006 Deloitte Touche Tohmatsu © 2012 Deloitte Global Services Limited

© 2006 Deloitte Touche Tohmatsu © 2012 Deloitte Global Services Limited

Questions?

Questions?

General information only This presentation contains general information only, and none of Deloitte Touche

General information only This presentation contains general information only, and none of Deloitte Touche Tohmatsu Limited, Deloitte Global Services Holdings Limited, the Deloitte Touche Tohmatsu Verein, any of their member firms, or any of the foregoing’s affiliates (collectively the “Deloitte Network”) are, by means of this presentation, rendering accounting, business, financial, investment, legal, tax, or other professional advice or services. This presentation is not a substitute for such professional advice or services, nor should it be used as a basis for any decision or action that may affect your finances or your business. Before making any decision or taking any action that may affect your finances or your business, you should consult a qualified professional adviser. No entity in the Deloitte Network shall be responsible for any loss whatsoever sustained by any person who relies on this publication. Confidential This document and the information contained in it is confidential and should not be used or disclosed in any way without our prior consent. 18 About Deloitte refers to one or more of Deloitte Touche Tohmatsu Limited, a UK private company limited by guarantee, and its network of member firms, each of which is a legally separate and independent entity. Please see www. deloitte. com/au/about for a detailed description of the legal structure of Deloitte Touche Tohmatsu Limited and its member firms. Deloitte provides audit, tax, consulting, and financial advisory services to public and private clients spanning multiple industries. With a globally connected network of member firms in more than 150 countries, Deloitte brings world-class capabilities and deep local expertise to help clients succeed wherever they operate. Deloitte’s approximately 170, 000 professionals are committed to becoming the standard of excellence. About Deloitte Australia In Australia, the member firm is the Australian partnership of Deloitte Touche Tohmatsu. As one of Australia’s leading professional services firms. Deloitte Touche Tohmatsu and its affiliates provide audit, tax, consulting, and financial advisory services through approximately 5, 700 people across the country. Focused on the creation of value and growth, and known as an employer of choice for innovative human resources programs, we are dedicated to helping our clients and our people excel. For more information, please visit our web site at www. deloitte. com. au. Liability limited by a scheme approved under Professional Standards Legislation. Member of Deloitte Touche Tohmatsu Limited © 2012 Deloitte Touche Tohmatsu © 2012 Deloitte Global Services Limited