Forensic Computing Ltd Case Studies

Consultancy - Accidental deletion of files – A consultancy had upgraded its server and this had failed and they had no backup. They had all of their business critical data held in Microsoft Outlook and had been lost. 

Data recovery was undertaken and the files (and the business) were recovered. 

Manufacturing Company - False Accounting – A temporary member of staff in the company had created a number of bogus invoices and set up a dummy company to process the payments. The member of staff was able to control both the initialisation of the payment and its authorisation.  

Forensic examination of the suspect’s portable computer indicated that there were none of the suspect invoices present as files but that they had been printed from the portable and that print artefacts existed to enable the actual images of the invoices to be recovered. 

Consultancy - Email abuse – A member of staff complained about receiving harassing emails from a number of different email addresses. These were all thought to have come from the same person. 

Forensic examination indicated that they had been sent from a single PC – even though they had been deleted from the system – and the email addresses spoofed. The emails were recovered. 

Law Firm – Lost Email – A lawyer had lost email that was critical to a case and needed to recover this to prove that an exchange of emails had taken place. There were no backups of the system. 

Forensic examination recovered enough of the emails to prove the exchange of emails. 

Law Firm – Proof of Documents – A law firm acting for a client needed to prove that a given document had, or had not, been created on or before a given date. 

Forensic examination of the metadata of the file as well as that of the operating system was undertaken and this supported the claim. 

Police Force – 419 Fraud – A number of computers had been seized and it was required to prove that they had been used in a 419 fraud.

Forensic examination indicated that there were a number of relevant files on the seized computers. In addition to this, more victims were discovered that were previously unknown and one of the computers had been stolen so it was possible to return it to the rightful owner.