Computer Forensics

SITUATION

FSS was hired by the Board of Directors of a regional company to assist with an internal investigation amid questions of unexplained declines in cash flows and the lack of timely financial reporting.

STRATEGY

As part of the internal investigation, FSS collected and examined forensic images of several computers.

RESULTS

Our examination of the allocated and unallocated areas of the hard drives and the recovery of deleted files identified:

  • A second set of books in a hidden partition.
  • Evidence that confidential company information was saved to an external storage device.
  • Deleted files that contained evidence of embezzlement.
  • Illegal images – law enforcement was immediately notified.