Transcript Clear and focused attention
Forensic Technology Deloitte Forensic
Conference of Regulatory Officers - CORO 2012
9 November 2012
2
Agenda
• • • • • •
Background What is Computer Forensics Defining the value of Forensic Technology Data sources Computer Forensics scenarios in trust accounts
• • Email & Smartphone investigation Computer Forensic Analysis
Questions
© 2012 Deloitte Global Services Limited
3
What is Computer Forensics?
The process of identifying , preserving , analysing and presenting digital evidence in a manner that is legally acceptable in any judicial or administrative hearing
Source: “What is Forensic Computing?”, Australian Institute of Criminology, Trends & Issues No. 118, June 1999.
© 2012 Deloitte Global Services Limited
4
Computer forensics is about the relationship between IT & the law of evidence
.
© 2012 Deloitte Global Services Limited
5
• • •
Key assumptions arising from this relationship
The examination results will be tendered in evidence The forensic methodology and technology will be tested The computer forensic examiners credibility will be challenged
Why Computer Forensics?
• • • • • • The computer is potentially a crime scene Majority of documents and records now stored in electronic form No investigation/litigation can be complete without the examination of all evidence Computers record many actions ….without the knowledge of the user Allows recovery of deleted and hidden documents Provides evidence which is accepted in court © 2012 Deloitte Global Services Limited
Computer Forensic
6
Workplace relations issues Theft of IP Misuse of IT resources Fraud & contract disputes Insolvency assistance © 2012 Deloitte Global Services Limited
Data Sources
7
Servers Backup tapes Databases Laptops Desktops © 2012 Deloitte Global Services Limited
Where does Forensic Technology provide value to lawyers?
Client Conferences
8
Expert review of evidence through: - Computer Forensics - Data analysis - Forensic Accounting Information Gathering Expert statements to support court applications Legal Review Computer forensic and investigative support for Anton Pillar orders Submissions for Court Orders Electronic Discovery Execution of Court Orders Import collected evidence and facilitate electronic discovery Identify potential involvement of technology - on both sides of the matter Identify and secure evidence - Apply forensic methods - Awareness of legal issues Presentation of expert evidence Court Hearings, Negotiation, Mediation Cost Recovery Quantification of economic loss © 2012 Deloitte Global Services Limited
9
Scenario 1: Email & smartphone Investigation
An organisation has lost a senior employee to a competitor, and suspect the person has taken confidential business information upon leaving
Forensic Activities
1.
2.
3.
Recovering email correspondence from multiple available sources Searching email & smartphone for unauthorised distribution of sensitive data Reviewing conversations to identify the context of communications • • • •
Results
Confirmation that sensitive files have been emailed to a ‘home’ account Identification of additional parties involved in the disclosure Corroboration of computer forensic evidence found at other sources Confirmation of the possible presence of evidence held by the person © 2012 Deloitte Global Services Limited
Scenario 2: Computer Forensic Analysis
An organisation has identified that serious misconduct is occurring, and need to confirm the persons involved and extent of misconduct
Forensic Activities
1.
Forensic imaging of individual’s work computers 2.
3.
Recovery of deleted and fragmented files Keyword searches for related material 4.
5.
Extraction of Internet history and application usage records Reconstruction of the user’s computer activities
10
• • • •
Results
Confirmation of the presence of inappropriate information on the computer Understanding the context of the information Identifying additional sources of electronic evidence Confirming the need for law enforcement involvement © 2012 Deloitte Global Services Limited
11
© 2012 Deloitte Global Services Limited
12
© 2012 Deloitte Global Services Limited
© 2012 Deloitte Global Services Limited
© 2012 Deloitte Global Services Limited
© 2012 Deloitte Global Services Limited
© 2006 Deloitte Touche Tohmatsu © 2012 Deloitte Global Services Limited
Questions?
18 General information only
This presentation contains general information only, and none of Deloitte Touche Tohmatsu Limited, Deloitte Global Services Limited, Deloitte Global Services Holdings Limited, the Deloitte Touche Tohmatsu Verein, any of their member firms, or any of the foregoing’s affiliates (collectively the “Deloitte Network”) are, by means of this presentation, rendering accounting, business, financial, investment, legal, tax, or other professional advice or services. This presentation is not a substitute for such professional advice or services, nor should it be used as a basis for any decision or action that may affect your finances or your business. Before making any decision or taking any action that may affect your finances or your business, you should consult a qualified professional adviser. No entity in the Deloitte Network shall be responsible for any loss whatsoever sustained by any person who relies on this publication.
Confidential This document and the information contained in it is confidential and should not be used or disclosed in any way without our prior consent.
About Deloitte
Deloitte refers to one or more of Deloitte Touche Tohmatsu Limited, a UK private company limited by guarantee, and its network of member firms, each of which is a legally separate and independent entity. Please see www.deloitte.com/au/about for a detailed description of the legal structure of Deloitte Touche Tohmatsu Limited and its member firms. Deloitte provides audit, tax, consulting, and financial advisory services to public and private clients spanning multiple industries. With a globally connected network of member firms in more than 150 countries, Deloitte brings world-class capabilities and deep local expertise to help clients succeed wherever they operate. Deloitte’s approximately 170,000 professionals are committed to becoming the standard of excellence.
About Deloitte Australia
In Australia, the member firm is the Australian partnership of Deloitte Touche Tohmatsu. As one of Australia’s leading professional services firms. Deloitte Touche Tohmatsu and its affiliates provide audit, tax, consulting, and financial advisory services through approximately 5,700 people across the country. Focused on the creation of value and growth, and known as an employer of choice for innovative human resources programs, we are dedicated to helping our clients and our people excel. For more information, please visit our web site at www.deloitte.com.au
. Liability limited by a scheme approved under Professional Standards Legislation. Member of Deloitte Touche Tohmatsu Limited © 2012 Deloitte Touche Tohmatsu © 2012 Deloitte Global Services Limited