The term computer forensic services means using computer hardware and software to uncover fraud or evidence usable in litigation. We have special software and computer hardware designed to enable us to provide these services.

Computer Aided Audit Techniques (CATT) use specially designed software to analyze databases of accounting and other financial information. According to ACL, a leading provider of CAAT software, over 85 per cent of frauds can be detected using such technology. The software:

• Indicates where to look;
• Indicates the depth and scope of the problem; and
• Directly points to critical evidence

Most computer accounting programs have built-in features for exporting the data needed for analysis. A few of the hundreds of analysis routines the software can run are:

• Identify duplicate payments for the same invoice (a sign expenses are higher than need be—or maybe fraud)
• Identify employees with address that are the same as vendors (a sign of vendor fraud)
• Identify employees without deductions or with invalid Social Security numbers (signs of a phantom employee)
• Identify employees who seldom take vacations (a sign of an employee engaged in a fraud)
• Run a digital frequency analysis (if the frequency with which numbers appear as first, second, and third digits in a set of related numbers, such as disbursements for a year, does not match a statistically determined frequency there is a great chance those numbers indicate a problem).

Data Capture Hardware is used to make a perfect mirror image of a computer’s hard drive. This image can then be analyzed and evidence discovered, such as:

• Deleted emails, correspondence, or photographs
• Unreported assets such as hidden bank accounts
• Evidence of associations with other people
• Employee misuse of the internet

This type of evidence:

• Is regularly gathered by law enforcement such as the FBI, CIA, IRS, and Scotland Yard;
• Is admissible in court if proper data gathering procedures are followed;
• Works with any operating system;
• Has an error rate of less than one-in-four billion;
• Can by-pass security systems;
• Is gathered without making any change to the target computer.

Data capture and analysis is important because:

• Deleted files do not disappear until physically written over, which may never happen on a large hard drive;
• Anything appearing on a computer screen exists on the computer’s hard drive until physically written over, even if the user never “saves” the screen;
• Deleted files can provide evidence crucial in litigation or fraud investigations.