Forensic and Investigative Accounting Chapter 13 Investigation of Electronic Data: A Brief Introduction © 2011 CCH. All Rights Reserved. 4025 W. Peterson Ave. Chicago, IL 60646-6085 1 800 248 3248 www.CCHGroup.com

Definition of Computer Forensics Computer forensics is the analysis of electronic data and residual data for the purposes of its recovery, legal preservation, authentication, reconstruction, and presentation to solve or aid in solving technology-based crimes. Chapter 13 Forensic and Investigative Accounting

Forensic and Investigative Accounting Digital Forensics Digital forensics is the investigation of all electronic devices such as cell phones, Blackberries, and iPods as well as computers to meet all the collection and preservation goals of computer forensics. Chapter 13 Forensic and Investigative Accounting

SAS No. 99 Guidelines for Testing Digital Data SAS No. 99 states: In an IT environment, it may be necessary for the auditor to employ computer-assisted audit techniques (for example, report writers, software or data extraction tools, or other system-based techniques) to identify the journal entries or other adjustments to be tested. Chapter 13 Forensic and Investigative Accounting

IT Guidelines under COSO Framework Guidelines have been established for these areas: Internal control environment Objective setting Event identification Risk assessment Risk response Control activities Information and communication Monitoring Chapter 13 Forensic and Investigative Accounting

Forensic and Investigative Accounting COBIT’s Goals COBIT’s goals are to set control objectives for IT compliance using a strategic planning perspective and at the same time to outline, in detail, the proper procedures to be followed for specific compliance measures. Chapter 13 Forensic and Investigative Accounting

ISO/IEC 1799:2005 Information Technology – Security Techniques Guidelines published by the International Organization for Standardization and used as standardization for security. They include standards for security policy; the organization of information security; asset management; human resources security; physical and environment security; communication management; access controls; information acquisition; incident management; continuity management; and compliance Chapter 13 Forensic and Investigative Accounting

Technical Skills for Digital Evidence Collection Necessary skills are based on the following requirements: Understanding of various operating systems Quickly identifying pertinent digital data Properly preserving data Properly securing data Properly collecting data Maintaining a proper chain of custody Chapter 13 Forensic and Investigative Accounting

Forensic Investigative Tools Imaging software: EnCase SafeBack Data extraction or data mining software: ACL Data Extraction and Analysis (IDEA) Chapter 13 Forensic and Investigative Accounting

Data Mining Strategies Link Analysis: Identify correlations in the database Case Base Reasoning: Associations with past data Sequence Analysis: Relationships based on timelines Cluster Analysis: Separating groups into their distinctive characteristics Chapter 13 Forensic and Investigative Accounting

Forensic and Investigative Accounting Zipf’s Law Uses frequency distributions to identify anomalies that may be an indicator of financial fraud. Chapter 13 Forensic and Investigative Accounting

Forensic and Investigative Accounting Audit Trails Computer logs found in software such as PeopleSoft and SAP can be used to trace the activities of employees to determine if they are following unauthorized policies that may be an indicator of fraudulent activity. Chapter 13 Forensic and Investigative Accounting

Forensic and Investigative Accounting Log Parsers Log Parsers are utility programs that allow the investigator to be able to format raw log entries into a format that is useful for an investigation. Chapter 13 Forensic and Investigative Accounting

Forensic and Investigative Accounting Conclusions Expanded methods to standardize security policies are being made in an attempt ot make it more difficult for cybercrimes to attack the financial databases of companies. The passage of time will determine the success of these methods. Chapter 13 Forensic and Investigative Accounting