1. Forensic and Investigative Accounting
Chapter 13
Investigation of Electronic Data:
A Brief Introduction
© 2011 CCH. All Rights Reserved.
4025 W. Peterson Ave.
Chicago, IL

2. Definition of Computer Forensics
Computer forensics is the analysis of electronic data and residual data for the purposes of its recovery, legal preservation, authentication, reconstruction, and presentation to solve or aid in solving technology-based crimes.
Chapter 13
Forensic and Investigative Accounting

3. Forensic and Investigative Accounting
Digital Forensics
Digital forensics is the investigation of all electronic devices such as cell phones, Blackberries, and iPods as well as computers to meet all the collection and preservation goals of computer forensics.
Chapter 13
Forensic and Investigative Accounting

4. SAS No. 99 Guidelines for Testing Digital Data
SAS No. 99 states:
In an IT environment, it may be necessary for the auditor to employ computer-assisted audit techniques (for example, report writers, software or data extraction tools, or other system-based techniques) to identify the journal entries or other adjustments to be tested.
Chapter 13
Forensic and Investigative Accounting

5. IT Guidelines under COSO Framework
Guidelines have been established for these areas:
Internal control environment
Objective setting
Event identification
Risk assessment
Risk response
Control activities
Information and communication
Monitoring
Chapter 13
Forensic and Investigative Accounting

6. Forensic and Investigative Accounting
COBIT’s Goals
COBIT’s goals are to set control objectives for IT compliance using a strategic planning perspective and at the same time to outline, in detail, the proper procedures to be followed for specific compliance measures.
Chapter 13
Forensic and Investigative Accounting

7. ISO/IEC 1799:2005 Information Technology – Security Techniques
Guidelines published by the International Organization for Standardization and used as standardization for security. They include standards for security policy; the organization of information security; asset management; human resources security; physical and environment security; communication management; access controls; information acquisition; incident management; continuity management; and compliance
Chapter 13
Forensic and Investigative Accounting

8. Technical Skills for Digital Evidence Collection
Necessary skills are based on the following requirements:
Understanding of various operating systems
Quickly identifying pertinent digital data
Properly preserving data
Properly securing data
Properly collecting data
Maintaining a proper chain of custody
Chapter 13
Forensic and Investigative Accounting

9. Forensic Investigative Tools
Imaging software:
EnCase
SafeBack
Data extraction or data mining software:
ACL
Data Extraction and Analysis (IDEA)
Chapter 13
Forensic and Investigative Accounting

10. Data Mining Strategies
Link Analysis: Identify correlations in the database
Case Base Reasoning: Associations with past data
Sequence Analysis: Relationships based on timelines
Cluster Analysis: Separating groups into their distinctive characteristics
Chapter 13
Forensic and Investigative Accounting

11. Forensic and Investigative Accounting
Zipf’s Law
Uses frequency distributions to identify anomalies that may be an indicator of financial fraud.
Chapter 13
Forensic and Investigative Accounting

12. Forensic and Investigative Accounting
Audit Trails
Computer logs found in software such as PeopleSoft and SAP can be used to trace the activities of employees to determine if they are following unauthorized policies that may be an indicator of fraudulent activity.
Chapter 13
Forensic and Investigative Accounting

13. Forensic and Investigative Accounting
Log Parsers
Log Parsers are utility programs that allow the investigator to be able to format raw log entries into a format that is useful for an investigation.
Chapter 13
Forensic and Investigative Accounting

14. Forensic and Investigative Accounting
Conclusions
Expanded methods to standardize security policies are being made in an attempt ot make it more difficult for cybercrimes to attack the financial databases of companies. The passage of time will determine the success of these methods.
Chapter 13
Forensic and Investigative Accounting