Fraud Investigations - Completeness

Don't get caught short! Consider all sources of digital evidence. 

It is imperative that evidence is collected and preserved from a pool of suspects who could potentially be involved in the fraud. A corporate employee hierarchy chart can help determine all possible suspects. Consider administrative assistants and/or individuals who reported the fraud, they could be involved. Once you have pinpointed the suspects, collect and preserve data from their desktops, laptops, smartphones and corporate/personal emails in a forensically sound manner.
 
Moreover, cloud storage such as Dropbox, Google and iCloud are potential places where evidence may be found. To identity an individual’s cloud storage provider, check their expense reimbursements or vendor payments. Remember to obtain a release if data will be pulled from personal accounts.
 
Lastly, consider email archive systems if available. It’s a good source to collect and preserve from because archive systems retain all emails even if the user has deleted them from their mailbox.
 
In conclusion, don’t get caught short, consider all sources of digital evidence and be ready to defend your decisions. 
​​
The items above are considered friendly advice. Not all computer fraud investigations are the same.