Fraud Investigations - Timeliness

Do you suspect fraud?  What you should know to take immediate action.

The bulk of fraud investigations require careful consideration of three important technical steps. In this write-up, I will highlight the importance of timeliness, followed by information on completeness and preservation techniques in my next articles.

Here are my top three reasons for immediate action if you suspect fraud in order to reduce the risk of spoliation.
​

1. If your company’s email system is Outlook, deleted emails by default will only remain in the Exchange database for 15 days. After 15 days, they will be unretrievable.
2. Other web mail providers such as Gmail, iCloud, Hotmail, Yahoo, AOL, etc. vary in their restoration process and likelihood of retrieval.
3. While the popularity of Solid State Drives (SSDs) are due to their recent affordability and robust capabilities, the downside is that data is seldom recoverable due to the “trim” command, which immediately wipes the storage space being erased.

In conclusion, the longer you wait, the higher the risk of data loss. ​

The items above are considered friendly advice. Not all computer fraud investigations are the same.