Computer Forensics - Case History

A mid-sized manufacturing company suspected that their Finance Director's PA had systematically been defrauding the company over a period of at least 18 months. Unusually, OVAG technical staff were called in before any disciplinary action or investigation by the IT department had taken place.

This enabled software to be installed on the company network which allowed monitoring and logging of all actions taking place on the PA's workstation. In addition, a forensically sound copy was taken of the hard drive in the workstation.

The monitoring facility was left in place for a period of two weeks, during which time the PA was allowed to continue working 'as normal'. At the end of the second week, over the weekend, the activity logs were examined. These logs showed the PA opening the suppliers' payment spreadsheet twice for a period of up to 15 minutes during lunch breaks.

Screenshots taken at regular intervals during this period showed increases to payment amounts to two particular suppliers. However, cross checking the workstation log-on times and the building access control swipe card times, along with CCTV footage, showed that the PA was off site during the periods of interest and could not, therefore, have made the alterations.

A cross-check of the suppliers, names and directors with the company's staff database highlighted a member of staff who resided at the same address as one of the suppliers. This member of staff had also occasionally filled in for the PA and therefore knew her password.

The member of staff was interviewed and presented with the evidence. She admitted the fraud and that the two suppliers were both owned by different members of her family.

Subsequent civil action recovered over £150,000 of the fraudulent payments. The file and supporting evidence was passed to police and a conviction followed.