At what point in a case should a forensic investigation be initiated?Whitney Irish
Once a case for fraud has been initiated, when should a forensic investigation be done?
As early as possible, for a couple reasons:
- One is, once an investigation begins, there is opportunity for the perpetrator to destroy evidence. You want the investigation by the forensic team to start before that happens.
- Also, in the case of computer imaging to reveal data, we have to face the unfortunate situation that data can be overridden. So, something that has been deleted from a hard drive can be recovered as long as someone hasn’t overridden it with new files. The quicker you begin the investigation, the easier it is to overcome this problem.