How do you capture or recover electronic evidence on computers and cell phones?BondBeebe
Natalie Burchfiel, CPA
New technologies mean evidence of fraud may be electronic, hidden and difficult to detect. How do you capture or recover electronic evidence on computers and cell phones?
Obviously, an investigator can look at the files saved on a computer’s hard drive. Despite a fraud perpetrator deleting files and emptying the recycling bin, however, most files are still located somewhere on the hard drive. Using specially programmed computer forensic software, a trained computer forensic investigator can uncover these deleted files.
By using computer forensic software, an investigator can recover a file’s metadata, such as the created, last written, and last accessed dates. Computer forensic investigators can also unearth Internet search history and previously sent and received emails.
As for mobile devices, phones often create logs of all calls and text messages, and smart phones are increasingly used for storing both personal and work emails, as well as text and picture messages.Also, most smart phones now come with pre-installed GPS software, and there are endless possibilities that GPS locations with timeframes could have in providing convicting evidence for major criminal investigations.