Fraud Examination Ch 7 - Investigating Theft Acts

Concealment Investigative Methods

• Document examination

• Audits

• Electrionic searches

• Physical asset counts

Theft Investigative Methods

• Surveillance & covert operations

• Invigilation

• Seizing and searching computers

• Physical evidence

Conversion Investigative Methods

• Searching public records’

• Online resources

• The net worth method

Inquiry Investigative Methods

• Interviews and interrogation

• Honesty testing

Considerations in proceeding with a fraud investigation;

• Perceived strength of the prediction - does it seem real?

• Perceived cost of the investigation

• Exposure or amount that could have been taken

• The signal that investigation (or lack thereof) sends to others inside and outside the organization

More considerations in proceeding witha fraud investigation:

• Risks of investigating and not investigating

• Public exposure or loss of reputation

• Nature of the possible fraud

• Impact on the organization’s culture

Vulnerability Chart

Coordinates elements of the possible fraud

Surveillance and Covert Operations

Theft investigation techniques that rely on the physical senses

3 main types of surveillance

• Stationary of fixed point

• Moving or tailing

• Electronic surveillance

Simple Fixed Point Observation

• Step 1 - Investigators locate the scene to be observed and action likely to occur at the scene

• Step 2 - Investigators keep detailed notes or video of the activities at the scene involving the suspect

Invigilation

Theft act investigative technique that involves close supervision of suspects during an examination period

Direct evidence of theft:

Broken locks, cutting marks, tire tracks, and fingerprints

Indirect evidence of theft:

Vehicle rental to transport stolen goods, computer evidence of conversion

Computer Forensics

The gathering of electronic evidence

Obtaining Electronic Evidence:

1. Secure the device & perform initial tasks

2. Clone the device and calculate a CRC number

3. Search the device manually

4. Search the device using automated procedures

Cyclic Redundancy Check (CRC)

Calculation verifies that your analysis was performed on unmodified data

Common programs that guide investigators through the electronic evidence gathering steps:

• Guidance Software’s EnCase Forensics

• Access-Data’s The Forensic Toolkit (FTK)

• E-fense’s Helix (Open source)

• Linux based BackTrack (open source)