Newsletter Expansion Announcement

This edition of the Cyber Crime & Computer Forensics News will be the last issue as you know it. Moving into 2009, our readers can expect a new and expanded newsletter, focusing on broader issues relating to investigations, including forensics, analysis and fraud. The new newsletter, tilted Investigation Insight, will continue to be free of charge and circulated monthly via e-mail. Stay tuned for Investigation Insight, coming to your Inbox January 2009!

	From the Bench: Courts Rely on a Computer Forensic Expert
	Technology You Should Know: Uncovering Fraud Through Investigation and Forensics
	News & Events

From the Bench: Courts Rely on a Computer Forensic Expert

Magistrate Judge Recommends Default Judgment for Laptop Spoliation, Finding Lesser Sanctions Inadequate
Gutman v. Klein, 2008 WL 4682208 (E.D.N.Y. Oct. 15, 2008). In this fraud litigation, the plaintiffs sought default judgment and monetary sanctions claiming the defendants destroyed crucial evidence on a laptop belonging to one of the defendants. Previously, the court ordered a court-appointed forensic expert to analyze the hard drives for evidence of a deletion program. The examiner forensically copied the hard drive, discovered that a deletion program did exist, and that hundreds of documents were deleted. The forensic expert also discovered that the computer's system clock had been altered, calling into question the integrity of the time stamps in the event logs. Finding that the plaintiffs demonstrated spoliation of evidence on the laptop and that the evidence was relevant, the magistrate judge determined the defendant acted in bad faith and recommended a default judgment, holding that the spoliation made it impossible to identify files, therefore making lesser sanctions inadequate. The magistrate judge also recommended awarding attorneys' fees to the plaintiffs relating to all expenses incurred regarding the laptop, but did not recommend that any punitive monetary sanctions be imposed.

To view additional case summaries visit: www.krollontrack.com/case-summaries/.

Technology You Should Know: Uncovering Fraud Through Investigation and Forensics

Employee fraud occurs far more often than one might expect, and organizations that fall prey often find themselves the victim of major financial and reputational damage as a result. According to Kroll's 2007/08 Global Fraud Survey, four out of five organizations experienced corporate fraud within the last three years, with the average company losing $20 million to fraudulent activities. To uncover the root cause of fraud and to prevent reoccurrence, interval investigations are often necessary. Organizations should consider the following best practices when conducting an internal investigation.

The first order of business when conducting an internal investigation is to create an investigative team that includes counsel, a forensic accountant and an investigator. The right investigator is often critical to the success of the investigation. The investigator must have skillful knowledge of how to review the types of data to be collected, have a thorough understanding of the facts of the case, and have extensive experience in the particular type of fraud investigation. Additionally, most internal investigations will require some sort of computer analysis; if your investigation involves data collection and/or analysis, be sure the investigator has experience in proper forensic protocols.

Once the investigative team is assembled, it is imperative to identify all potentially relevant evidence and make a determination as to its accessibility. To that end, the team will be called upon to determine the likely key issues, which will allow for the creation of a data map outlining the location of all potentially relevant information. This process will require an identification of key custodians and an account of how the company normally conducts business related to the fraudulent activity.

Further, protocol dictates that evidence must be preserved in such a manner as to protect its origin, integrity and chain of custody. Be sure to consider whether personal computers may be involved or other types of data stores. Investigators must secure the data from all sources in a defensible manner following proper forensic protocols in order to avoid tampering claims.

When approaching the interview process, it may be helpful to construct a timeline detailing the available evidence related to the fraudulent activities and the suspected players. This timeline will allow the investigator to have a clearer understanding of the potential fraud that occurred and will permit more efficient questioning during interviews. Additionally, use the information gained throughout the investigation in the interviews. This will result in a more efficient use of the interview process by allowing the investigator to ask pointed questions, properly gauge answers and establish if a witness is being untruthful or withholding essential information.

Applying best practices is vital in conducting a successful investigation into allegations of fraud. A sophisticated investigative team can increase the company's odds of determining who was involved in the fraud, giving your company a heightened chance to regain a portion of the losses and prevent future incidents of fraud.

To view Kroll's Global Fraud Report, please visit http://kroll.com/library/fraud/FraudReport_English-US_Oct08.pdf.

Back To Top

News & Events

#1 E-Discovery Provider 7th Year in a Row
Kroll Ontrack has been named the #1 electronic discovery provider in the 13th Annual Am Law Tech Survey. This survey, appearing in the October issue of Law Firm Inc., marks the seventh consecutive year that Kroll Ontrack has been awarded this honor. Of the firms surveyed, 62% of the respondents identified Kroll Ontrack as their electronic discovery provider of choice. Polling CIOs and IT directors from the largest 200 law firms in America since 1995, the Am Law Tech Survey aims to reveal information about hardware, software, budgets, new developments and the latest legal trends. For the full story, please visit www.krollontrack.com/news-releases/.

Corporate ESI Policies Are On the Rise, But So Are E-Discovery Risks
A recent independent study of 403 in-house counsel—203 from the United States and the remainder from the United Kingdom—reveals in-house counsel understands the value in ESI preparedness but still struggle to gain executive support. The survey reported that 70% of US companies and 53% of those in the UK now have ESI policies in place, still leaving 28% of US and 40% of UK organizations at risk for substantial reputation damage and financial loss during litigation or investigations that involve the exchange of electronic evidence. The survey points to a lack of time and resources among corporations as the most common barriers to executing ESI policies. To download your complimentary copy of the survey, please visit www.krollontrack.com/esitrends/.

Meet our representatives at the following events:

Visit http://www.krollontrack.com/upcoming-events/ for more information on these events and others.

Back To Top

We Request Your Input

Our legal consultants, project managers and technology experts strive to stay on top of e-discovery law. If you are aware of any additional local court rules or new cases in this area of the law, please contact us by writing to jshogren@krollontrack.com.

This newsletter was written by Gina Jytyla and Joni Shogren, Kroll Ontrack Staff Attorneys, with assistance from Kelly Kubacki and Meridith Socha, Kroll Ontrack Law Clerks. Ms. Shogren can be contacted by writing to jshogren@krollontrack.com.

For more information about e-discovery and computer forensics services, contact Kroll Ontrack at 800 347 6105 or http://www.krollontrack.com.