Forensic Investigations and the importance of the right evidence

Where HR professionals require independent investigations, often in relation to senior executives involving serious allegations, engaging a forensic investigator and evoking legal professional privilege is often the wisest move.

Frazer Jones were delighted to host a seminar in conjunction with Hall & Wilcox, where Donna Thomson, Partner, PPB Advisory, spoke on when to involve forensic investigators and the importance of evidence preservation and collection in the digital age.

Digital evidence looks at the electronic footprint left when people use computers, smartphones or other devices. Issues that need to be considered regarding digital evidence include:

  • recent access to and copying of, large quantities of electronic material
  • evidence of documents residing on external USB devices
  • activity associated with accessing and storing large volumes of documents in cloud based storage
  • destruction of electronic documents
  • fabrication of documents and emails
  • changes in patterns of digital behaviour
  • web based searches
  • communications with other parties (e.g. email, SMS)
  • installation of data wiping and anti-forensic tools used to cover ones tracks.

As many organisations now allow employees to ‘Bring Your Own Device’, the risks may far outweigh the benefits. Risks which may have flow on consequences to an investigation include:

  • platforms used that are not controlled by in-house IT
  • loss of corporate information if a device is sold or stolen
  • the ‘eternal’ digital footprint, if an app is used to search for deleted files that are subsequently distributed
  • peer-to-peer sharing apps, where information may be shared inadvertently or maliciously
  • apps with ‘surveillance’ capabilities, e.g. Facebook can now activate your microphone while you are using it - in order to understand your physical surrounds.

Preservation and uncovering of evidence in an investigation in a timely and cost efficient manner is critical to the investigation and HR professionals must give consideration to:

  • policies and procedures, especially IT policies covering BYOD
  • gathering of original evidence
  • electronic devices – where are they, who owns them and what do you need access to?
  • cloud storage and IT infrastructure
  • photographs of evidence in-situ
  • contemporaneous notes

These issues were considered in the context of some real life examples that Donna Thomson, has encountered during her 10 plus years of investigating ‘white collar crime’ and misconduct investigations.

For more information on how PPB Advisory forensics team can undertake investigations or utilise forensic technology to analyse, recover, or reconstruct the information you need to mount a successful case or deliver a positive outcome for your organisation, please contact her.