Analyzing Evidence Flashcards
List examples of data analysis queries that can be performed by data analysis software
- Summarize payroll activity by specific criteria for review.
- Identify changes to payroll or employee files.
- Compare timecard and payroll rates for possible discrepancies.
- Prepare check amount reports for amounts over a certain limit.
- Check proper supervisory authorization on payroll disbursements
Steps to be considered in each data analysis engagement
(1) Planning phase
- Understand the data.
- Define examination objectives.
- Build a profile of potential frauds.
- Determine whether predication exists.
(2) Preparation phase
- Identify the relevant data.
- Obtain the data.
- Verify the data.
- Cleanse and normalize the data.
(3) Testing and interpretation phase
- Analyze the data.
(4) Post-analysis phase
- Respond to the analysis findings.
- Monitor the data.
What is structured and unstructured data?
Structured data are the type of data found in a database, consisting of recognizable and predictable structures. Examples: sales records, payment or expense details, and financial reports
Unstructured data, by contrast, are data that would not be found in a traditional spreadsheet or database - text based
What is STEGANOGRAPHY?
the process of hiding one piece of information within an apparently innocent file
What are the FOUR common methods to detect the use of steganography?
(1) Visual Detection - looking for visual anomalies in jpeg, bmp, gif, and other image files
(2) Audible Detection - looking for audible anomalies in wav, mp3, mpeg, and other media files
(3) Statistical Detection - determining whether the statistical properties of files deviate from the expected norm
(4) Structural detection - looking for structural oddities that suggest manipulation (e.g., size differences, date differences, time differences, or content modification)
What are the steps in evidence collection?
(1) examine and document the machine’s surroundings
2
What are the unique challenges of cloud forensics not faced in traditional forensic practices?
- Lack of frameworks and specialist tools
- Lack of information accessibility
- Lack of data control
- Jurisdiction of storage
- Electronic discovery
- Preserving chain of custody
- Resource sharing
- Lack of knowledge
What is Link Analysis?
- very effective for identifying indirect relationships and relationships with several degrees of separation
- useful when conducting a money laundering investigation, since it can track the placement, layering, and integration of money as it moves around unexpected sources
Link analysis software is used by fraud examiners to create visual representations
What is chain of custody?
both a process and a document that memorializes who has had possession of an object and what they have done with it
The memorandum should state:
- What items were received
- When they were received
- From whom they were received
- Where they are maintained
What is indented writing?
impression a writing instrument leaves on sheets of paper below the sheet that contains the original writing?
can be seen by employing an oblique-lighting method
What is Data Mining???
the science of searching large volumes of data for patterns
combines several different techniques essential to detecting fraud, including the streamlining of raw data into understandable patterns
effective way for fraud examiners to develop fraud targets for further investigation
What is textual analytics?
method of using software to extract usable information from unstructured text data
can be used to categorize data to reveal patterns, sentiments, and relationships indicative of fraud.
What are the 5 ADVANTAGES of using data analysis software?
(1) centralize an investigation, relying less on others to gather data
(2) ensure that an investigation is accurate and complete
(3) base predictions about the probability of a fraudulent situation on reliable statistical information
(4) search entire data files for red flags of possible fraud
(5) eveloping reference files for ongoing fraud detection and investigation work
What is IMAGING?
the process whereby a forensic image of a hard drive or other digital media is made and imaged to another hard disk drive or other media for forensic analysis
Imaging the data from suspect devices allows a fraud examiner to view and analyze a computer’s contents without altering the original data in any way.
What is multi-file processing?
allows the user to relate several files by defining relationships between multiple files, without the use of the Join command
