Chapters 7 & 8 - Investigating and Concealing Theft Acts

Question 1

Fraud investigation contains elements of 4 methods

Answer 1

theft investigation methods

concealment investigation methods

conversion investigation methods

inquiry investigation methods

Question 2

what factors to consider when deciding to investigate a fraud or not?

Answer 2

1 predication (fraud symptoms, tip, anomalies)

• cost
• strength of evidence
• public exposure risk

Question 3

Proper sequence of events to resolve allegations:

Answer 3

1. identify the allegation
2. review source documents and records
3. employ other investigative procedures
4. interview those you think are innocent
5. interview suspect(s)

these steps move from outward to inward

Question 4

what is invigilation

Answer 4

a period of extremely tight controls making it nearly impossible for someone to continue their fraud. purpose is to establish a baseline to see how much fraud is really taking place

Question 5

what is a period of extremely tight controls for the purpose of establishing a baseline of normal activity

Answer 5

invigilation

Question 6

things to be careful about when imposing invigilation

Answer 6

• its expensive

- its invasive and people may quit, so get management’s approval

Question 7

steps to gathering electronic evidence

Answer 7

1. secure the device and perform initial task
2. clone the device and calculate a CRC checksum
3. search the device manually
4. . searching the device using automated procedures (forensic software)

Question 8

explain securing the device and performing initial tasks

Answer 8

• must have a right to seize it
• must maintain a clean chain of custody
• take pictures of seizure site, have witnesses
• pull computer plug, DO NOT shut down normally

Question 9

explain cloning the device and calculate CRC Checksum

Answer 9

• perform a copy of the hard drive
• calculate CRC Checksum
• seal away original disk
• perform investigation on the cloned copy

Question 10

explain searching the device manually

Answer 10

search cloned copy for

• web history
• documents
• trash bin
• emails
• usb drives
• recently loaded files
• have someone check the server for their deleted emails