Investigation Flashcards
Graphology (graphoanalysis)
Graphology (or graphoanalysis) has been described as a pseudoscience in which its practitioners have the purported ability to determine a person’s character, moral traits (honesty/dishonesty, etc.), personality, and mental state based upon an analysis of that person’s handwriting. Graphology is often erroneously confused with forensic document examinations, especially by the media. Fraud examiners should be aware that some individuals practicing graphological analyses might have little academic and scientific training.
Anachronisms
Anachronisms are items located at a time when they could not have existed or occurred. Generally, exposing anachronisms in fraudulent historical documents requires the expertise of investigators, historical experts, scientific laboratories, and forensic document examiners. For example, accurate handwriting comparisons are rarely possible in the absence of adequate contemporaneous genuine writings of the purported author. In such cases, the experts will examine the materials used to produce the documents, such as paper, ink, printing, adhesives and seals, bindings, and covers.
Often, to add credibility to forged documents, fraudsters will backdate them. To determine whether contemporary documents were backdated, experts usually rely on diligent investigation and forensic document examiners.
The proper method for developing latent fingerprints that have been absorbed into porous materials, such as paper, is to dust them with fingerprint powder. T/F
Fraud examiners should never try to develop latent fingerprints that have been absorbed into paper or other porous materials by dusting with fingerprint powder or any other means. Such efforts will not only be unsuccessful, but they will prevent additional examinations. Instead, fraud examiners should preserve the evidence by placing it into a labeled protective container, such as a sealable, acid-free paper envelope. Also, fraud examiners should label the item’s container with their initials, the current date, where the document was taken from, and an identifying exhibit number (if any).
Experts will use various methods to examine fingerprints on porous surfaces, including iodine fuming and brushing or spraying silver nitrate solution or ninhydrin spray, which reacts with the body chemicals and other substances in the latent prints that have soaked into the absorbent surface. Some of these methods will permanently discolor a document.
Best way to organize large amount of evidence
Keeping track of the amount of paper generated is one of the biggest problems in fraud cases. Good organization in complex cases includes the following:
Segregating documents by either witness or transaction
Making a “key document” file for easy access to the most relevant documents
Establishing a database early on in the case of a large amount of information
During the evidence gathering stage of an investigation, organizing the documents chronologically is not recommended because it will make searching for relevant information more difficult. It is generally better to organize the documents by transaction or by party. The fraud examination report often follows a chronological timeline to give a narrative of a fraud scheme, in which case displaying key documents chronologically often makes sense. But in the organization phase, there usually is too much clutter for chronological organization to be effective.
A(n) ___________ is a writing, usually a signature, prepared by carefully copying or tracing a model example of another person’s writings.
A simulated or traced forgery is a writing, usually a signature, prepared by carefully copying or tracing a model example of another person’s writings. Although identifiable as a forgery, a simulated, or traced signature, forgery often does not contain enough of the forger’s normal handwriting characteristics to permit expert identification.
Autoforgery
A person creates a forgery of their own name and deny it later on.
Limitation to Benford’s Law
Benford’s Law distinguishes between natural and non-natural numbers, and it is important to understand the difference between the two types because Benford’s Law cannot be applied to data sets with non-natural numbers. Natural numbers are those numbers that are not ordered in a particular numbering scheme and are not human-generated or generated from a random number system. For example, most vendor invoice totals will be populated by dollar values that are natural numbers. Conversely, non-natural numbers (e.g., employee identification numbers and telephone numbers) are designed systematically to convey information that restricts the natural nature of the number. Any number that is arbitrarily determined, such as the price of inventory held for sale, is considered a non-natural number.
Which of the following data analysis functions is most useful in testing for hidden journal entries?
Gap testing is used to identify missing items in a sequence or series, such as missing check or invoice numbers. It can also be used to find sequences where none are expected to exist (e.g., employee Social Security numbers). In reviewing journal entries, gaps might signal possible hidden entries.
First phase of data analysis: and tasks involved.
As with most tasks, proper planning is essential in a data analysis engagement. Without sufficient time and attention devoted to planning early on, the fraud examiner risks analyzing the data inefficiently, lacking focus or direction for the engagement, running into avoidable technical difficulties, and possibly overlooking key areas for exploration.
The first phase of the data analysis process is the planning phase.
This phase consists of several important steps, including: Understanding the data Articulating examination objectives Building a profile of potential frauds Determining whether predication exists
Textual analytics
Textual analytics can be used to categorize data to reveal patterns, sentiments, and relationships indicative of fraud.
Why would a fraud examiner perform duplicate testing on data?
To identify transactions with matching values in the same field
Examples of data analysis queries that can be performed by data analysis software on asset accounts to help detect fraud:
The following are examples of data analysis queries that can be performed by data analysis software on asset accounts to help detect fraud:
• Generate depreciation to cost reports.
• Compare book and tax depreciation and indicate variances.
• Sort asset values by asset type or dollar amount.
• Select samples for asset existence verification.
• Recalculate expense and reserve amounts using replacement costs.
Join function
Data analysis technique that combines fields from two sorted input files into a third file.
Example: Compare two different files with differing records, or looking for ghost employees by comparing payroll to employee master file
A fraud examiner is conducting textual analytics on journal entry data and runs a keyword search using the terms override, write off, and reserve. With which leg of the fraud triangle are these fraud keywords typically associated?
Opportunity.
Link analysis
data analysis tool that is effective in identifying indirect relationships and relationships with several degrees of separation
multi-file processing
data analysis software function that allows users to relate several files by defining relationships in collected data, without the use of the join command.
Which of the following is an example of a data analysis function that can be performed to help detect fraud through examination of payroll accounts?
A. Compare customer credit limits and current or past balances.
B. Compare approved vendors to the cash disbursement payee list.
C. Identify paycheck amounts over a certain limit.
D. Generate depreciation to asset cost reports.
Identify paycheck amounts over a certain limit.
The following are examples of data analysis queries that can be performed by data analysis software on payroll accounts to help detect fraud:
• Summarize payroll activity by specific criteria for review.
• Identify changes to payroll or employee files.
• Compare timecard and payroll rates for possible discrepancies.
• Prepare check amount reports for amounts over a certain limit.
• Check proper supervisory authorization on payroll disbursements.
The primary concern when analyzing digital evidence is
The primary concern when analyzing digital evidence is to maintain the integrity of the data at all times. Fraud examiners must be especially careful with computer equipment because a careless investigator might inadvertently alter important evidence. Therefore, it is helpful to develop procedures to prevent the opposing party from raising allegations that the methodology used to collect or analyze data was improper and could have damaged or altered the evidence
When a forensic investigator is seizing a running computer for examination, he can retrieve data from the computer directly via its normal interface if the evidence needed exists only in the form of volatile data. T/F
True
When seizing a computer that is running, the party seizing the system should not, in most situations, search the computer for evidence because doing so might damage and taint relevant evidence. But in some situations, it might be appropriate to perform live evidence collection (i.e., collect evidence during the seizure phase when a suspect system is not shut and is up and running). Generally, live evidence collection (i.e., collection directly from the computer via its normal interface) is appropriate when a formally trained computer investigator is seizing the computer, and the evidence that the investigator needs to collect exists only in the form of volatile data.
When analyzing data for evidence, the fraud examiner should look for…
When analyzing data for evidence, the fraud examiner should look for inculpatory evidence (i.e., evidence that serves to incriminate the subject of the investigation) and exculpatory evidence (i.e., evidence that serves to disprove the subject’s involvement in the misconduct).
Cloud forensics presents challenges not faced in traditional forensic practices
Conducting digital forensic investigations in the cloud environment (i.e., cloud forensics) presents challenges not faced in traditional forensic practices. Some of the important challenges of acquiring evidence from the cloud are: Lack of frameworks and specialist tools Lack of information accessibility Lack of data control Jurisdiction of storage Electronic discovery Preserving chain of custody Resource sharing Lack of knowledge
Metadata
Metadata is a type of computer-generated data that can be helpful in a fraud investigation. Metadata is data about data, and these file tidbits contain a tremendous amount of information. Metadata information can help determine who wrote a document; who received, opened, copied, edited, moved, or printed the document; and when these events occurred.
What is the procedure used to convert information using an algorithm (called a cipher) that makes the information unreadable.
Encryption
