Justin Sloane Archives - Schindlers Forensics AI

INTODUCTION – WHAT IS FORENSIC AUDITING?

Fraud and corruption continue to threaten the success of business entities within South Africa. To add to this, the ever-evolving advancements of information technology contribute to the ease in which perpetrators perform fraudulent activities and conceal their transgressions. This leaves entities susceptible to exploits and crimes that are bound to have damaging financial effects on the functioning and continuation of the business.

Forensic auditing thus contemplates an investigation into an entity’s financial and legal affairs, in an effort to uncover suspicious fraudulent activities that may have taken place within such entity. ¹

Such investigations and the findings that transpire, may thereafter be used in legal proceedings instituted in order to prosecute a party for the financial crimes and/or fraudulent conduct perpetrated and recover the funds through the civil courts.

¹ Van Wyk, A. C.; Vorster, J. Legal Challenges Facing Forensic Auditing. Available from: http://icsa.cs.up.ac.za/issa/2006/Proceedings/Research/85_Paper.pdf (03/08/2020)

THE ROLE OF THE FORENSIC AUDITOR

It is vital that the collection of evidence in a forensic audit be considered admissible by a court of law, should the entity decide to prosecute the perpetrator/s of such fraudulent conduct. The forensic auditor is thus obliged to ensure that the methods used in the conduct of its investigation falls within the confines of the law of evidence. Accordingly, the role of a forensic auditor may be summarised to include the:²

identification of offenders;
identification of the means used and time period of the fraud;
determination of the financial impact of such fraud on the entity;
collection of evidence to allow the entity to take action against the perpetrator/s; and
advising the entity on the corrective action that may be taken in respect of the failed controls of the entity.

² Barlow, P. Helberg, S. Large, N. Le Roux, K. 1995. The Business Approach To Internal Auditing. Juta & Co, Ltd. Kenwyn Pg. 37 – 38)

While information technology may be used in the commission and concealment of fraud, it may also be effectively used by a forensic auditor in an attempt to detect possible fraud in an organisation. Technology allows for data analysis to be computerised and applied across an entity’s entire company database, in order to detect transgressions. The reports that are generated by such technology progresses a forensic auditor’s understanding of the business of an entity. This automated method contributes to the conservation of time, resources and audit costs contemplated in the forensic audit. ³

ADMISSIBILITY OF FORENSIC EVIDENCE

The admissibility of evidence, as discovered through a forensic audit, is imperative to the success or failure in the prosecution of perpetrators. Computer generated evidence is considered as ‘hearsay’ evidence in South African courts and, as such, is considered as inadmissible, unless the person upon whose credibility the probative value of such evidence depends, testifies at such proceedings. ⁴

³ Lanza, R. “How to Use a New Computer Audit Fraud Prevention and Detection Tool“. http://www.isaca.org
⁴ Section 3(1) of the Law of Evidence Amendment Act 45 of 1988

Accordingly, unless the forensic evidence can be attested to by the individual responsible for generating the data, the courts will deem such evidence inadmissible. It is common that information technology professionals who assist forensic auditors will be required to attest to the accuracy and dependability of the computer-generated evidence in a court of law.

Furthermore, section 3(1) of the Law of Evidence Amendment Act 45 of 1988 (“the Act”) provides that hearsay evidence shall not be admitted as evidence at civil or criminal proceedings, unless the court regards the admission of same to be within the interests of justice. The Electronic Communications and Transactions Act 25 of 2002 (“the ECTA”), which also governs computer evidence in South Africa, provides that the reliability of evidence is largely dependent on the following factors:

the manner in which the evidence was generated, stored or communicated;
the reliability of the manner in which the veracity of the evidence was maintained;
the identification of the originator; and
other relevant factors.

Additionally, a court is likely to take into account the interference in the custody of such forensic evidence, in assessing whether the admission of same could be prejudicial to a litigating party.

It is evident that a litigating party will need to establish one of the above exceptions, in order to render forensic evidence admissible before a court. However, notwithstanding the general inadmissibility of computer evidence, it is submitted that electronic data is often extremely steadfast and should be conferred the appropriate weight by the South African courts.

CONCLUSION

The boom in technological development undoubtedly caters for the success of an entity’s business, but also contributes heavily to the ease in which fraudulent activities may be conducted in such entity.

Employing the services of a forensic auditor, who is well-versed in the intricacies of information technology can only assist in the expedited prosecution of perpetrators and the subsequent recovery of any financial losses suffered as a result of their conduct. However, as evidenced above, it is crucial that a forensic auditor is kept abreast of the South African laws of evidence, in order to ensure that the discovered evidence may be effectively used in a court of law.

This is the very basis upon which Schindlers Forensics is established. As such, it is advisable that, when requiring assistance in forensic investigations, that you employ a multidisciplinary team, who understands the workings of auditing, accounting and law, in order to propose tailored solutions and recommendations to ensure compliance and prevent commercial crime within your entity.

INTRODUCTION TO DIGITAL FORENSICS

Technology, the internet, data it has all become inextricably linked to the majority of our lives. The rise of technology has revolutionized and molded the world in which we live today whilst simultaneously creating new obstacles and threats businesses and individuals should be aware of.

Digital forensics can be defined as:

“The use of scientifically derived and proven methods toward the preservation, validation, identification, analysis, interpretation, documentation and presentation of digital evidence derived from digital sources for the purpose of facilitating or furthering the reconstruction of events found to be criminal, or helping to anticipate unauthorized actions shown to be disruptive to planned operations.” ¹

¹ Gary L Palmer. (2001). A Road Map for Digital Forensic Research. Technical Report DTR-T0010- 01, DFRWS.

To put this simply, digital forensics involves the investigation of electronic devices including computers, mobile phones, storage devices (hard drives and memory cards), which have been utilized in an illegal or unauthorized manner. The purpose of this article is to provide some insight into what digital forensics is, why it has become so important in the modern world and an overview of digital forensic procedures.

THE IMPORTANCE OF DIGITAL FORENSICS

The emergence of the internet and technology has led to the emergence of new crimes and has prohibited practices which can be committed in the online world. Similarly, electronic devices, such as, cellphones and laptops have been used to store data, which has either been obtained illegally (through hacking or phishing scams for example) or which proves an offence has been committed (video footage of an incident).

The importance of digital forensics includes, but is not limited to, the following:

Digital forensics may act as a preventative tool against certain malicious events being committed against an individual or company;
It assists in identifying those involved in the commission of an offence and assists in tracing the events which lead to the commission of an offence;
Digital forensics assist in securing convictions against those who have committed “cybercrimes”; and
Digital Forensics assists in educating individuals and improving awareness about the risks and vulnerabilities posed within the online world.

Digital forensics acts not only as an important reactive tool which may be employed once an offence has been committed but it further acts as a proactive tool which may be used by companies and individuals to ensure they are adequately protected from any malicious digital conduct.

Digital forensics has become an important tool in the prosecution of criminal offences, where once the relevant data has been extracted and analysed, it may be presented as evidence in court. This will often take the form of a report compiled by the forensic investigator and may even require the investigator to give oral evidence during the trial, wherein they will explain the report and how they came to their findings.

Companies and individuals store majority of their sensitive information, such as, banking details, trade secrets and intellectual property information on electronic platforms. Digital forensics has and will continue to become increasingly important as this information needs to be protected from falling into the wrong hands.

DIGITAL FORENSIC PROCEDURE

Currently, there exists no standardized procedure which is adopted uniformly when digital forensic investigations are being conducted. Although, there exists a need for a standardized procedure, it may be better that a more flexible approach is adopted due to the rapid advancements in technology over the years.

There are, however, certain procedures which have been adopted over the years incorporating various phases within the forensic procedure to ensure optimum results are achieved. In general, the process of digital forensics incorporates four stages, namely:

Preservation – this stage is primarily aimed at preventing any conduct which may prevent digital information being collected. It entails certain activities such as preventing individuals from using electronic devices, preventing and halting deletion processes and identifying the safest manner in which the relevant data may be collected.
Collection – this stage includes both the physical removal of electronic devices as well as the extraction of data from these devices. It is important that this is done in a manner which maintains the integrity of the data.
Examination – this stage consists of a search which is conducted on the electronic devices in a manner which systematically identifies and extracts the data which may be relevant to the investigation. This will entail the extraction of log files, relevant data files, etc.
Analysis – this stage, in essence, involves an analysis of the information which has been extracted and drawing conclusions therefrom in relation to the specific investigation being conducted.
Reporting – this is the final stage, which requires the forensic investigator to prepare a report which details their findings and conclusions, drawn from their forensic investigation and, if necessary, presenting such evidence in court.

The above outlines the general investigative process which is found in digital forensic investigations; however, certain specific digital forensic procedures may incorporate variations to the stages outlined above or certain additions thereto. By way of example, the Integrated Digital Investigation Model consists of various phases, such as:

Readiness Phase;
Deployment Phase;
Physical Crime Scene Investigation Phases;
Digital Crime Scene Investigation Phases; and
Review Phase.

Whilst the process adopted in each unique digital forensic procedure exceeds the bounds of this article the above serves to show the variety of procedures which may be adopted during a digital forensic investigation.

THE FUTURE OF DIGITAL FORENSICS

Nobody can be certain what the future may hold, however, it is expected that digital forensics may become even more prevalent in South Africa in the years to come. In 2017 the Cybercrime and Cybersecurity Bill B6 (“the Bill”) was presented which seeks to give effect to a number of cybercrimes.

The Bill primarily deals with crimes involving data such as the unlawful accessing and obtaining of data which becomes a criminal offence under the Bill. Unlawfully acquiring another individual’s password and using data for unlawful purposes will further become a criminal offence.

The Bill proposes procedures and seeks to enable the South African Police Services to investigate, as well as search and seize data and devices, which have been used in cybercrimes. Cybercrimes are currently investigated in accordance with the Criminal Procedure Act 51 of 1997, however, this position will change when/if the Bill becomes legislation.

Whilst the Bill is only draft legislation currently, should the Bill be enacted digital forensics will become increasingly important in giving effect to the Bill. Digital forensics will be utilized to investigate the crimes which have been perpetrated in terms of the Bill. This will undoubtedly increase the prevalence of digital forensics not only within the private sphere but also within the public sphere as government develops and adopts their own digital forensic investigation procedures.

COVID-19 has forced many individuals to work remotely where possible, communicating with their colleagues exclusively through electronic platforms, such as, emails, Zoom, Microsoft teams etc. It has been speculated that many businesses may seek to adopt remote working measures even once a vaccine or cure for COVID-19 has been found.

This will create an even greater reliance on technological means of communicating, and transfer data and so this may create further risks and security requirements for such communications of transfers. Digital forensics will allow one to test and identify weaknesses in a company’s online systems and ensure they are protected to the fullest extent.

Finally, given the rapid increase in technology which has occurred in recent history and which will continue in the future, the developments of such technology will require adequate digital forensic mechanisms to ensure all measures are taken for the safety of a company/individual’s data. The importance of digital forensics cannot be understated and as can be seen from the above this importance will likely continue to grow in the near future.

CONCLUSION

As technology advances, so too will digital forensics which will become more advanced, accurate and prevalent in our society. As the importance of digital forensics increases individuals will be required to gain a knowledge into the practice to ensure they are adopting the most effective measures within their organizations or personal lives.

Digital forensics will further become an increasingly important tool in investigating crimes and other malicious practices which have been committed against an individual or company.

The purpose of this article is to shed some light on digital forensics and the practices which are utilized in this process in an attempt to provide the reader with a basic knowledge as to what digital forensics entails.

Schindlers Forensics has a wide array of experience which will prove to be essential in conducting in any digital forensic investigation which investigation will be tailored to your own personal needs. Should you require assistance please do not hesitate to contact us.