Deloitte Forensic Forensic Technology Conference of Regulatory Officers - CORO November 2012

© 2012 Deloitte Global Services Limited 2 Background What is Computer Forensics Defining the value of Forensic Technology Data sources Computer Forensics scenarios in trust accounts & Smartphone investigation Computer Forensic Analysis Questions Agenda

© 2012 Deloitte Global Services Limited 3 The process of identifying, preserving, analysing and presenting digital evidence in a manner that is legally acceptable in any judicial or administrative hearing Source: “What is Forensic Computing?”, Australian Institute of Criminology, Trends & Issues No. 118, June What is Computer Forensics?

© 2012 Deloitte Global Services Limited 4 Computer forensics is about the relationship between IT & the law of evidence.

© 2012 Deloitte Global Services Limited 5 Key assumptions arising from this relationship The examination results will be tendered in evidence The forensic methodology and technology will be tested The computer forensic examiners credibility will be challenged The computer is potentially a crime scene Majority of documents and records now stored in electronic form No investigation/litigation can be complete without the examination of all evidence Computers record many actions ….without the knowledge of the user Allows recovery of deleted and hidden documents Provides evidence which is accepted in court Why Computer Forensics?

© 2012 Deloitte Global Services Limited 6 Computer Forensic Workplace relations issues Theft of IP Misuse of IT resources Fraud & contract disputes Insolvency assistance

© 2012 Deloitte Global Services Limited 7 Data Sources Servers Backup tapes Databases Laptops Desktops

© 2012 Deloitte Global Services Limited Expert review of evidence through: - Computer Forensics - Data analysis - Forensic Accounting Where does Forensic Technology provide value to lawyers? 8 Client Conferences Information Gathering Legal Review Submissions for Court Orders Electronic Discovery Execution of Court Orders Court Hearings, Negotiation, Mediation Cost Recovery Expert statements to support court applications Computer forensic and investigative support for Anton Pillar orders Identify potential involvement of technology - on both sides of the matter Identify and secure evidence - Apply forensic methods - Awareness of legal issues Presentation of expert evidence Import collected evidence and facilitate electronic discovery Quantification of economic loss

© 2012 Deloitte Global Services Limited Scenario 1: & smartphone Investigation 9  An organisation has lost a senior employee to a competitor, and suspect the person has taken confidential business information upon leaving Forensic Activities 1.Recovering correspondence from multiple available sources 2.Searching & smartphone for unauthorised distribution of sensitive data 3.Reviewing conversations to identify the context of communications Results Confirmation that sensitive files have been ed to a ‘home’ account Identification of additional parties involved in the disclosure Corroboration of computer forensic evidence found at other sources Confirmation of the possible presence of evidence held by the person

© 2012 Deloitte Global Services Limited Scenario 2: Computer Forensic Analysis 10  An organisation has identified that serious misconduct is occurring, and need to confirm the persons involved and extent of misconduct Forensic Activities 1.Forensic imaging of individual’s work computers 2.Recovery of deleted and fragmented files 3.Keyword searches for related material 4.Extraction of Internet history and application usage records 5.Reconstruction of the user’s computer activities Results Confirmation of the presence of inappropriate information on the computer Understanding the context of the information Identifying additional sources of electronic evidence Confirming the need for law enforcement involvement

© 2012 Deloitte Global Services Limited 11

© 2012 Deloitte Global Services Limited 12

© 2012 Deloitte Global Services Limited

© 2006 Deloitte Touche Tohmatsu

Questions?

© 2012 Deloitte Global Services Limited 18 General information only This presentation contains general information only, and none of Deloitte Touche Tohmatsu Limited, Deloitte Global Services Limited, Deloitte Global Services Holdings Limited, the Deloitte Touche Tohmatsu Verein, any of their member firms, or any of the foregoing’s affiliates (collectively the “Deloitte Network”) are, by means of this presentation, rendering accounting, business, financial, investment, legal, tax, or other professional advice or services. This presentation is not a substitute for such professional advice or services, nor should it be used as a basis for any decision or action that may affect your finances or your business. Before making any decision or taking any action that may affect your finances or your business, you should consult a qualified professional adviser. No entity in the Deloitte Network shall be responsible for any loss whatsoever sustained by any person who relies on this publication. Confidential This document and the information contained in it is confidential and should not be used or disclosed in any way without our prior consent. About Deloitte Deloitte refers to one or more of Deloitte Touche Tohmatsu Limited, a UK private company limited by guarantee, and its network of member firms, each of which is a legally separate and independent entity. Please see for a detailed description of the legal structure of Deloitte Touche Tohmatsu Limited and its member firms. Deloitte provides audit, tax, consulting, and financial advisory services to public and private clients spanning multiple industries. With a globally connected network of member firms in more than 150 countries, Deloitte brings world-class capabilities and deep local expertise to help clients succeed wherever they operate. Deloitte’s approximately 170,000 professionals are committed to becoming the standard of excellence. About Deloitte Australia In Australia, the member firm is the Australian partnership of Deloitte Touche Tohmatsu. As one of Australia’s leading professional services firms. Deloitte Touche Tohmatsu and its affiliates provide audit, tax, consulting, and financial advisory services through approximately 5,700 people across the country. Focused on the creation of value and growth, and known as an employer of choice for innovative human resources programs, we are dedicated to helping our clients and our people excel. For more information, please visit our web site at Liability limited by a scheme approved under Professional Standards Legislation. Member of Deloitte Touche Tohmatsu Limited © 2012 Deloitte Touche Tohmatsu