1. Forensic and Investigative Accounting Chapter 13 Computer Forensics: A Brief Introduction © 2007 CCH. All Rights Reserved. 4025 W. Peterson Ave. Chicago, IL 60646-6085 1 800 248 3248 www.CCHGroup.com

2. Chapter 13Forensic and Investigative Accounting2 Definition of Computer Forensics Computer forensics is the analysis of electronic data and residual data for the purposes of its recovery, legal preservation, authentication, reconstruction, and presentation to solve or aid in solving technology-based crimes.

3. Chapter 13Forensic and Investigative Accounting3 SAS No. 99 Guidelines for Testing Digital Data SAS No. 99 states: In an IT environment, it may be necessary for the auditor to employ computer-assisted audit techniques (for example, report writers, software or data extraction tools, or other system-based techniques) to identify the journal entries or other adjustments to be tested.

4. Chapter 13Forensic and Investigative Accounting4 IT Guidelines under COSO Framework Guidelines have been established for these areas: 1. Internal control environment 2. Objective setting 3. Event identification 4. Risk assessment 5. Risk response 6. Control activities 7. Information and communication 8. Monitoring

5. Chapter 13Forensic and Investigative Accounting5 COBIT’s Goals COBIT’s goals are to set control objectives for IT compliance using a strategic planning perspective and at the same time to outline, in detail, the proper procedures to be followed for specific compliance measures.

6. Chapter 13Forensic and Investigative Accounting6 Technical Skills for Digital Evidence Collection Necessary skills are based on the following requirements: 1. Understanding of various operating systems 2. Quickly identifying pertinent digital data 3. Properly preserving data 4. Properly securing data 5. Properly collecting data 6. Maintaining a proper chain of custody

7. Chapter 13Forensic and Investigative Accounting7 Forensic Investigative Tools Imaging software: EnCase EnCase SafeBack SafeBack Data extraction or data mining software: ACL ACL Data Extraction and Analysis (IDEA) Data Extraction and Analysis (IDEA)