You Need Forensic Technology!

It is almost inconceivable that in late 2003, bankruptcy trustees are conducting financial investigations without the benefit of this expertise. How can any trustee investigate the debtor and uncover assets, accounting and bankruptcy fraud without initiating a digital forensic accounting examination?

It is practically impossible for unscrupulous debtors or their officers to escape from the trail of e-data left behind in today's digitized business environment. Yet, little or nothing is being done by the trustees to protect the rights of creditors. When creditors suspect the existence of significant assets, a comprehensive risk (cost) reward (recovery) analysis is necessary.

Trustees and creditors need the skills of the digital forensic accounting technologist (“forensic technologist”) expertise as it relates to bankruptcy and litigation support for the 21st century. After a bankruptcy filing, the trustee and forensic technologist must be prepared to immediately begin to uncover, recover and analyze the debtor's e-data from any available digital data-storage source for the benefit of creditors. Forensic technologists understand this is not inexpensive, and it may need to be funded by creditors, but the bottom line is the rewards can be enormous. This article explains the process necessary to facilitate change and how to get the money back for creditors.

Time Is Not on the Creditors' Side

Fact: Since time is all-important, the trustee must obtain access to all computer hard disk drives (HDD), handheld PC/personal digital assistants (PDA), and digital devices, including but not limited to CDs, DVDs, Microdrives, CompactFlash, SmartMedia, SecureDigital, Memory Sticks and MultiMediaCards even before the Section 341 examination. A trustee will need to arrange for the forensic technologist to immediately observe and secure the computers and digital devices in place on site.

Fact: Hesitation on the part of the debtor and/or insiders to allow that examination may be considered an indication that necessary digital financial information is in jeopardy so long as controlled by the Debtor and insiders.

Fact: Creditors should always stop a trustee from having the auctioneer dispose of computers and digital devices before the forensic technologist has completed his or her preliminary examination. Many auctioneers immediately begin the process of having the computers HDD “wiped clean” of all the e-data. If the trustee is not listening, consider the need to apply for a protective order to stop this.

Question: Exactly what is necessitated from the forensic technologist?

Answer: Promptly examining the e-data to find where the money went and possibly who may have the money or property now, and getting it back are obvious goals for the creditors. A proper digital examination includes but is not limited to a review of the computerized accounting records, e-mail messages, instant messages, electronic memos, word processing documents, databases, spreadsheets, archives, presentations, graphics, and address books or other contact management data contained in the wide assortment of computers, digital devices or PDAs used by the debtor.

Question: How will the forensic technologist acquire the e-data?

Answer: The first step in maintaining the best practices for protecting the integrity and validity of the Debtor's digital information is for the forensic technologist to create what is called a forensic image (sometimes technically referred to as low-level bit-stream image) from the debtor's computer HDD, PDA, and digital devices. The forensic images will permit the trustee to assess the debtor's activities with a greater degree of completeness and this, in turn, allows the trustee to promptly ascertain the location of any hidden property for the benefit of creditors.

Question: Why can't the trustee just use the office staff or accountants?

Answer: Starting up or just turning on or off the debtor's computers, PDA and digital devices may jeopardize the evidence. Try as they may, trustees or others should never use the debtor's computers and attempt to copy its computer files and then somehow hope to find the trail of money or property. These actions will only succeed in compromising the integrity of the digital forensic evidence in the debtor's e-data.

Question: Why does the digital forensic image need to be created?

Answer: Before the trustee can begin to do an investigation of the debtor's financial information and the books and records, the trustee needs to have a digital forensic image created of the computer HDD, PDA and digital storage sources that are exact forensic image copies that will be admissible as evidence in court. The forensic technologist will match (bit by bit) the e-data present on the debtor's original source HDD, PDA and digital devices with the forensic image being created during the acquisition process. The process will provide a digital signature that is unique and cannot be replicated, except when the algorithm is applied to the same identical e-data, just like a fingerprint. The “trail of evidence” must be proven unbroken from the debtor's digital data sources to the witness stand.

Question: What would happen if the trustee fails to obtain the forensic image copies?

Answer: The real cost to the creditors would be enormous if the trustee fails to obtain the forensic image copies, and instead allows the debtor's computers, PDA and digital devices to be accessed by someone who lacks forensic technologist expertise. The debtor, insiders and others in an adversary proceeding might allege that the information obtained by the trustee from the debtor's computer HDD was unsubstantiated and could not be corroborated.

Question: Is the debtor or insiders hiding e-data from the trustee and creditors?

Answer: Invisible attachments. Valuable financial information in the form of e-data can be hiding behind legitimate files on the debtor's computer HDD as invisible attachments. The Microsoft NTFS file system provides for Alternative Data Streams (also referred to as Multiple Data Streams), and ADS allows for the hiding of the debtor's e-data such as books and records, documents, files, folders and programs. The trustee must find the second set of books. This important information is not visible unless one knows how to find it. The trustee should not allow this to be overlooked during the examination of the e-data.

There is also steganography or covered writing and encrypted e-data to consider. An investigation is made to locate encrypted information. Once these encrypted files are identified, it is necessary to decrypt them. A steganalysis, the inspection of digital files to detect steganography, is performed for the discovery of hidden embedded information inasmuch as steganography poses a significant threat to the recovery of money for the creditors. Most often, encrypted and hidden information will likely provide confidential evidence that the debtor or insiders are concealing. This evidence may provide extensive e-clues that could expose fraudulent accounting activities and point to fraudulent conveyances that can be recovered for the creditors.

Recovery of deleted information is next on the list. Most participants in the bankruptcy process are now aware, even after numerous and repeated scandals, that when you delete e-data, the computer only marks this information as deleted in the (computer) file system. Previously deleted e-data is extremely delicate from an evidentiary standpoint. Allowing the use (other than by the forensic technologist) of the debtor's computer HDD, PDA and digital devices during the investigation of a case will overwrite information on those devices. This will jeopardize discovery that could benefit the creditors.

In many cases, it is likely that e-data files have been deleted. The forensic technologist will search the discovered and recovered deleted files and documents for specific excerpts of text using GREP regular expressions (derived from UNIX), and this enables powerful text searches using special characters. In addition, logical expressions (Boolean) allows for searching using two or more search strings in a variety of ways and use lightning fast multiple simultaneous text searches of the debtor's e-mail messages, documents, and files. This information may provide the trustee with the evidence necessary to recover assets for the benefit of the creditors before the money is all gone.

Question: What are the economic benefits for the creditors in doing this?

Answer: The following is an example of how the digital forensic accounting technologist can benefit the creditors:

• Find hidden assets, including the ability to trace individual transactions from start to finish.
• Identify and reveal digital evidence related or pertaining to possible claims against Board of Directors for breach of fiduciary duty, fraud, theft, conversion and unjust enrichment.
• Detect and uncover unusual transactions, including money and property transfers and complex related-party activities.
• Identify and reveal digital evidence related or pertaining to possible claims against Preferred Shareholders for breach of contract and fraud.
• Expose facts and circumstances relating to issues of substance over form that could not otherwise be documented.
• Uncover fraudulent accounting activities.
• Discover undisclosed business or business activities to which assets may have been shifted.
• Detect hidden documents, including the ability to trace related activities.
• Identify and expose digital evidence related or pertaining to possible claims against Auditors for breach of contract, breach of fiduciary duty, aiding and abetting a breach of fiduciary duty, fraud and negligent misrepresentation, professional negligence, and securities fraud.
• Discover and expose digital evidence related or pertaining to possible claims against underwriters for breach of fiduciary duty, aiding and abetting a breach of fiduciary duty, claims of breach of contract, fraud and negligent misrepresentation, and securities fraud.
• Detect the backdating of vital documents leading to possible fraudulent conveyance actions.
• Reveal abuses, concealment and destruction of computers and e-data leading to ' 707(a), 707(b) and ' 727 referrals by the trustee.

Conclusion

Computers, digital devices, e-mail and the Internet have utterly changed how businesses operate today. However, creditors do have a solution for recovery in the digital e-age. Trustees and creditors need the skills of digital forensic accounting technologists, experienced in bankruptcy, litigation, financial and accounting matters. These experts, knowledgeable in computerized financial and accounting applications and especially effective in the analysis of complex financial information, provide maximum results for the ultimate benefit of the creditors. Dealing with the technical aspects of a case, the creditors need to be sure that the digital forensic accounting specialist follows established digital forensic methodologies.

Every bankruptcy professional understands that a Chapter 7 trustee has the duty to investigate a debtor's financial affairs and to ensure that books and records are properly turned over in accordance with Section 704. The debtor has the obligation, under Section 521(4), to “surrender to the trustee all property of the estate and any recorded information, including books, documents, records, and papers relating to property of the estate, whether or not immunity is granted under Section 344 of this title.” Likewise, Chapter 11 and Chapter 13 trustees and debtors have similar duties and responsibilities.

Setting and Consequences

Millions of individuals and businesses use electronic banking, computers, personal digital assistants, digital devices, e-mail, word processing, spreadsheets, and accounting software applications used to record and report on personal and business financial activities. Bankruptcy statistics are devoid of information regarding the number of business debtors using computers and digital devices. The reason is quite simple since, unfortunately for the creditors, most trustees do not have the understanding and technical expertise necessary to properly investigate digital technology in the modern financial world.

It is almost inconceivable that in late 2003, bankruptcy trustees are conducting financial investigations without the benefit of this expertise. How can any trustee investigate the debtor and uncover assets, accounting and bankruptcy fraud without initiating a digital forensic accounting examination?

It is practically impossible for unscrupulous debtors or their officers to escape from the trail of e-data left behind in today's digitized business environment. Yet, little or nothing is being done by the trustees to protect the rights of creditors. When creditors suspect the existence of significant assets, a comprehensive risk (cost) reward (recovery) analysis is necessary.

Trustees and creditors need the skills of the digital forensic accounting technologist (“forensic technologist”) expertise as it relates to bankruptcy and litigation support for the 21st century. After a bankruptcy filing, the trustee and forensic technologist must be prepared to immediately begin to uncover, recover and analyze the debtor's e-data from any available digital data-storage source for the benefit of creditors. Forensic technologists understand this is not inexpensive, and it may need to be funded by creditors, but the bottom line is the rewards can be enormous. This article explains the process necessary to facilitate change and how to get the money back for creditors.

Time Is Not on the Creditors' Side

Fact: Since time is all-important, the trustee must obtain access to all computer hard disk drives (HDD), handheld PC/personal digital assistants (PDA), and digital devices, including but not limited to CDs, DVDs, Microdrives, CompactFlash, SmartMedia, SecureDigital, Memory Sticks and MultiMediaCards even before the Section 341 examination. A trustee will need to arrange for the forensic technologist to immediately observe and secure the computers and digital devices in place on site.

Fact: Hesitation on the part of the debtor and/or insiders to allow that examination may be considered an indication that necessary digital financial information is in jeopardy so long as controlled by the Debtor and insiders.

Fact: Creditors should always stop a trustee from having the auctioneer dispose of computers and digital devices before the forensic technologist has completed his or her preliminary examination. Many auctioneers immediately begin the process of having the computers HDD “wiped clean” of all the e-data. If the trustee is not listening, consider the need to apply for a protective order to stop this.

Question: Exactly what is necessitated from the forensic technologist?

Answer: Promptly examining the e-data to find where the money went and possibly who may have the money or property now, and getting it back are obvious goals for the creditors. A proper digital examination includes but is not limited to a review of the computerized accounting records, e-mail messages, instant messages, electronic memos, word processing documents, databases, spreadsheets, archives, presentations, graphics, and address books or other contact management data contained in the wide assortment of computers, digital devices or PDAs used by the debtor.

Question: How will the forensic technologist acquire the e-data?

Answer: The first step in maintaining the best practices for protecting the integrity and validity of the Debtor's digital information is for the forensic technologist to create what is called a forensic image (sometimes technically referred to as low-level bit-stream image) from the debtor's computer HDD, PDA, and digital devices. The forensic images will permit the trustee to assess the debtor's activities with a greater degree of completeness and this, in turn, allows the trustee to promptly ascertain the location of any hidden property for the benefit of creditors.

Question: Why can't the trustee just use the office staff or accountants?

Answer: Starting up or just turning on or off the debtor's computers, PDA and digital devices may jeopardize the evidence. Try as they may, trustees or others should never use the debtor's computers and attempt to copy its computer files and then somehow hope to find the trail of money or property. These actions will only succeed in compromising the integrity of the digital forensic evidence in the debtor's e-data.

Question: Why does the digital forensic image need to be created?

Answer: Before the trustee can begin to do an investigation of the debtor's financial information and the books and records, the trustee needs to have a digital forensic image created of the computer HDD, PDA and digital storage sources that are exact forensic image copies that will be admissible as evidence in court. The forensic technologist will match (bit by bit) the e-data present on the debtor's original source HDD, PDA and digital devices with the forensic image being created during the acquisition process. The process will provide a digital signature that is unique and cannot be replicated, except when the algorithm is applied to the same identical e-data, just like a fingerprint. The “trail of evidence” must be proven unbroken from the debtor's digital data sources to the witness stand.

Question: What would happen if the trustee fails to obtain the forensic image copies?

Answer: The real cost to the creditors would be enormous if the trustee fails to obtain the forensic image copies, and instead allows the debtor's computers, PDA and digital devices to be accessed by someone who lacks forensic technologist expertise. The debtor, insiders and others in an adversary proceeding might allege that the information obtained by the trustee from the debtor's computer HDD was unsubstantiated and could not be corroborated.

Question: Is the debtor or insiders hiding e-data from the trustee and creditors?

Answer: Invisible attachments. Valuable financial information in the form of e-data can be hiding behind legitimate files on the debtor's computer HDD as invisible attachments. The Microsoft NTFS file system provides for Alternative Data Streams (also referred to as Multiple Data Streams), and ADS allows for the hiding of the debtor's e-data such as books and records, documents, files, folders and programs. The trustee must find the second set of books. This important information is not visible unless one knows how to find it. The trustee should not allow this to be overlooked during the examination of the e-data.

There is also steganography or covered writing and encrypted e-data to consider. An investigation is made to locate encrypted information. Once these encrypted files are identified, it is necessary to decrypt them. A steganalysis, the inspection of digital files to detect steganography, is performed for the discovery of hidden embedded information inasmuch as steganography poses a significant threat to the recovery of money for the creditors. Most often, encrypted and hidden information will likely provide confidential evidence that the debtor or insiders are concealing. This evidence may provide extensive e-clues that could expose fraudulent accounting activities and point to fraudulent conveyances that can be recovered for the creditors.

Recovery of deleted information is next on the list. Most participants in the bankruptcy process are now aware, even after numerous and repeated scandals, that when you delete e-data, the computer only marks this information as deleted in the (computer) file system. Previously deleted e-data is extremely delicate from an evidentiary standpoint. Allowing the use (other than by the forensic technologist) of the debtor's computer HDD, PDA and digital devices during the investigation of a case will overwrite information on those devices. This will jeopardize discovery that could benefit the creditors.

In many cases, it is likely that e-data files have been deleted. The forensic technologist will search the discovered and recovered deleted files and documents for specific excerpts of text using GREP regular expressions (derived from UNIX), and this enables powerful text searches using special characters. In addition, logical expressions (Boolean) allows for searching using two or more search strings in a variety of ways and use lightning fast multiple simultaneous text searches of the debtor's e-mail messages, documents, and files. This information may provide the trustee with the evidence necessary to recover assets for the benefit of the creditors before the money is all gone.

Question: What are the economic benefits for the creditors in doing this?

Answer: The following is an example of how the digital forensic accounting technologist can benefit the creditors:

• Find hidden assets, including the ability to trace individual transactions from start to finish.
• Identify and reveal digital evidence related or pertaining to possible claims against Board of Directors for breach of fiduciary duty, fraud, theft, conversion and unjust enrichment.
• Detect and uncover unusual transactions, including money and property transfers and complex related-party activities.
• Identify and reveal digital evidence related or pertaining to possible claims against Preferred Shareholders for breach of contract and fraud.
• Expose facts and circumstances relating to issues of substance over form that could not otherwise be documented.
• Uncover fraudulent accounting activities.
• Discover undisclosed business or business activities to which assets may have been shifted.
• Detect hidden documents, including the ability to trace related activities.
• Identify and expose digital evidence related or pertaining to possible claims against Auditors for breach of contract, breach of fiduciary duty, aiding and abetting a breach of fiduciary duty, fraud and negligent misrepresentation, professional negligence, and securities fraud.
• Discover and expose digital evidence related or pertaining to possible claims against underwriters for breach of fiduciary duty, aiding and abetting a breach of fiduciary duty, claims of breach of contract, fraud and negligent misrepresentation, and securities fraud.
• Detect the backdating of vital documents leading to possible fraudulent conveyance actions.
• Reveal abuses, concealment and destruction of computers and e-data leading to ' 707(a), 707(b) and ' 727 referrals by the trustee.

Conclusion

Computers, digital devices, e-mail and the Internet have utterly changed how businesses operate today. However, creditors do have a solution for recovery in the digital e-age. Trustees and creditors need the skills of digital forensic accounting technologists, experienced in bankruptcy, litigation, financial and accounting matters. These experts, knowledgeable in computerized financial and accounting applications and especially effective in the analysis of complex financial information, provide maximum results for the ultimate benefit of the creditors. Dealing with the technical aspects of a case, the creditors need to be sure that the digital forensic accounting specialist follows established digital forensic methodologies.