A member of the sales team, Mark Smith, hands in his notice, and does not say where he is going to work after leaving his current company. Two weeks after he has left, one of your primary clients informs you that Mr Smith has contacted him and is offering him a competitive service to your own. By investigating the computer used by Mr Smith whilst in your employment it is often possible to determine a number of activities of the individual:

• It is not uncommon to locate evidence of the theft of the client database, or other intellectual property such has design plans, or written software. There have been projects in the past where an individual has taken every piece of intellectual property, amounting to many Gigabytes of data providing them the resources to set up in direct competition in a matter of days
• Draft business plans for the start-up venture, or contractual discussions with a competitor firm / head hunter whereby Mr Smith discusses what he can bring with him
• Electronic discussions had with other staff members, who are still employed with the company, in collusion or support of Mr Smith and his activities

It has come to your attention that one of a team of five administration staff has been approving false invoices for payment, each invoice being slightly under the £5,000 threshold whereby a higher level of authorisation is required. By examining the computers used by such an administration team it is often possible to determine which person was responsible for the false invoices, and to trace assets of the individual for recovery:

• The false invoices are typically drafted with an application such as Microsoft Word. Traces of these authoring processes are often recorded on the computer
• It is often possible to determine access to the bank account to where the funds were paid
• Proof of property or other purchases using the ill-begotten funds are regularly evidenced on the user's computer. This can help with recovering damages

An employee has filed a case for unfair dismissal, and has produced a raft of hard copy email print-out purporting various discussions and agreements made during their employment. You strongly dispute the veracity of these documents, and the supposed agreements documented:

• By investigating the hard copy print-out for anomalies, it can be possible to question the authenticity of the documents
• By investigating you systems it can be possible to evidence the electronically recorded documents, and compare the content, or to evidence the absence of such documents
• In the case where a forgery is suspected, and access can be gained to the computer on which the documents were authored, it is often possible to identify evidence of the editing techniques used

It is becoming increasingly common for e-mail, and other electronic documents to be relied upon for contractual agreements. Being electronic, they are susceptible to later editing and tampering. In most circumstances, this leaves a trace behind in the meta-data of the documents, and elsewhere of the computer equipment in use. By further inspection it is usually possible to determine:

• Which was the original document, and therefore what text has been amended
• When the modifications occurred
• Possible steps taken in an attempt to obscure or hide the modifications performed

There are many ways in which data recovery may be required, ranging from accidental or malicious deletion, through to system or device failure. It is usually possible to recover deleted or lost data, and in the case of malicious deletion, the act of deletion can be evidenced.

As can be seen from these simplified examples, there are many different ways in which investigating a computer system could be beneficial in resolving disputes. If you have any questions, or would like to discuss the specific circumstances of a case you are working on, please contact Right Click for impartial and confidential advice.