Forensic Q&A

Question 1)

A lawyer in a law firm is suspected of embezzling money from a trust account. Who should conduct the investigation?

If evidence is found to support the claim, what should be done?

Explaining the steps to take, who is involved, and what items must be considered ?

Answer :

law firm should first do internal investigation.They shoulg gather all supporting evidence before filing case.

If the evidence is found to support the claim then they should file police complaint regarding such fraudulent activity of their employee.

Following steps can be taken :

  1. Law firm should track down all such transaction. They should take defensive steps in order to prevent further lose of money.They should halt transaction of that suspected person. They should freeze all his accounts related to that Law Firm

  2. Law firm along with police should track down other people who were involved in it.

  3. Once legal case has been filed then Forensic team should ask suspect’s bank for account details and past transactions.

  4. Thus based on evidences respective legal action should be taken.


Question 2)

An employee is suspected of operating his llama business with a company computer.

It’s been alleged that he’s tracking the sales price of the wool and the cost of feed and upkeep on spreadsheets. What should the employer do? Explaining the tasks an investigator should perform.

Answer :

Employer should monitor Log of recent activities of that person. Employer can limit access right of that employee.

If employer is sure that behaviour of that employee is suspicious then he should call forensic firm.

Investigator might look for following

  1. He should look for all possible log of particular computer which suspect use.

  2. Investigator should also look for which accounts did suspect use on computer.Like personal mail IDs, cloud storage account, etc.

  3. Investigator should also look for log of different hardware connected to that computer in past. He might be interested in logs related to USB storage drives.

  4. Investigator should convey respective report to employer. If he found that suspect has done malicious activity then he should tell employer regarding possible legal actions to take.

Thus, Employer may file case with supporting evidence


Question 3)

Jonathan Simpson owns a construction company. One day a subcontractor calls him, saying that he needs a replacement check for the job he completed at 1437 West Maple Avenue. Jonathan looks up the job on his accounting program and agrees to reissue the check for $12,750.

The subcontractor says that the original check was for only $10,750. Jonathan looks around the office but can’t find the company checkbook or ledger. Only one other person has access to the accounting program. Jonathan calls you to investigate.

How would you proceed? Write a(limit: 5000 word) report detailing the steps Jonathan needs to take to gather the necessary evidence and protect his company.

Answer :

Their is difference of around 2000$. Except jonathan only one person has access to those financial accounts. So obviously he will be prime suspect.

Now Since I am called to investigate this matter :

I might follow following steps :

  1. First and most important thing is to freeze all bank accounts and access rights of that suspect.

  2. As we know check books and ledger is missing so we don’t have any physical evidence. So as a forensic investigator, I will ask for access of computer where suspect works.

  3. Once I get access, I might check his past transactions related to subcontractors.

  4. It might be the case that he accidently put wrong check amount during entry. To verify whether it was done by mistakenly or purposefully, I will check his past transactions. After cross-verifying previous transaction with respective check receivers, I can conclude whether he did fraud or not

  5. Incase, I found he is guilty, then I will convey my investigation results to Jonathan. I will tell him to preserve all his banking activity in safe location because it will be key evidence for case.

  6. During such Investigation, I will recommend jonathan to freeze all financial activity of company.

Jonathan may contact lawyer and file case against that suspect. He now also has key evidence which will help him in lawsuit.