27th April 2022

The use of digital forensic tools in insolvency cases

Digital forensic tools can play a key role in insolvency investigations where wrongdoing is suspected and the potential evidence is in the form of digital data.

What is digital forensics?

Digital forensics is a branch of forensics science. It focuses on the recovery and investigation of data stored electronically.

Digital forensics uses specialised tools for data collection and analysis. ‘Computer forensics’ was an earlier name for digital forensics. The term ‘digital forensics’ reflects the fact that many different types of device can store digital data. Sources of digital data include:

  • Computer hard drives
  • Servers
  • Online or cloud-based sources like Google Workplace and Microsoft 365
  • Mobile phones
  • Social media such as Facebook, Instagram, and LinkedIn.

The most common context for digital forensics is to provide evidence in a court of law. Digital forensics professionals must handle digital evidence in a very specific way, otherwise, the court won’t accept it.

Steps in the digital forensics process

The digital forensics process has five steps. Following this procedure helps ensure any evidence will be admissible in court if necessary.

1. Identification

Identifying the evidence is the first step. The digital forensics team will identify what evidence is present. They’ll note where the data is stored and in which format.

2. Preservation

Next, the digital forensics experts will isolate, secure, and preserve the data. This step includes protecting the data from tampering.

3. Analysis

The analysis phase involves a deep, systematic search for relevant evidence. It can include reconstructing fragments of data. Several rounds of examination may be necessary.

The analysts make conclusions based on the evidence they find.

4. Documentation

The fourth step is to create a record of all the visible data. Investigators combine the digital evidence with other evidence documented in photos, sketches, or crime scene maps.

5. Presentation

Finally, the digital forensics team will write a summary of their work.

The report follows forensics protocols. It explains the analysts’ methodologies and procedures as well as their conclusions.

The digital forensics team should write the presentation of evidence and conclusions using terminology a non-specialist can understand.

Development of digital forensic tools

Digital forensic tools have developed significantly in recent decades. Computer forensics began to gain recognition in the 1990s. Early digital forensics investigations used live analysis with the device in question.

However, devices started to contain more and more data. Data interactions have increased by 5,000% since 2010. Relying solely on live analysis is inefficient and impractical.

Modern analysts use a range of sophisticated digital forensics tools. Tools include hardware and software. They can be open source, freeware, or proprietary specialist technologies.

A key feature of digital forensic tools today is automation. For example, tools can filter out duplicate or non-relevant files. This reduces the amount of data that needs investigating.

Types of digital forensic tools

Digital forensics tools can have many different functions. Many modern tools can do multiple tasks. Some tools package hundreds of different functionalities into a single platform.

Each investigation typically needs several types of tools to discover all the relevant evidence.

  • Disk and Data Capture – Disk and data capture tools detect encrypted data on physical drives. They capture and preview the information. They focus on the whole system.
  • File Viewer and File Analysis – File viewers and file analysis tools focus on separate files instead of the entire system. They work to extract and analyse relevant files.
  • Memory Forensics – Analysis of a computer’s file system misses the RAM memory. This volatile memory can have useful information. Sources of information include running processes, network connections, and registry hives. Memory forensics tools work to capture this data.
  • Registry Analysis – The Windows registry is a database for configuration information. It shows how the operating system and its applications are configured. Registry analysis provides information about a user and their activities.
  • Internet and Network Analysis – Network tools let forensic investigators analyse network traffic. They can show what a user was doing online. Tools can capture live traffic or take a saved capture file.
  • Mobile Device Forensics – Mobile forensics tools are specialised tools for mobile devices. They help get data from the internal and external memory of mobile devices. These tools use different methods to bypass device security features like lock screens.
  • Email Analysis – Email analysis tools help with studying the source and content of email messages. They can identify the origin and destination of messages down to the IP address, network provider or ISP, and physical location.
  • Database Forensics – Database forensics tools can analyse data and metadata from a database system. They let analysts see who had access to a database and what those users did. Tools can scan and retrieve deleted data.

Importance of digital forensics for insolvency cases

Digital forensics can play a critical role in insolvency cases. Time is of the essence. If unscrupulous individuals destroy important data, creditors and the court may not see the true picture of a company’s assets. Evidence of unethical activity may disappear.

Digital forensics services can handle the investigation process when you suspect fraud or dishonesty on the part of company stakeholders. In addition to hidden assets, digital forensics can help find people who are trying to evade justice. You can focus on the more technical insolvency aspects of the case.

Choosing the right digital forensics service

Digital forensics can help ensure that your insolvency cases have all the evidence you need. However, choosing the right digital forensics analysts is important to be sure the court will accept your evidence.

You can trust the expert digital forensics analysts at ESA Risk with your insolvency cases. Our digital forensic tools include specialist software that preserves critical metadata. We carry out investigations in an ISO-accredited lab.

Learn more about digital forensics services from ESA Risk and see how we can support your insolvency investigations.

contact us online or by phone

Get the advice you need

Our expert consultants are on hand to give you the support you need.

What are you looking for?

Get the advice you need

Deep dive for the answers you need
Or contact us on +44 (0)843 515 8686 or at advice@esarisk.com.

Deep dive for the
answers you need

Lawyers, accountants, advisors, investors, senior
management. You name it, we help them find the answers
they need. Ready to discover how we can help you?