Computer Forensic Case Studies

CLIENT   National Insurance Carrier - SIU Unit, Theft of Property EVENT   An insurance claim was filed reporting that rare baseball cards were stolen from the insured's residence. The insured's claim was based on digital photos of the cards, submitted as proof of ownership. Fraud was suspected. SOLUTION   LWG CFS made an exact image of the insured's computer hard drive and searched the media for evidence, namely the presece of the supplied card images and other reported proof of ownership. No proof was found. The findings resulted in additional investigation and dismissal of the claim. CLIENT   National Insurance Carrier - SIU Unit, Fire Loss and Fraud EVENT   An insured party sustained a total loss of property and contents due to a fire. Initial origin and cause investigation results indicated a set fire. Other investigation results indicate that the structure has been loaded with objects, which were intended to be burned and later claimed as contents. SOLUTION   LWG CFS assessed the internal hard disk drive from a fire-damaged PC recovered from the loss site. The internal hard drive was repaired and the data stored within was analyzed. Evidence recovered from the analysis proved that the insured party had fraudulently represented their contents, as well as demonstrated that the subject computer was not owned by the insured party and was part of a previous theft event. CLIENT   Attorney Representing Private Business Owner, Misappropriation of Protected Information EVENT   An attorney requested that 200 gigabytes of electronic data be submitted for Forensic Engineering. The analysis could reveal crucial evidence needed by the attorney. The attorney's client claimed that his employees were engaged in the development of a competitive business venture and that these employees were using proprietary company information to their gain. SOLUTION   LWG CFS conducted key-word searches, targeted file recovery, and deleted file retrieval. The analysis resulted in the recovery of crucial evidence in the form of Internet e-mail that clearly implicated the employees in the suspected activity. CLIENT   National Insurance Carrier - SIU Unit, Commercial Fire Exaggerated Business Interruption Loss EVENT   An insured party sustained a total loss of structure and property when their restaurant was damaged by fire. During the assessment of the historical business operations, it was determined that the supporting documents submitted by the insured were financially questionable. It was later determined that the insured utilized a personal computer to maintain business operating records. SOLUTION   LWG CFS was retained to assess the insured's PC for key financial records. Initial assessment of the unit determined that the internal hard disk drive had been re-formatted and that the desired financial records, although recovered, were password protected. All passwords were defeated and the underlying financial data was recovered and provided to the client for assessment. The data provided by LWG CFS clearly proved misrepresentation by the insured. CLIENT   Multiple National Insurance Carriers - Subrogation Action EVENT   A large commercial production facility sustained heavy damage and massive business interruption losses following an explosion in their plant. The facility utilized computer based process controllers and PC based event logging systems. SOLUTION   LWG CFS was retained to secure all electronic evidence from the loss location. Forensic images were taken of PC based event logging systems, back-up media, and proprietary PC based control systems. These various data sources were analyzed for critical system operation information and programming instructions to assist in the subrogation analysis efforts. CLIENT   National Insurance Carrier - SIU Unit, Theft of Property EVENT   An insured individual submitted a personal property claim for the theft of valuable computer equipment from the trunk of their automobile. As proof of ownership, the insured provided an original purchase receipt. The receipt was sent from a PC fax modem unit. Initial assessment by the insurance adjuster found red flags and the file was turned over to their SIU unit. SOLUTION   LWG CFS was retained to assess the insured's PC for record of the original receipt that was faxed. Key-word searches, targeted file recovery, and deleted file retrieval were all performed. The analysis resulted in the determination that the insured had scanned in the original equipment purchase receipt and had modified it to resemble their own using computer software. The fraud was proven and the claim denied.