Question

Jackson Company manufactures pet supplies for birds and cats. Its top-level staff includes two accountants, a technology coordinator, a production manager, a ware- house manager, an office manager, two sales managers, two assistants, and the CEO. The company’s main offices and manufacturing plant in Los Angeles consist of an office building, a plant building, and two small warehouses. All buildings are connected via underground fiber optic cable. The servers, hubs, and routers are stored in the main office building.

The brain behind the IT network includes three server machines, named Washington, Jefferson, and Adams. The Adams server hosts the Mixta accounting system, which processes all internal and external accounting transactions in real time. A recent audit by a regional accounting firm discovered six customer accounts that could not be traced back to real people. The auditors’ confirmations had been returned in the mail, marked “Undeliverable” and with “Invalid Address” stamps. To make things worse, all six accounts had been written off for nonpayment of amounts ranging from $4,200 to $7,000. The discovery was a complete surprise to Sandra Winger, the credit manager, because she always reviewed and personally approved all write-offs over $2,500. She was sure that she had not approved any of these.

Sandra called in Tom Surefoot, a local forensic accountant, to investigate. She was sure that fraud was involved, and she strongly suspected that Betty Beanco, one of the office managers, had somehow gotten into the accounting system and set up the phony customer accounts and had probably sold the written-off accounts on the gray market. Sandra was furious.

“I don’t care how much it costs,” Sandra told Tom. “I want you to catch that woman. I’m not going to let her get away with robbing me like that.”

How could Tom apply computer forensics and other techniques to determine whether or not Betty Beanco should be a suspect?

Answer 1

Tom will first need to determine how well Adams server is isolated from this internet.

If this server and the mixta system are not adequately isolated from the internet via firewalls

And other means, tom would need to consider the possibility that an outside hacker had committed the crime

The identifying a group of the possible suspects is an essential part of investigation, especially

The suspects are internal employees. This permits the forensic accountant to interview the various suspects in light of their relations to elements of fraud triangle along with physical evidence.

In the many cases, skilled, interviewing alone will result in a confession,

That is forensic accountant would use in usual array of tools that include the site –access,

Network –access, server, and accounting –system –access logs. Network packet sniffer might also be helpful in recording fraud, especially if the attacker is sophisticated enough to the alter and permanently

Delete the access logs,. Physical site access logs might also be helpful in the indentifying the computer used and approximate time that the suspect committed the crime

These sufficient evidence can be gathered to the establish a probable cause that an individual has committed the embezzlement , then the low enforcement may be able to subpoena financial and phone record of suspect . A search warrant could be used to size any computer in the suspect‘s home

It would also be important to investigate the purchases made on accounts that were written off. Possible video surveillance recording could be used to the identify the suspect’s.

Who made these purchases? That person is likely an accomplice or the actual person who fraudulently manipulated the company’s accounting files.