What is forensic investigation? Explanation of necessary cases, precautions, and examples

When virus infection, unauthorized access, leakage of confidential or personal information, or internal fraud such as embezzlement or quality fraud are suspected at a company, a forensic investigation called a "forensic investigation" is required. This section provides an easy-to-understand explanation of what a forensic investigation is, the cases in which it is necessary, points to note, and the specific flow of the investigation.

What is a forensic investigation?

A forensic investigation is a forensic investigation conducted when an incident such as internal fraud or information leakage occurs. Forensics generally means "forensics " and originally referred to forensic investigations conducted primarily in police criminal investigations to find forensic or legal evidence, meaning investigations to collect and analyze evidence.

In the IT field, forensics refers to the search for evidence and clues from computers and other digital devices, and there are an increasing number of cases where legal evidence is investigated, searched, and analyzed from digital data.

Related Articles] What is Forensics? Explaining the Meaning, Necessary Situations, Investigation Methods, and Cautions

Types of Forensic Investigations

Among forensic investigations, those in which digital data is in contrast are called " digital forensics." The reality is that most interactions, records, and documents are now digital, and most forensic investigations are digital forensics. This technology is used to investigate the causes of crimes and malware infiltration in the digital environment, and the demand for this technology has been increasing in recent years. There are several types of forensic investigation depending on the devices and other factors to be investigated.

Computer forensics

Computer forensics is the collection and analysis of electronic data recorded on the computer itself, such as information leaks and unauthorized access. For example, the computer of an identified suspect is seized, the hard disk is copied and analyzed, and the operating history and data are recovered.

Related Articles] What is Computer Forensics? Introduction to the investigation process, necessity, etc.

Related articles】What is email forensics? Explanation of forensic investigation methods, examples of email forensics, and cost images.

Memory Forensics

Memory forensics is the collection and analysis of information stored in the memory (RAM) of a computer system. It analyzes the processes in memory to identify unauthorized activities, and analyzes encrypted data and other data in memory to determine the cause of malware intrusion and investigate unauthorized activities.

Mobile Forensics

Mobile forensics is digital forensics related to mobile devices such as smartphones and tablets. It collects and analyzes device storage, applications, and communication history. It also includes information on cloud services such as online storage and email accounts associated with the device

Network Forensics

Network forensics is the collection and analysis of communication data and log information on a network. The packets (communication data) that enter and leave the target network are used to detect fraud. In addition to detecting unauthorized packet data, it is also used for real-time incident response.

Fast Forensics

Fast forensics is a method that emphasizes quick results, whereas normal forensic investigations require a lot of time. Priorities are determined based on importance and urgency, and a large amount of data is processed efficiently through automation, sharing of tasks, and information sharing. Priority is given to minimizing damage by quickly determining the cause of the problem and identifying unauthorized behavior and intrusion routes.

Major cases requiring forensic investigation

What are the cases in which forensic investigation is necessary? Here are some specific examples of cases where forensic investigations are used in companies.

Leakage of confidential or personal information

Information leakage is caused by an employee taking confidential corporate information or extracting personal information when he/she leaves the company. We can identify evidence by investigating the history of unauthorized communication, copying, and removal of information from the employee's computer.

Quality fraud, embezzlement and kickbacks

Employees tend to destroy evidence when they suspect fraud within the company, such as intentional falsification of data for quality fraud, embezzlement, kickbacks, and accounting irregularities. We carefully investigate by extracting the e-mail history of the suspected employee without his/her knowledge. We also investigate in case there are accomplices.

Collusion and purchasing irregularities

Forensic investigations are also used in cases of bid-rigging, purchasing irregularities, and other corporate fraud and misconduct. In order to obtain evidence of fraud, deleted data is recovered and analyzed. Predicting highly likely cases and conducting AI-based audits from normal times can also have the effect of preventing fraudulent activities from occurring.

Electronic data includes all data that you have agreed to submit, such as e-mails, text files, various internal documents, message chats, spreadsheets, image data, and website content. Data subject to submission is preserved so that it is not tampered with or destroyed. Gathering the data deemed necessary from among them and converting it to the agreed format. A review and analysis will be required to find the text agreed to be submitted.

Labor and harassment issues.

Forensic investigations are also useful for investigating labor-related incidents such as improper claims for overtime pay or neglect of duties. We investigate the actual working conditions of employees based on their computer logs, e-mails, chat history, and so on. We also check for evidence of harassment-related communication.

Security incidents such as malware infection

When we become aware of damage caused by hacking or malware infection, we need to investigate the circumstances of the damage, such as information leaks, whether there was virus infection or unauthorized access, and through what channels it occurred. If it is a company that handles personal information, it is required by law to grasp the facts as soon as possible, and if a leak of personal data is recognized, it is required by law to make a prescribed report.

Forensic Investigation Process

When you encounter a case that requires forensic investigation, what steps should you take? The following is an introduction to the general process and each procedure.

Initial Investigation

First, clarify the purpose of the investigation. We determine the devices, systems, and time period to be surveyed, as well as the acquisition and analysis methods, and the tools, personnel, and other resources required for the survey.

Data collection and preservation

We secure the devices to be surveyed and properly preserve the collected digital data to prevent accidental deletion or destruction. We collect the data to be investigated and generate complete copies of the data.

Data Processing and Analysis

Information is read from the target devices and copied data, and deleted files are restored if any. If there are deleted files, we recover them and optimize them for easy analysis.

Data Analysis

This is the process of analyzing the information that has been organized for the purpose of the investigation. We analyze the information to determine whether it is consistent with the purpose of the investigation and whether it can be used as evidence, while also making full use of our knowledge of the law.

Reporting

The results obtained from the analysis are compiled and submitted in a report. The report will contain the details and facts of the investigation and will be made available to the court of law.

Points to keep in mind when conducting a forensic investigation

Forensic investigations require a wide range of expertise in digital, legal, and other areas. It is important to know that it is difficult to conduct a series of forensic investigations on one's own.

Possibility of Secondary Incidents

In many cases, there may be no in-house expertise or technical know-how to begin with. Failure to properly investigate and mishandle data can lead to secondary damage.

In the case of important incidents, it is often necessary to bring in a third party to ensure objectivity in order to avoid suspicion of cover-up, and there are limits to what can be done by an in-house investigation alone.

Consult a vendor with a proven track record and technical capabilities for forensic investigations.

Forensic investigations have limitations in terms of in-house investigation. The shortcut is to ask an investigation company with a proven track record and technical capabilities to conduct the investigation.

FRONTEO, a leading AI-based forensic investigation company

FRONTEO has been conducting forensic investigations since the dawn of digital forensics in Japan, and since its establishment in 2003, has faced a variety of challenges as a pioneer in fraud investigation in Japan. We propose effective and cost-effective investigations for all types of incidents by utilizing the knowledge we have gained from our overwhelming number of cases.

High technological capabilities with over 2,000 forensic cases and utilization of AI technology

While making full use of the latest technologies such as our proprietary AI engine, we also utilize in-house developed software. We take a one-stop approach to data identification, preservation, processing, review, and preparation of data for submission. The know-how we have cultivated over the years has given us the ability to respond to a wide range of companies and issues.

We have handled more than 2,000 cases of digital forensics. We can consult on various types of case investigations, including information leaks, data falsification, embezzlement/kickbacks, bid-rigging, purchasing irregularities, labor issues, identification of the source of suspicious documents, harassment issues, security matters, and support for investigative commissions (expert testimony) for investigative agencies.

Examples of FRONTEO's forensic investigations

FRONTEO's strength lies in its extensive experience in forensic investigations. Here are some actual cases where forensic investigations were conducted and problems were solved.

Confidential information leak investigation

A whistleblower reported that a soon-to-be retired employee was taking confidential information outside the company, and the need for an investigation arose. The employee was found to be in possession of trade secret information outside the scope of his work from a company computer, and our attorney conducted an interview with the employee. FRONTEO responded by completely deleting the relevant information. This led to the prevention of information leakage.

Embezzlement and Kickback Investigation

After Company A's employee was reported by Company B, a client of FRONTEO, as a result of an internal investigation, it was discovered that there was a discrepancy between the amount of the invoice and the amount of the payment. The legal counsel and others conducted an interview, and the parties involved were criminally prosecuted.

Security Case

Upon receiving a call from a business partner stating that they had received a suspicious e-mail claiming to be from Company C, Company C conducted an internal investigation and discovered a virus on a terminal dedicated to the business management system. Company C issued a warning and apology for the suspicious e-mail, explained the circumstances and the extent of the damage, and implemented measures to prevent recurrence through FRONTEO's training. FRONTEO training was also provided to prevent recurrence.

For forensic investigation, FRONTEO has an overwhelming track record and AI technology

With the proliferation of smartphones and tablets, anyone, regardless of the size of an individual or company, has the potential for a variety of incidents. If you feel the need for forensic investigation, it is a wise choice to entrust it to a trusted expert.

FRONTEO conducts its own forensic investigations using KIBIT, an AI (Artificial Intelligence) engine developed in-house. By investigating a vast amount of data such as e-mails and chats with a document review tool called KIBIT Automator, we are able to provide reliable evidence, data recovery, and data preservation and analysis. FRONTEO, with its overwhelming track record in forensic investigation, can propose the best solution in a speedy manner in case of emergency by utilizing the latest AI technology.

What is forensics? Explaining the Meaning, Necessary Situations, Investigation Methods, and Cautions