Forensic investigations are indispensable in resolving and appropriately addressing fraud and information leakage issues that companies face. However, the cost of forensic investigation is difficult for legal staff to grasp. There are a variety of formats and items in the estimates submitted by investigation companies (vendors), and it is difficult to understand how they are viewed, resulting in some cases in which the final bill is unexpected. This article explains the cost of forensic investigation and provides the knowledge necessary to control the cost of forensic investigation.
Forensic investigation is a forensic investigation conducted for incidents of internal fraud or information leakage. The term "digital forensics" refers in particular to the investigation of causes and evidence based on traces of digital data access and data recovery.
By determining the causes of internal fraud and the routes of cyber-attacks, responsibility can be clarified and measures to prevent recurrence can be established. To this end, the purpose of forensic investigation is to uncover evidence of fraudulent activities on data stored in digital devices.
In a company, forensic investigations are used for a great variety of incidents.
In the case of a leak of confidential or personal information, forensic investigations are used to identify fraudulent activities by employees who take information with them when they leave the company. Quality fraud, embezzlement, kickbacks, and other fraudulent activities within the company are also subject to forensic investigation. In these cases, employees may destroy evidence, and techniques such as data recovery are also required.
Forensic investigation is also used in cases of bid-rigging, cartels, and purchasing irregularities between companies. Forensic investigations can also be effective in confirming employee behavior in labor and harassment issues. In addition, for cyber attacks such as unauthorized access and malware infection, forensic investigations are used to investigate the damage and intrusion routes in detail.
Forensic investigation begins with "interviews. After clarifying the purpose of the investigation, we begin preserving and collecting data as "evidence preservation. Next, the collected data is "investigated and analyzed" using specialized analysis tools to clarify the history and path of damage. Finally, a "report" is issued to complete the process.
This section introduces the cost of a forensic investigation, the breakdown of costs, an image of the fee structure, and other factors related to costs when an investigation company (vendor) is commissioned to conduct a forensic investigation.
The cost of a forensic investigation can range from several tens of thousands of yen to several million yen, depending on factors such as the nature of the investigation and the scope of the investigation. Furthermore, if the case is a large scale and involves an investigation and report by a third-party committee, the amount of work and the time required will be enormous, and the cost is expected to be a large amount.
When a forensic investigation is conducted by an investigation firm, the main cost breakdown is data hosting (preservation cost), data processing and retrieval (technical cost), and analysis and analysis of potential evidence (review cost). The review process usually accounts for the majority of the costs.
As a rough guide, the cost of a forensic investigation generally ranges from several hundred thousand yen per device. Calculations can be found in units of equipment such as "per computer" or in the amount of data such as "per GB.
Some vendors have fewer items in their estimates, and in some cases, the amount is written as a "complete set of work," or they present the amount without stating the "unit price x estimated amount.
Costs vary depending on the content and complexity of the investigation. For example, extensive network tracing or large-scale information leakage will cost more than basic investigations such as log analysis and data recovery. Other factors also affect the cost from this perspective, as different investigation firms use different techniques in their investigations.
The time required for a forensic investigation varies greatly depending on the number of devices to be investigated, the items to be investigated, and the purpose of the investigation, ranging from a few hours if the investigation targets a single PC to several months depending on the size and complexity of the case.
Reasons why forensic investigation costs are high include the cost of tools (equipment), labor costs, and low demand.
It takes a certain amount of money for an investigation company (vendor) to continue to develop and maintain the equipment for data analysis to handle cases of any type and size. In addition, forensic technicians are required to have specialized knowledge and experience in data-related equipment, networks, and other IT-related areas, which also affects personnel costs. Because of the nature of forensic investigations, which are required only in cases of fraud, they are not in high demand, and the cost per case tends to be high.
Nevertheless, be wary of firms that offer inexpensive quotes. Among the various processes described in the forensic investigation breakdown, the quality of the initial data preservation and collection directly affects the overall quality of the review. If the skill and quality of data handling in the initial process is inadequate, the cost of the review may unintentionally balloon, causing the final cost to increase significantly from the estimate.
As we have discussed, the cost of a forensic investigation varies greatly depending on the amount of engineers working on the investigation, the amount of data, and other factors. The following is an explanation of points to focus on and points to consider in order to properly select an investigation company (vendor).
The cost of forensic investigation consists of the cost of data processing and retrieval, analysis and analysis of potential evidence (review), and data hosting, with the review process usually accounting for the majority of the cost. The final cost varies greatly depending on the scope and content of the investigation, and can range from several tens of thousands of yen to several million yen. We recommend choosing a vendor with a clear cost structure that includes additional fees.
In addition, awareness of the use of AI in surveys has been spreading recently, and significant cost advantages can be gained by utilizing AI to dramatically improve survey efficiency. When gathering quotes, be sure to ask for the total cost, including AI and review, and compare not only the unit cost but also the overall cost.
The outcome of a survey depends on the skill level of the engineers, tools (equipment), and other factors. A company with a large number of survey results will have accumulated a high level of technical skills and know-how in data recovery, and will be able to respond to each case with the most appropriate methods and at a reasonable cost, especially for large-scale and special surveys.
In addition, the proficiency of engineers and specialized tools are essential for advanced data recovery and analysis. Furthermore, recognition of the use of AI (Artificial Intelligence) in investigations has been spreading recently, and significant cost advantages can be obtained by using AI to dramatically improve the efficiency of investigations. When obtaining an estimate, ask for the total cost, including AI use and review, and carefully compare not only the unit cost but also the overall cost.
References can be obtained from companies that have used a potential research firm to confirm its reputation. Contact the firms and attorneys to whom you will ask for references, and ask the firms and attorneys about the firms' actual reputations. Although this is time-consuming, it is a recommended method for selecting the best firm that matches your company and case.
As a leading forensics company in Japan, FRONTEO has been involved in fraud investigation since its establishment in 2003, including contributing to the establishment of the "Digital Forensics Study Group. FRONTEO's strengths lie in its proven track record and its ability to conduct accurate investigations using its self-developed AI engine.
With a history of over 20 years and a track record of more than 2,000 fraud investigations, FRONTEO's forensic technology has been used by many "third-party committees" in cases involving scandals that have caused a stir in the world. Our accumulated know-how and high reliability have helped many companies solve their problems.
KIBIT, our self-developed AI engine that plays an active role in analysis and analysis, is a simple and high-performance algorithm. Unlike other products, KIBIT has advantageous features for forensic investigation, such as small amount of teacher data, short implementation time, and light computational processing. In addition to early implementation, it can be flexibly customized for a company's uniquely developed systems and special data. Even for large-scale projects, FRONTEC can accurately promote investigations by making full use of its know-how and technology. Please contact FRONTEO for forensic investigation.