Evidence cannot only be found on computers. Mobile phones, Blackberries, PDAs even iPhones can accumulate useful evidence. Grant Thornton has the expertise and technology to retrieve mobile phone data.
The problem
The Chief Executive Officer of a medium sized company received a document from his departing finance manager on his Blackberry, querying a number of outstanding invoices and suggesting that he follow them up. The CEO was surprised to find that the same e-mail did not turn up on his e-mail account. Was there a hacker on the system?
The solution
Our team made forensic copies of both the Blackberry and the e-mail server. From the Blackberry we were able to determine the sending time and account of the original e-mails and the updating settings of the Blackberry itself. We were therefore able to tell when the e-mail had been deleted from the e-mail server.
We found that someone had logged onto the e-mail server remotely just before the e-mail was deleted using administrative privileges. We traced the remote logon to the client’s IT manager’s computer. Further investigation revealed that the invoices queried in the missing e-mail were fake, and all had been generated by the IT Manager.
The IT Manager was dismissed and successfully prosecuted.