Learning Objectives

• Understand digital forensics principles
• Apply techniques to recover financial evidence
• Maintain chain of custody
• Basic understanding of digital systems
• Week 1-5: Financial forensics foundation

1. Digital Forensics Principles

• Preserve: Don't alter original evidence (write-blockers, forensics images)
• Document: Everything you do, step by step
• Analyze: Systematic examination
• Report: Clear, defensible conclusions

2. Types of Digital Evidence

• Emails: Communication trails, hidden recipients, metadata
• Documents: Metadata (author, creation date, edits), hidden content
• Spreadsheets: Hidden cells, formulas, linked data sources
• Databases: Audit logs, deleted records, data anomalies
• Communication Apps: Messages, call logs, location data

3. Chain of Custody

• Who collected, when, where
• Who possessed, when, purpose
• How stored, secured
• Any transfers with signatures Purpose: Ensure evidence is admissible in court. Break in chain = evidence excluded.

Q1: What is the chain of custody and why is it important?

Documentation trail showing every person who handled evidence, when, why, and how it was stored. Critical for court admissibility - any break can exclude evidence. Q2: What digital evidence might reveal financial fraud?

Emails discussing false transactions, metadata showing documents backdated, spreadsheets with hidden rows/columns, deleted database records, audit logs showing unauthorized access. Q3: What is a forensics image?

Bit-by-bit copy of a storage device (hard drive, phone, USB). Preserves deleted files, unallocated space, and metadata. Unlike normal copy, captures everything including deleted data. Q4: How can document metadata reveal fraud?

Metadata shows author, creation date, modification dates, previous versions. A contract dated 2023 with "author: John Smith (left company 2021)" suggests backdating. Q5: What is the order of volatility when collecting digital evidence?

Collect most volatile first: CPU registers, RAM, network connections, running processes, temporary files, disk storage, archived backups. Volatile evidence disappears when system is turned off. Join Discord PreviousAnti-Money Laundering (AML)NextData Science for Fraud Detection