Attorneys win cases with forensic accounting tools

One of the most damaging pieces of evidence in Microsoft's antitrust trial was the introduction of an intra-office e-mail from Bill Gates about a competitor. He wrote, "Do we have a clear plan on what we want Apple to do to undermine Sun?"

The latest tool used by litigators successfully in court is a relatively new forensic accounting technique known as electronic data discovery. Courts are now allowing data recovered from computer hard drives, office e-mails, servers, palm pilots, etc., to be admitted into evidence during trials such as in the Microsoft antitrust case.

Specialty equipment

Computer forensic accountants, using special forensic software and hardware, are now able to collect, preserve, analyze and present computer-related evidence. The evidence that can be collected and protected consists of all active files as well as "deleted" electronic files, temporary files, e-mails, password-protected files and even some encrypted files. And many users are unaware that information from Web sites they visit are being stored on their hard drives such as the pictures viewed.

Traceable activity

The types of activity that can be traced or recovered include:

? "Deleted" files

? Files that were merely viewed or printed but never saved

? E-mail activity

? Internet activity including pictures viewed

? User history registries

? Traces of hacking or intrusion

The electronic information obtained provides more background than printed information, since it is possible to see when the file was created and last accessed (date and time), hidden notes can be unlocked and previous versions of the document can sometimes be viewed. Other information created or viewed at around the same time can be researched.

Imagine the surprise when the letters of recommendation produced by the defendant in a case turned out to be written by him on his own computer.

Sophisticated tools

The tools for obtaining and preserving the data are sophisticated and are used by law enforcement agencies such as the FBI and Secret Service. The mission re-quires a powerful computer, state-of-the-art software and a secure forensic computer lab. The forensic soundness of the electronic information to be used as trial evidence is critical and is monitored electronically by the use of "hash totals" or "hashing algorithms" that alert the forensic accountant if as little as one letter or symbol in the recovered information is altered.

These hash totals serve as a "finger print" of the data in question, allowing forensic accountants to prove that the data introduced into evidence is in fact an exact copy of the original data.

Costly task

Many lawsuit production requests now routinely ask for all electronic data related to the case. This can be a very costly and overwhelming task if a company has not managed its information systems or established an effective records retention policy. Therefore, from a risk management perspective, it has become critically important for companies to establish electronic data policies regarding what and how long information is saved and to make sure those policies are followed.

Data recovery

Forensic accountants can assist in the recovery and analysis of electronic data and provide expert testimony regarding the tools used to extract the data and the results of an analysis of such data. Forensic accountants also can assist in developing retention and destruction policies for a company's electronic data.

When retaining a forensic accountant to perform these services, consider asking the following questions:

? What software do they use?

? Have they rigorously tested and validated it?

? Is it generally accepted in the forensics community?

? What training do the people collecting and analyzing the data have? Most forensic accountants should have at least 80 hours of classroom training in forensic computer procedures and evidence handling.

? What steps are taken to preserve the forensic integrity of the electronic data?

? How secure is the laboratory where the analysis will be performed?

? What are the qualifications of the expert witness who will be testifying?

Experienced experts using the latest accepted methods and tools for performing electronic data discovery can help win court cases. Don't ignore this potential source of evidence.

(Judy A. Breeding, CPA, ABV, is a partner in the Springfield office of BKD, LLP, who specializes in litigation services, business valuation and expert consultation and testimony.)