INFORMATIONAL ARTICLES

Corporate fraud is a hot area of investigations in 2013. From embezzlement to corporate due diligence, the activity level is high. The Economist magazine presents an article talking about some of those areas. “One big source of work is the growing complexity of business regulation. Multinationals can never be sure that some employee, somewhere has not violated America’s Foreign Corrupt Practices Act, or some other anti-bribery law.” One investigator described how the job sometimes goes: “Part of the job will continue to be “tracking down the disgruntled former secretary or book-keeper who knows where the bodies are buried, and knowing how to coax information from them.”

Here are a couple of videos on areas of corporate investigations:

[youtube=http://www.youtube.com/watch?v=Sh0rtB3PuBw]

[youtube=http://www.youtube.com/watch?v=fD0U4rvYOcU]

The definition and perception of what goes into a criminal background check varies. For a private investigator it is important to serve the needs of a client by doing a thorough search so that he or she receives the complete information that they need. Be aware that within the investigative industry we have the knowledge that a one click “FBI Background Check” does not exist, and it might be necessary to describe the methods to discover the criminal history of a subject.

The video below describes the basic mechanics that a client might want to know about including starting with a “chain of residence.”

[youtube=http://www.youtube.com/watch?v=YgECbCxAlbc]

AFX Search, Palm Beach FL private investigator.

Private investigators are often called upon to document cheating in a relationship. Whether in a divorce case or checking on a relationship partner it is important that the investigator go beyond simply observing that the subject is having an affair. Collecting supporting information and pursuing the related activity is even more valuable to the client.

In most cases the client already knows that the subject is having an affair. Finding out the extent of all hidden activities is really what the investigation should be about. The real value of a professional investigator is digging deeper to find all the risks the subject is creating for the client, and helping them out of jeopardy.

The following video describes some of the elements a professional investigator should consider when operating a cheating case.

[youtube=http://www.youtube.com/watch?v=gQGbQAsJt3A]

Concealing assets in divorce cases is very common. This 6 minute video discusses some of the methods used to hide assets, and how they can be discovered.

[youtube=http://www.youtube.com/watch?v=1hZONOv7pm8]

Discussion on ESI typically will focus of e-discovery of data such as letters, emails, financial records, and scanned documents. An extraordinary opportunity for discovery of potentially valuable information from voice and audio recordings is frequently overlooked. The exchange of information in voice or audio format has migrated almost exclusively to software based platforms. Because of this, files containing audio and voice are created in regular FAT or NTFS formats, even if only for a temporary mechanism to transport the audio to its destination. Many IT managers are unaware that these audio files exist.  A skilled e-discovery expert can use this knowledge to develop intel from a case.

A simple example can be demonstrated by understanding the modern phone and voice mail systems. When a call comes into a corporate enterprise phone system, the routing and call management is handled by computer. Most firms now have raw data lines running into the organization handling all types of bandwidth volume. In many cases the data allowance is shared between data and voice, with the company handling the setup of phone numbers and call flow. One or more phone servers are set up to manage this phone traffic in the same way a file server manages data traffic. As the call is routed to the selected extension or DID number, the phone server routes the connection to the appropriate wall jack as programmed in the system. The server maintains records of how the calls were routed, transferred, or terminated. This data by itself may prove valuable.

Where it gets more interesting is when a voice mail or message is created. If the call is routed to voice mail  the message is stored as an audio file on the server in much the same way as any other data file on a PC. It may be in a distinct .WAV or .MP4 file or part of a zipped archive containing multiple audio records. The sound file will often contain the date, time, caller ID, length, and selected extension within the metadata. What makes this mechanism even better for an investigator is that the records are often more durable than expected. When a system user deletes a voice mail message the process does not vacate the audio. Instead the system simply removes the registration of that sound file from being indexed by the users voice mail account. This is why many phone systems have the ability to recover deleted messages. Eventually the system may overwrite the sound files if the space is needed for more records but most enterprise systems have plenty of storage capacity. Even older voice messages which would have been overwritten can be discovered. At regular intervals the phone server is backed up to tape in the same way that date file servers are. The backed up version of a phone server would have a snapshot of the audio files as they existed on that date. Since backup tapes are usually not immediately reused and are stored in inventory there may be up to a years worth of old audio files stored somewhere if the investigator is diligent.

Many phone systems also allow for users to use the system to transmit voice messages internally to each other using their phone extensions. These messages are stored the same way and may contain candid communications which are perceived to be less documented than email. Most users believe that when an audio voice message is “deleted” by hitting a button on the phone set that it is gone forever. For this reason there may be information on audio which is more sensitive than that in written or email format.

This knowledge can be applied to voice and audio files created on many platforms.

• Virtual IVR systems (OneBox, RingCentral, 8×8, etc.) – Cloud based systems record the audio off-site, so careful crafting of discovery will be needed to obtain these records.
• VOIP – Businesses are migrating from copper wires at a high rate. Over 80% of new business lines installed use VOIP services such as Skype, Vonage or Ooma for some communications. The voice files for these can be accessed by a user login, or recovered from the provider.
• GoToWebinar – Webinars, podcasts, or other presentations may contain information on training policies, what information was distributed to employees, and what opinions are held by a company. Each presentation creates an audio file. Employees and executives are more outspoken when conducting internal meetings and presentations. Conference call platforms also create an audio file.
• Voice memos; enterprise and mobile – Executive users may use their mobile device to record memos, ideas, and notices to be transcribed later. These are captured when the device is synced.
• Auto-attendants – Telephony has gone from a proprietary hardware system to software based IVR. We have all heard the ubiquitous notice “This call may be monitored for quality assurance.” Incoming calls to some departments such as billing or customer service might create an audio record of the entire call. Even older hardware such as Dialogic cards store audio messages on disk.

When examining available audio, consider three additional additions to the investigation:

1. Background audio – be attentive to sounds in the background of audio files for additional details. Was the caller in a vehicle? Are there other parties present? Did another call ring in to the call waiting?
2. Meta data – Be sure to extract any meta date from audio files as well as data files. Sound files need to have more robust meta info since there is no space for text on the visible file as in an email or PDF file.
3. Old greeting messages – A person may have various versions of greeting messages for their extension. Some attempts at recording the message may have been interrupted by a co-worker talking to them, or some other interruption. The “deleted” recording may contain background info.

The opponent is expecting discovery of written materials and electronic records. Worded documents are created with more diligence with the expectation that the record is durable. Individuals are less cautious in verbal communications, even when the discussion is by phone or electronically. The durability of audio communications may not be visible to the eye. The value to an investigator is created by the capitalizing on the subject not expecting voice comms to be archived. If the legal team ensures that audio files are part of the ESI discovery, and there is an expert investigative resource to extract all of the files from servers, backup tapes, and other electronic media.