Investigating Digital Crime and Computer Misuse

A private organisation contacted Arcanum to perform forensic analysis on a computer system to determine which data had been stolen by a former employee. Using internet network traffic monitoring the business identified that one of their users had uploaded several emails in Personal Storage Table (PST) file format to their personal Network Attached Storage (NAS) device. An initial investigation by their inhouse team had segregated and imaged the computer system and identified which PST files had been uploaded. Assistance was required in the review of what these files contained including running Optical Character Recognition (OCR) on files and searching. Due to the sensitive nature of the material potentially stored in the PST files all work was required to be carried out on the customer’s site.

The business initially supplied over 10,000 search terms which Arcanum processed by deduplicating and adding regular expressions to create a set of approximately 6,500 search terms.

Outcome: An Arcanum Digital Forensics Technician attended the business site with an analysis machine with a clean hard drive installed. The image of the computer system was reviewed and the PST files in question identified, this was confirmed with the customer and a new image created containing only these PST files.

Reports were provided to client highlighting search hits which allowed them to fulfil their disclose requirements. 

Arcanum was the independent third-party investigator for a criminal investigation conducted by a police force. It was suspected that the defendant had shared confidential sexually explicit images and videos of his partner via Snapchat. Extensive forensic analysis was conducted on digital data that was extracted from a mobile telephone. Various digital evidence sources such as Photos, Calls, Messages, Emails, Instagram, SnapChat, Geo Location and mobile logs were analysed.

Outcome: Arcanum was able to find key evidence which had previously not been discovered, which assisted in providing a timeline of events concerning the said images and videos.

Arcanum assisted a joint investigation with a liquidation company and HMRC. This involved a civil search order and liquidation of a company who were suspected of large-scale fraudulent activity. The order allowed Arcanum’s team to attend the defendant’s business and residential address in order to forensically acquire and seize digital equipment containing significant digital data.

Arcanum’s team had to triage data first to avoid copying personal data outside what was permitted in the civil injunction.  The team that attended the residential premises could not seize devices and therefore spent approx. Capture and preservation of mobile telephones listed on a civil injunction are particularly difficult, as personal data cannot be captured from the device. Therefore, the phone was thoroughly examined so that business-related data was solely extracted. A significant chat was found to be stored within the Cloud which required Arcanum to perform a Cloud collection as well as the extraction within strict time constraints.

During examination, various search terms provided by the customer were run over the extracted data with resulting hits provided in respective reports.

Outcome: Arcanum were able to examine numerous devices on-site and provide all the acquired data within 2 weeks. As with all Arcanum cases, a written report of the highest standard was produced. Digital reports were provided to the customer for review which would contain crucial evidence.

A satellite navigation system was seized by a local authority in the UK from a vehicle containing a large quantity of illegal tobacco. The Arcanum forensics team was engaged to carry out data extraction and analysis of the seized equipment. The team recovered recent locations that the user might have visited and were able to determine the user configured route settings such as recently visited locations, favourite destinations and saved routes.

Outcome: The analysis of the recovered data identified locations of interest, which served as key evidence in the case. The device data was provided in a user-friendly Excel spreadsheet, alongside a detailed examination report.

A Business in South Wales was making made sales calls throughout the UK claiming to be Sky TV or mobile telephone service providers renewing insurance policies. The team recovered data, including deleted call recordings, and were also able to identify the location from which the company’s IT consultant accessed and attempted to delete data from servers during the early stages of the warrant.

Outcome: Eight defendants were sentenced to a total of 23 years imprisonment.

The team has supported internal investigations on on corporate employees. Our digital forensics experts investigated any computer misuse, property theft and subsequent re-sale, IP theft, fraud, use of corporate resources to run private businesses, harassment, malware incidents, inappropriate use of social media etc.