A recurring type of engagement is the theft of substantial amounts of money by long-term, trusted employees. Such matters we have investigated include incidents where the CFO was suspected of having embezzled the client's money over many years.
We assisted by covertly collecting the accounting books and records and email from the client’s business systems prior to any approach being made to the employee. This allowed for the quantification of the theft, identification of recoverable assets as well as the preservation of evidence in case there was any attempt to alter records once the employee had been confronted.
Often, we provide a "facilitation" service to investigators where we collect the electronic material from computers and phones and then process it in our forensic suite of tools. We then give the investigator access to a portable report containing the forensic artefacts that allows them to investigate the data for material relevant to the allegations. This makes good use of the investigator's understanding of context and relevance.