Forensic Data Analysis

Part of digital forensics, forensic data analysis examines structured data and often uses statistical modelling to uncover fraudulent activities. The keyword here is structured data, referring to data found within computer application systems and their incorporated databases, whether they reside on-premises or as cloud based services. It is this distinction that separates forensic data analysis from other forms of forensic analysis which obtain information from communications equipment and office applications.

What’s the difference between Forensic Data Analysis and Digital Forensics?

Put simply, digital forensics is an umbrella term that encapsulates a variety of forensic services related to uncovering fraudulent activity on digital systems and storage devices. In other words, digital forensics include forensic data analysis, computer forensics and other forensic services associated with communications systems.

How this breaks down depends on the type of data under analysis. Data derived for examination from computer applications, networked communications, mobile phones, among others exist in the form of ‘unstructured data’. Unstructured data has no top-level structure to conform to and can be stochastic in nature. This is the preserve of Blackhawk’s Computer Forensics service.

In the case of Forensic Data Analysis, our team focuses on data derived from physical devices such as hard drives, memory sticks, CDs, among other storage devices. We examine how data is stored in specific areas of the drive and how it is being accessed. These media have a ‘structured data’ format brought about by the way the storage device is formatted for a particular operating system.

Forensic data analysis techniques and financial fraud

The analysis of structured data often stems from investigations into financial fraud. The intention is to analyse and identify patterns of fraudulent activity within the data contained in the system, rather than with the system or the application itself.

Given the amount of data that can be involved – often from gigabytes to terabytes, detecting any crime will require a highly methodical approach, carried out by experts with years of solid experience.

Essential data analysis steps in detecting fraud

We approach these tasks in a variety of ways, but often our investigators begin using exploratory data analysis techniques – essentially, these are statistical techniques that look at the characteristics of large data sets, often displayed using visual techniques from which patterns of activity can be identified more easily.

A key stage of the process is in actually recovering the data from the device concerned (which can be a hard drive, memory stick or other storage devices). Retrieving corrupted or deleted data can also be possible.

Once a useable data set has been retrieved, the next stage is to create queries, process the results, and review patterns. Creating hypotheses using methods of explorative data analysis is also common. The idea behind is to simulate who the perpetrators are and how their actions may have helped them to achieve personal gain. Every piece of data is analysed and if no evidence is found, the hypothesis is scrapped and a new one would be created and the process would start over again.

Key to this is the experience of the investigators – they are specialists with a proven track record and who are familiar with the patters of activity that fraudsters use to achieve their goals.

Time-consuming and expensive if left to inexperienced investigators

The iterative processes associated with forensic data analysis can be very time-consuming, and if left in the hands of individuals lacking seasoned experience, it can become quite expensive. For this reason, at Blackhawk Intelligence, our team of forensic analysis experts comprises engineers and forensic scientists who excel at performing technical steps, who understand processes and internal controls of the investigated company, and who are familiar with patterns of fraudulent behaviour.

Helps companies secure their processes and data

The process of uncovering fraudulent activity within the data held by companies often yields information on the vulnerability of systems and processes that hold the data. The forensic data analysis process can therefore help a company understand where the security of its systems and processes can be improved, once the data has been fully explored and the implication of its findings understood.

Forensic data analysis used as an ongoing proactive tool

The analytics processes used in forensic data analysis present an opportunity for companies to move from a reactive risk mitigation environment to a proactive one where lessons learned and information from advanced analytics tools can help improve systems, process security, as well as with compliance. Adoption of a more proactive approach to ongoing data analysis can offer the following benefits:

• Improving corporate risk assessment
• Improving the speed of fraud detection through better training and awareness
• Increased chances of detecting fraud and risk areas in large data sets
• Being more responsive towards fraud investigations
• Having internal corrective activities become part of an overall improvement process
• Meeting compliance and regulatory expectations

Furthermore, the growth in machine learning algorithms and AI in fraud detection software, processes and specialists, is making it more realistic for companies to invest in and to incorporate what was once a reactive, damage-limitation exercise into an ongoing proactive process of improvement and risk mitigation.

Forensic data analysis is part of Blackhawk’s suite of digital forensics services

At Blackhawk Intelligence, our digital forensics team oversees five areas of services:

• Cyber crime and digital forensics
• Forensic data analysis
• Mobile phone forensics
• Computer forensics
• IT forensics

We provide independent and accurate digital forensic examinations and reports to solicitors and companies. We are also expert witnesses giving evidence on complex fraud cases and helping legal teams understand the digital evidence.

If your company or your client has been a victim of digital fraud, call us today on +44 (0)20 8108 9317  and see how our digital forensic services can assist you.