Proving innocence and proving guilt are opposite sides of the same investigative coin. Here at , we are concerned with facts, evidence and truth. That’s the investigative business. That being said, good investigators are also experienced professionals – and, I dare say, experts – in human behavior. It is that understanding of how people react and what they are likely to do that gives us leads that others might not recognize.
detectives are also steadfast in their objectivity, which is another sign of a professional. Objectivity promotes clarity and the ability to see past the heat of the moment.
Derek came to us in a highly emotional state. The young man was trying to build a career in accounting and there had been “an incident” at work. He repeated over and over that this could be the end of his career – and that he was innocent. He needed help to prove his innocence.
The situation
Apparently a colleague had tipped off his manager that Derek was spending time on his office computer scrolling through porn sites. When the manager confronted Derek, he denied it, but then the manager sat down at his computer and was able to find a file of photos and videos that “proved” that Derek was lying.
He had been suspended and sent home. He expected a letter of termination any day. But he was adamant that he had NEVER been to a porn site in his life, let alone in his office on the job.
It was obvious that a computer forensic investigation would easily recover porn on the office computer, after all, the manager saw it. But because Derek had taken the time and effort to see an investigator and that he was so distraught, was a flag that maybe he was telling the truth. Maybe he had been the victim of some foul play.
The investigation
Investigators knew that since the evidence was on the computer, they had to conduct a computer forensic examination. But the employer might think it was a ploy to remove the evidence by Derek. In a meeting, the computer forensic expert outlined not only the digital forensics process, but the protocols in securing evidence accurately. Derek offered to pay for the computer forensic services and the report would be shared with the firm.
The investigator on the case wondered, aloud with the computer forensic investigator and others in the meeting, whether this could be a case to use spyware detectors and be prepared for spyware removal. Perhaps the device had had spyware installed and that someone else might be controlling the creation of the porn evidence.
Derek’s face fell at the suggestion and the firm representatives raised their eyebrows, apparently stunned by the thought. That idea convinced the firm to agree to the forensic computer analysis, as long as they could have a representative with the machine at all times.
The investigation results
In the end, Derek was exonerated and reinstated at his job. There was spyware installed on his office computer and through detailed examination using data mining software, the computer forensic investigator was able to identity and remove the software as well as uncover detail that showed when the pornographic files had been created.
Computer forensic data recovery provided a picture and timeline that did not correlate with the time cards and schedule Derek kept in the office. Some of the files had been created on his computer when he opened emails. Eventually the pattern indicated the emails in question were from one person – a colleague Derek considered a friend.
When confronted, and presented with the evidence, the colleague admitted his part in the ploy. At first it had started as a joke, but when Derek was recognized for his work and in line for a promotion, the joke became a malicious ploy to remove him from the office.
The firm recognized the vulnerability in the office network and upped their game in digital security. Derek stayed on the job to continue to build his career and said he would be more aware of office politics from now on.
Innocence or guilt, either way, the facts collected in an objective manner tell the story and that’s exactly what always does – go after the truth.
-Brenda McGinley, CEO, All in Investigations, All in Investigations
