CASE STUDIES - INVESTIGATION OF EMPLOYEE MISCONDUCT
CASE STUDY
Investigation of Employee Misconduct and Defrauding the Department of Defense
Tags
Digital Forensics, Investigation, Department of Defense, Fraud, Internet Artifacts, Deleted File Recovery
Background
A manufacturer of specialized parts, mostly a Department of Defense contractor, retained Maryman to investigate allegations against two of its employees, Employee A and Employee B. Another employee reported that they overheard Employee A and Employee B discussing a side business of selling the same types of parts to the Department of Defense. The company wanted to see if they had stolen company property or utilized company property to aid in setting up this company to compete against it.
Scope and Preservation
The Maryman team proceeded with a full-scope digital forensics investigation to determine whether the allegations were true. We proceeded with documenting their workspace and inventorying all digital devices at their desks. We performed forensic imaging and preservation of their workstations, email accounts, domain profiles, and removable USB drives found in their desks.
Analysis and Findings
The forensic investigation and analysis uncovered key evidence that told the story
of what occurred. A forensic examination of Employee A’s workstation led to the recovery of deleted documents that were revealed to be business filings for the side business started by Employee A from his residence. Further analysis of Employee A’s system revealed deleted internet artifacts that uncovered submitted responses to Department of Defense Requests for Quotes (RFQs) for the same parts that had been submitted a week prior by the company, only this time the submissions had different part numbers. Additionally, the Maryman investigative team discovered that the side business of Employee A did not have the proper certifications to manufacture and sell these parts to the Department of Defense.