About fraud, forensics and dispute resolution

Fraud is a complex social phenomenon, which has been on the rise in Russia since 2008, when stability in employment and commercial relations has been severely damaged. Typically, fraud causes direct financial losses, but also reputational damage, loss of trust and a whole range of legal issues. We practice multidisciplinary approach to their resolution by bringing together lawyers and forensic practitioners.

A: Skillset of a litigator and an investigator – how are they compared?

M: Good question. Those projects, where we started working together, do you remember that feeling of synergy? I think all this boils down to core competences. What a good litigator should be able to do?

A: Collect, organize and evaluate evidence. Communicate and convince in a situation, often under pressure. Control himself and a situation. Dig deep into the matter.

M: But the basis of the investigator’s skillset is the same! The question is what you build on that basis. Forensic accounting, intelligence analysis, labor and corporate law or procedure. A person, capable of convincing a judge in his point of view, particularly in Russia, may well build and operate a robust intelligence network.

A: In other words, skillset is more or less the same, although its application may differ. We build our practice on combination of multiple disciplines, as we believe that only this combination leads to positive client outcomes.

Historically, there are many terms in anti-fraud practice, which may be unclear for general audience. We have collected here frequently asked questions.

Quesiton: What should I do if the fraudster does not have enough funds in Russia to enforce a court award?

AbouzovKrapivin: Work where he has such assets. As in Russia fraud schemes have become more and more sophisticated, often asset recovery necessitates use of interim measures and remedies offered by other jurisdictions, first of all common law countries, including may offshore havens. These are, for instance, disclosure and freezing orders.

Over years we have built partner relationship with the best practices around the world, and often manage international asset tracing and recovery projects.

Question: What should we do if an employee had defrauded our company?

AbouzovKrapivin: First of all, calm down and don’t make any mistakes. Remember about core tasks, which are remuneration of damage and correct employment termination. These are tasks covered in our practices “internal investigations” and “dispute resolution”.

Question: What is forensic?

AbouzovKrapivin: Merriam-Webster dictionary defines forensic as “relating to or dealing with the application of scientific knowledge to legal problems”.

In the Russian language “forensic” becomes a well-accepted term as well. Forensics in our practice means examination of facts using professional or scientific knowledge to establish truth, gather evidence and enable use of legal remedies in conflict situations. Lawyers work with forensic analysts in our practice. This includes:

  • Forensic accounting - establishment of facts in internal investigations for further use in dispute resolution;
  • Computer forensics lab, which allows us to collect data, recover deleted information and examine digital evidence to establish facts in full compliance with applicable law;
  • Expertise in gathering and analysis of information from various sources and establishment of facts about companies, persons, assets and links among them (forensic intelligence).

Question: What is computer forensics?

AbouzovKrapivin: Computer forensics is the scientific process of collection and analysis of digital information for independent findings of facts within the prescriptions of applicable law.

Much more information is stored at data storage devices than most people think. Also, it is much more difficult to delete it irretrievably than most people think. This data is a valuable and, sometimes, the only source of evidence.

To be able to work with this key source of evidence in investigations we have established a computer forensics lab – group of experts in the area of digital evidence armed with needed software and hardware infrastructure to conduct forensic examinations. They are forensic examiners at crime scene investigation when bad faith actions have a “digital component” (for instance, when digital information had been stolen) or when evidence of fraud (for example, an e-mail) is located on a digital storage device. They analyze the contents (including deleted and subsequently recovered data) of servers, hard drives, micro-storage devices, mobile devices and communicate their findings to lawyers-analysts who work on this investigation.

Question: What is an “image” of a hard-drive?

AbouzovKrapivin: Image of a data storage device is a non-invasive creation of a 100% sector-by-sector copy of the original media. Instead of simply copying files, digital evidence experts typically image data storage devices. By doing so the following matters are resolved:

  • No change in original data and 100% authenticity of the image. This is important from the standpoint of future use of identified evidence in legal proceedings.
  • Security of original data. Further examination (including examination of artifacts of the operating system and file structure, recovery of deleted data, examination of user’s activity, etc.) is performed on an image, while the original data storage device may be safely secured unchanged.
  • Capture of all data. Imaging creates 100% replica of the original information, including deleted data, which has not been over-written, and unallocated clusters. Simple copying does not give this result. Enough to say that presumably deleted data is of a very special interest in any investigation.