"First, we boot evidential computers direct from a USB drive, or we remove the drive from the machine, as it is important that the preservation process itself does not disturb the evidence. We then image the drive using industry approved technologies which delivers a forensically sound evidence that will stand up to the rigours of investigation and the Court processes.
"The second step in the process is building the case, reconstructing the paper trail, validating and or reconstructing the financials, reviewing the contractual and non-contractual elements around key transactions, identifying side letters and agreements, investigating conflicts of interest in the entity's dealings, to determine whether fraud has occurred. This function falls squarely in the hands of the forensic accountant, who might not necessarily have or require a technical IT background, as the data cataloguing and data mining in the forensic exercise is already complete -- the forensic accountant role is akin to investigative audit."
Wayne Kedzlie's company, HardData, is a specialist, Wellington-based consultancy that has worked on a number of significant engagements, providing a range of computer and accounting forensic skills to individuals, corporates and government departments and providing expert testimony.