E-sleuthing and the Art of Electronic Data Retrieval Uncovering Hidden Assets in the Digital Age Part III

Journal Issue

Apr 2004

Column Name

Journal HTML Content

Editor's Note:
Part I of this article appeared in the February 2004 issue, Vol. XXIII, No. 1, and Part II appeared in the March 2004 issue, Vol. XXIII, No. 2. A glossary of terms used can be found in Part II.
</blockquote>

<h3>Overview: Using the Tools of the Digital Information Age</h3>

In Parts I and II of this article, we discussed the realm of digital forensic technology with regard to the Bankruptcy
Code, Bankruptcy Rules and the Federal Rules of Civil Procedure. We noted that a debtor in the digital age is
unlikely to maintain paper records. As one prominent commentator has observed: "There are no filing cabinets full
of records that are easy to digest. Rather, there is a mass of computers, hard drives, software, CD-roms, etc., from
which we have to try to figure out what happened to this debtor."<a href="#3" name="3a">3</a>

Today, a formidable bankruptcy practitioner must be prepared to confront debtors and insiders on an
equal-technological basis. Often, this is done with the assistance of a trained digital forensic accounting
technologist. With digital discovery now coming of age, it is not surprising that ABI's Annual Spring Meeting
includes a panel entitled "Electronic Digital Discovery‹Finding the 'Byte' in the Haystack."

The purpose of this final Part III is to demonstrate, using practical, concrete examples from real cases,<a href="#4" name="4a">4</a> how digital
electronic data obtained in a digital forensic investigation can be used in conjunction with the hard copy documents
to reveal an accurate picture of a debtor's financial affairs. It is our hope that if you have still not considered the use
of digital electronic discovery in representing creditors, the examples set forth in this part will show you how vital
and accessible digital discovery really is, and how it must be in your arsenal as you engage in bankruptcy litigation
in the 21st century.

<h3>Example 1: The Case of the Self-dealing Insider</h3>

A chapter 7 business debtor's books showed that a large debt owed by a customer was never paid, and the customer
subsequently went out of business. That might have been the end of the story, except that during a digital forensic
investigation, a "deleted" electronic fax document was discovered. The fax showed that a key insider was in the
process of buying the company that owed the large debt to the debtor. Moreover, the digital forensic investigation
of the electronic books showed that the customer had made payments to the debtor that were applied to the benefit
of the insider. The digital forensic examination showed that within one month following the payments, someone
had "erased" those accounting entries from the books. Ultimately, the insider settled with the trustee for these
actions.

How did the trustee and his digital forensic experts break open the case of the "Self-dealing Insider?" Almost all
electronic accounting systems have "back doors" that allow for "fixing" and "tinkering" with the books. These back
doors into the accounting system will not be found on the accounting system flow chart because they are hidden and
provide invisible entry into the electronic books and records. Subsequent "erasures" of past accounting activity are
possible using accounting system "back doors." Without the use of digital forensic accounting technology, forensic
accountants and fraud examiners are often not able to discover the alterations and erasures made in the debtor's
digital database for the books and records. Call it a digital accounting shuffle. The "deleted" fax mentioned a
deposit made by the insider for the purchase of the customer's business. Evidently, the customer's payment was
used as the deposit. The insider and accountant did what was right only up to a point. They charged the outstanding
accounts receivable due from the insider account in the general ledger, but then, using the digital accounting shuffle,
they fixed their "mistake" and reinstated the amount back to accounts receivable using this hidden and invisible
"back door."

That was all in preparation of the next step in the transaction, because the next day the insider charged off the
accounts receivable from this customer to bad debts. The dates of the electronic transactions and original entries
were voided and made to appear as if they never took place. The debtor's accountant and computer consultant
assisted the insider in creating this "back door" fix. The customer eventually went out of business, but not until
after the insider had taken control of the company and emptied its accounts. Fortunately, a digital forensic
examination uncovered all of this.

In the digital world, it is easy to hide financial information from auditors and examiners who use only
"conventional" means to uncover it. Digital "back door" tools, alternative data streams, encryption and
steganography all play their part assisting self-dealing insiders and their accomplices.<a href="#5" name="5a">5</a>

<h3>Example 2: The Rejected Contracts and the "Lost" Digital Data</h3>

It can be easy for a debtor, including a debtor-in-possession (DIP), to "lose" potentially important data and
information. This can be done with particular ease if the debtor has leased its computers and other digital devices,
and then rejects the leases under §365 of the Bankruptcy Code. The computers and devices are returned to the lessor,
and the drives and memory are wiped clean. This can include desktops, laptops, PDAs and other devices from the
CEO, CFO, controller and other key personnel.

Bankruptcy practitioners must carefully scrutinize §365 motions to make sure that critical data will not vanish when
computer leases are rejected. Too often, trustees and committee counsel do not realize that potentially significant
data has been lost in this manner.<a href="#6" name="6a">6</a>

<h3>Example 3: The Case of the Phony Invoices</h3>

For most people, any digital accounting information is easy to accept as the truth. After all, it looks so
professional, and the professionals should know what they are doing, right?

In this case, the debtor's insiders created hundreds of fake customer invoices in order to fool lenders into providing
large loans using the accounts receivable as collateral. The insiders then used a "back door" to the accounting
program and "cancelled out" each of the fake invoices. Next, the insiders altered the digital books so that it appeared
that the invoice was never created in the first place. In some cases, the insiders created bogus "credits" showing the
same date as the fake invoices, thus offsetting the invoices, which were listing as "errors." Of course, the credits
were created long after the fake invoices were made. As a result of these relatively easy steps, the invoices did not
show up on the customers' accounts receivable records. Since the invoices and credits were all digital, it was not
hard for the insiders to pull off the scam.

In this case, it took an aggressive trustee and a trained digital forensic accounting technologist to uncover the
insider's fraud. First, the trustee got control of the debtor's computer hard drives. On first examination of the files,
there were no invoices or anything out of the ordinary. Nevertheless, using digital forensic technology, the trustee
was able to retrieve thousands of the fake invoices and uncover the fraud. Up until that point, the only thing the
insiders had been considering was how much to take and when to file bankruptcy.

<h3>Example 4: The Case of the Second Set of Books</h3>

In this case, a digital forensic accounting investigation strongly suggested that a second set of books and records
existed. You know, the "real" books and records. However, the initial investigation could only find one set of
generic electronic accounting software, and the debtor's insiders swore it was the only software they used.

An extensive digital forensic examination of the debtor's hard disk drive showed that a QuickBooks program had
been deleted from the hard drive. Why would QuickBooks have been deleted from the hard drive if the debtor never
used it? The insiders insisted they did not know how it happened. Later, after reviewing every byte of the hard
drive, the forensic technologist found something even more telling: A check had been issued to a computer store
with the memo notation for the purchase of the QuickBooks software. In the face of this compelling information,
and wanting to avoid more severe consequences, the insiders decided to cooperate with the trustee, and subsequently
settled numerous disputes with the trustee resulting in a substantial settlement to the estate.

<h3>Example 5: The Debtor Who Changed the Hard Drive</h3>

Okay, sometimes digital fraud is easy to detect. In this case, the trustee made a demand for the debtor's computer.
A few weeks later, the debtor's attorney turned over the computer.

A digital forensic examination determined that the computer hard drive was devoid of any data relating to the
debtor's business. What was even more obvious was the fact that the hard disk drive found inside the debtor's
computer was not the original hard disk drive. The debtor had replaced the original hard disk drive with a hard disk
drive that was manufactured after the date the debtor filed for bankruptcy! The debtor even tried to move some
useless "decoy" information from another disk drive onto the replaced hard drive, but the footprints from this effort
were likewise very obvious.

<h3>Example 6: The Case of the Frightened Accountant</h3>

In this case, the electronic books and records were kept on the debtor's computer. However, the accountant kept the
debtor's "real" books and records on the computer in his own office. After some investigation, the debtor's finances
just did not add up. It was not that the accountant was suspected initially, rather it was that his myriad excuses and
explanations did not resolve the problems with the estate. Increasingly, the trustee was forced to consider whether
the accountant was a part of the problem, despite the accountant's repeated denials.

When the accountant realized that that the next step might be a full digital forensic examination of his computer, the
accountant gave up. "What will it take to end this now?" he asked. The trustee obtained significant settlement in
this case for the estate.

<h3>Conclusion</h3>

This series of articles has introduced bankruptcy practitioners to the reality of digital electronic data, and to suggest
that it will no longer do to assume that all relevant data can be discovered in easy-to-understand hard copy.
Financial data is now almost exclusively generated in digital form, and as we have shown, this opens a myriad of
avenues for unscrupulous insiders to modify and manipulate data to their own ends. The conventional methods of
forensic accounting are insufficient to meet this challenge. Digital data is the reality of the 21st Century, and
practitioners who work for trustees and creditors must understand how to use digital forensic accounting expertise
when dealing with potential debtor or insider fraud.

In this article series, we have introduced some of the key technical tools and terms, and have discussed the legal
regimes that govern digital discovery. Of course, it is not expected that you will also be your client's digital
forensic accounting technologist, no more than attorneys would hire themselves as the client's CPA or financial
consultant. But bankruptcy practitioners today would do well to acquire a basic understanding of what digital
forensic accounting is all about, and to know when to hire an expert as the need arises.

<hr>
<h3>Footnotes</h3>

<a name="1">1</a> Jack Seward is a consultant and has an association with a forensic accounting firm in New York City. He is a veteran of many years of forensic accounting and electronic data sleuthing. <a href="#1a">Return to article</a>

<a name="2">2</a> Daniel Austin is a lawyer in the Pittsburgh office of McGuireWoods LLP, where he specializes in bankruptcy law. Mr. Austin may be reached at <a href="mailto:daustin16@hotmail.com">daustin16@hotmail.com</a>. <a href="#2a">Return to article</a>

<a name="3">3</a> Furr, Robert C., "NAB Talk" (editor's column), Journal of the National Association of Bankruptcy Trustees, Summer 2003. <a href="#3a">Return to article</a>

<a name="4">4</a> All names have been changed. <a href="#4a">Return to article</a>

<a name="5">5</a> See Seward, Jack, "Digital Stealth Secrets and the [Sarbanes-Oxley] Act," LJN's Corporate Compliance & Regulatory Newsletter, Law Journal Newsletters, March 2004 (<a href="http://www.ljnonline.com">http://www.ljnonline.com</a>). <a href="#5a">Return to article</a>

<a name="6">6</a> Seward, J., "What You Need to Know About a Debtor's Leased Computers." LJN's Equipment Leasing Newsletter, Law Journal Newsletters, December 2003 (<a href="http://www.ljnonline.com">http://www.ljnonline.com</a>). <a href="#6a">Return to article</a>

Journal Authors

Daniel A. Austin

Jack Seward

Journal Date

Thursday, April 1, 2004 - 12:00

Bankruptcy Rule

2004