When you’ve hired a digital forensics professional to track down old financial files or other information, it’s often very important to make sure that you have knowledgeable possession of the file. There are four main factors that will determine whether or not you or the forensic professionals have knowledgeable possession of the files. You only need to have one of these to have attained this status.
1. You Can Perform Timeframe Analysis
Timeframe analysis is when you are able to identify exactly when the file was last accessed and on what date. This is helpful because for businesses, you can often determine who had access to the computer on that date, and then use security cameras to figure out who accessed the computer at that specific time. This will help reinforce any evidence that you find on a person’s computer by proving that he or she was indeed the one who altered the file.
2. Check the Contents For User Identification
If you can’t perform timeframe analysis, then you can always check the contents for user identification. Examples of user identification could be unfinished resumes, personal bank account numbers, a social security number, and other information that would definitely identify the person who had been modifying the file.
3. Check For Non-Default File Locations
Suppose that you’re looking for proof that someone was evading their taxes and had tax forms that didn’t match those that were put out by the IRS. User created files will always have the name of the person who created them in their “Properties” tab, or at least the label “Owner” on them. For example, if a person downloads his or her tax forms off the Internet and saves them in a folder labeled “Taxes” rather than the “Downloads” default folder, then a folder tag will be created with the name of the computer user who created. This is most helpful for shared computers.
4. Check For Password Matching
If an employer suspects that an employee is downloading information on his or her own time and finds a password protected folder, he or she could determine that the employee created the folder if the password that is protecting the folder is similar to the one that the employee uses to log into his or her own account.
For more information, contact a company of digital forensics professionals (such as http://www.eppsforensics.com). They will be able to help you determine if you have knowledgeable possession, or help you obtain knowledgeable possession if your case needs it.