Jan - British Chamber of Commerce in the Czech Republic

More documents

Recommendations

Info

Patron’s Page You’ve Got Mail! Nobody writes letters any more – the day of the inkstand and quill are long since past. Indeed many of us don’t even like to pick up a telephone, or talk to a colleague. Instead we all sit glued behind our screens and quite happily send an email to a colleague sitting directly next to us. What has the world come to? Well aside from the fact that we are all becoming less and less verbally communicative as people, email has spread like wildfire over the past decade. Email is used so much in fact that it has become in many corporations an official and approved means of communication. However, great benefits do not come without trouble. When I want to destroy, say, a letter, it is easy. I burn it. It is gone, end of story. But in the digital age, people have long given up caring about how computers work, and so make the grave assumption that a mail deleted is a mail ‘burnt’. How wrong. An email is not a ‘unique’ item. When an email is sent, it travels through many servers (or, if you like, post offices), and at every server it may leave a copy of itself behind, leaving a long paper trail from the original sender’s outbox to the recipient’s inbox and then again to every person he or she forwards this mail to, or to whomever was copied (cc’ed) to the original message. Once an email is sent, you never know how many copies will be generated. Now how does this all tie in with performing a fraud investigation? Email has become so prolific that every person’s mailbox has become a dumping ground for huge amounts of potential evidentiary information. Many people do not delete emails, many replicate local copies to their workstations, many think that deleting an email means that it is has been wiped from the face of the earth. Now, like every treasure-trove, there are always booby-traps to hinder and prevent your from achieving your quest. In relation to emails, there are a number of them that have to be carefully navigated to ensure an efficient investigation. Complications Initially there is the technological issue – different organisations have different infrastructures. (I wish they were not allowed to; it makes the life of a Forensic Technology Specialist a nightmare.) We need to be able to take whatever media that these email archives are stored on (such as DAT, CD, DVD, DLT, LTO… the possibilities are almost endless). We then need to extract the file from this media. �is sounds like a walk in the park, however there are a number of rather tricky technical considerations that need to be navigated to ensure a successful extraction. Further consideration needs to be given to the fact that email servers are o�en backed up and archived on a periodic (daily /weekly/ monthly) basis, meaning that you can theoretically end up with, for example, 18 months 20-21 F O C U S 1 of restored mail boxes with the same message appearing in every one. �erefore to prevent repetitive and extremely dull reading, we need to ‘de-duplicate’ these messages to ensure that any one unique message appears only once in our review. Before Computer Operating Systems realised that English was not the only language it should support, many people had problems sending emails in their local languages, so – particularly in Central Europe – there is a common habit of people to basically write their correspondence in a Word Document, and attach it to the mail. �is means that not only do we have to think about de-duplicating (de-duping) the emails, we need to also extract their attachments and be able to efficiently read and search those too. We get into further problems when users password-protect their attachments, and (even worse) encrypt their emails when communicating with one another. However, to my mind it seems like an obvious pointer to files and emails that really need to be looked at in detail. Drilling deeper Once we have navigated these obstacles and done what we can to avoid problems, the result is still a formidable haystack, within which we must search for the needle needed to support our investigation. In order to do this, we need to process the data in such a way that everything is indexed. �is means, for example, that I am able to search for the word ‘Josh’ across 20 mailboxes instantaneously, from 18 months of backups. For those tricky password-protected files, they obviously cannot be reviewed without removing the protection first. �ere are three ways in which this can be typically done, and in this order of ease and efficiency. First ask what the password is. �is sounds like madness to many people, but from my ‘Attack & Penetration testing’ days, it was the first thing I learnt. Second, attempt to locate a back door to the file. Many file-protection techniques are not as strong as they are made out to be, so it is possible to bypass the protection entirely, accessing the file without ever knowing the password. �ird and finally, attempt the ‘passwordcracking’ of the file. Now this sounds really techie and cool, however it is painstakingly THINGS YOU DID NOT KNOW ABOUT PricewaterhouseCoopers • PwC are the largest of the Big Four. • In fiscal year 2005, PwC member firms performed services for 82 % of the companies in the Fortune Global 500. The magazine of the British Chamber of Commerce in the Czech Republic slow, and has very low yield, simply because of the amount of time, and the power of the systems needed to crunch the possible permutations. For example a seven-character password gives rise to a mere 64,847,759,419,264 (yes 64 trillion) possible combinations. �is will take even the most powerful of computers aeons to process. So option three is really not ideal. Pulling it all together So we have extracted our mail boxes, merged them, and then removed the duplicates. We have similarly extracted all the attachments and password-cracked those files that are protected, and then we have indexed all available data. And now, finally we have been able to run searches across this information and identify information to support us in our investigation. Having performed all of this and having extracted some potential (if not real) ‘smoking guns’, consideration needs to be given for the place of electronic evidence – especially emails – in an investigation. Going back to my opening comments about not being aware of how many copies of an email are really distributed, it is similarly very possible that people receive mails without ever knowing about them and also without ever reading them. In considering the applicability of electronic evidence, the deciding factor is whether or not possession implies knowledge or whether ignorance implies innocence. It is a difficult call to make, and therefore it is important that when reviewing emails (and other types of electronic evidence) that due consideration is given to the accuracy of correlation of evidence to the suspect. Despite all of these considerations and pitfalls that can be encountered when attempting a successful email analysis, in my experience the benefits to be reaped from performing this nature of work when supporting an investigation can make all the difference. �at’s all for this week. Tune in next time for ‘Protect Me!’ Josh Ellis Investigations and Forensic Services PricewaterhouseCoopers Kateřinská 40/466, 120 00 Praha 2 T: +420 251 151 111, F: +420 251 156 111 E: name.surname@cz.pwc.com www.pwc.com/cz
Events Round-up Breakfast Briefing: “Expatriate Tax Update” Petra Kleinová and Bryan McSweeny of PricewaterhouseCoopers presented to over 60 British Chamber of Commerce members on 25th November. �e topics included Czech immigration policy, post EU-accession procedures and the impact of the EU Savings Taxation Directive on individuals. �e audience was very interested to hear that, while many of the hassles regarding obtaining Czech work permits and residency visas have been reduced, there are still many areas where challenges exist due to frequent changes in the immigration legislation. But for the most part, procedures for UK citizens are much easier; generally it’s only necessary to register with the local labour office and foreign police office. For UK citizens who intend to stay in the Czech Republic on a long-term basis, there is the option of obtaining a special Czech EU residence permit. �e audience was advised to consider how the sharing of financial information among banks and authorities in the EU needs to be considered to ensure no surprises arise in matters of personal income tax compliance. For example, UK citizens who are Czech Republic residents for tax purposes should be aware that if they have ADVERTISEMENT WI-FI INTERNET in our PIANO BAR. Petra Kleinová, PricewaterhouseCoopers Bryan McSweeny, PricewaterhouseCoopers a British bank account, the UK bank is generally obliged to report any interest YOUR BUSINESS – OUR CUP OF TEA Enjoy the possibility to hold a business meeting in a cosy and intimate atmosphere of Piano Bar with full service of our friendly and professional staff. Live piano music every night. Open daily from 10 a.m. to 1:30 a.m. Hotel President***** Nám. Curieových 100 | 110 00 Praha 1 | tel.: +420 234 614 100 | fax: +420 234 614 110 e-mail: reservations@hotelpresident.cz | www.hotelpresident.cz payments to the Czech tax authority, to ensure that income was properly taxed. Hotel_President_IT_inz.192x136.indd 1 6.1.2006 9:30:33 BCC – Working for a better business environment
Page 1 and 2: 1/ 20 0 6 T H E M AG A ZINE O F T H
Page 3 and 4: Board of Directors of the British C
Page 5 and 6: a�ernoon lottery, which included
Page 7 and 8: Introducing New Members Coffeeheave
Page 9 and 10: Personally, I am glad that the gove
Page 11 and 12: Focus on … New Age - IT & Telecom
Page 14 and 15: Focus on … New rules in the mobil
Page 16 and 17: Events Round-up Starry Night Gala C
Page 18 and 19: Events Round-up Key Tax Issues for
Page 22 and 23: Embassy Latest British Airports Gro
Page 24 and 25: Management Corner The Consulting Ch
Page 26 and 27: Chamber People News Ivana Kolářov
Page 28 and 29: Survey Perceptions of Corruption in
Page 30 and 31: Members of the BCC 30 F O C U S 1 P

Jan - British Chamber of Commerce in the Czech Republic

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?