For Companies · Fraud, incidents and compliance

The biggest corporate mistake: the in-house "examination"

The script repeats itself in almost every corporate case that reaches the laboratory. A report of misconduct comes in and the company, wanting only to check whether it holds, asks the technology team to inspect the employee's computer. In other cases the employee is suspended or dismissed at once, and the equipment goes straight to the same in-house analysis. The intention is legitimate; the method, disastrous.

Because the IT team does not master the consequences of a computer forensic examination, the device is switched on and browsed, new accounts are created on the machine, the user's passwords are changed to gain access to the environment and check what was on the desktop, which sites were visited, what was done on the day the report refers to. Every one of those acts alters artefacts and overwrites trace evidence. The material that would prove the conduct stops working as evidence, precisely because it was examined.

Civil and employment cases bearing that mark are countless in forensic practice: the employee dismissed for cause files to have it reversed, the evidence is produced, and the examination finds that computer and mobile phone were handled after the termination. Financial institutions live the same drama at scale: the urgency to look into the insider or the internal fraud compromises the evidence, and the actual conduct becomes provable internally but unprovable on the record.

What to do in the first hour

Take the equipment out of use without switching it on, browsing or "having a quick look": preservation comes before inquiry
Record in writing who learned of the report, when and through which channel
Suspend automatic purging of logs and backups for the period
Bring in counsel and a forensic expert before any internal technical measure
If there is suspension or dismissal, seal and store the devices exactly as they are

What not to do

Ask IT to inspect the machine: IT solves incidents, it does not preserve evidence
Create accounts, change passwords or access the user's profile on the equipment
Confront the suspect before the evidence is preserved
Return, format or reassign the equipment of someone who left under suspicion

A specific warning for BYOD policies (use of personal devices): when the incident happens, the company wants to examine the employee's device, but the equipment belongs to him. Without a prior clause in the acceptable use policy allowing the personal device to be audited where the need is demonstrated, the examination simply cannot take place. The time to write that clause is before the incident.

Scenarios

Situations where the examination decides the outcome

Internal fraud

Suspected fraud or misconduct

An inquiry without forensic method contaminates the evidence and makes accountability impossible. Investigation with chain of custody produces evidence that supports dismissal for cause, a claim for damages and reporting to the authorities.

Unfair competition

Information taken to a competitor

Misconduct that unfolds into unfair competition: employees passing on confidential information, client portfolios, projects and trade secrets. The examination demonstrates the leak, the authorship and where the information went.

Incident

Intrusion, leak or incident under way

Every hour without preservation is evidence lost. The response combines technically guided containment and immediate forensic collection, so the company comes out of the incident with facts, not assumptions.

Employment

Dismissal for cause with technical backing

Dismissal for cause grounded in a forensic examination holds up in the Labour Courts. Without an expert report, reversal is the rule; with sound technical evidence, the company's decision stands.

Compliance

Reports, LGPD (Brazil's data protection act) and compliance

Impartial inquiry into ethics hotline reports, response to data incidents and documented internal investigations, with a report that grounds administrative and regulatory decisions.

IT contracts

Disputes over systems and software

Projects delivered outside the contract, systems that do not work, failed rollouts: technical analysis establishes what was contracted, what was delivered and where responsibility lies.

Intellectual property

Copied software or alleged infringement

From source code taken by former employees to defence against software infringement notices: the examination compares, quantifies and grounds the company's position.

Financial fraud

Scams, payment slips and payment channels

Fraud in payment slips, payment terminals, transactions and reconciliations: the examination reconstructs the flow of the fraud and identifies where security was breached.

Free material

Party-Appointed Expert Guide (PDF)

CPC (Brazilian Code of Civil Procedure) deadlines, a checklist for preserving digital evidence and the golden rules for drafting questions. Download it and use it on the next case.

Forensic work follows the legal strategy

Forensic work for the client company always runs side by side with the technical and legal strategy of the in-house legal department or of retained counsel. The examination does not replace the legal case: it supports it with proven facts.

What your company receives

Documented chain of custody: evidence materialised in a secure and verifiable way

Methodical forensic analysis, reproducible by the court-appointed expert or by a third-party expert in an audit or arbitration

Technical report or expert report with legal validity, signed with ICP-Brasil

Explicit statement of the technical limitations of the examination (the forensic honesty that sustains the evidence under challenge)

Objective guidance for administrative or judicial decisions

Where the examination looks ahead to litigation: full technical assistance, with preliminary, complementary and supplementary questions to the expert, attendance at the forensic site visit and verification of the methodology applied by the appointed expert, so that any irregularity is identified in time

A screenshot does not survive the challenge. Preserved evidence does.

Before you confront, preserve. The first right move is worth more than ten later ones.

An approved report with an error becomes a court decision

With the large volume of new registrations in the court systems, not every appointed expert is fit for highly complex examinations. When the professional makes a serious error and nobody identifies it in time, the error turns into a court decision: the court is led into a mistaken understanding of the situation.

At the opposite extreme, when the appointed expert is highly qualified, precise and technical questions become even more valuable: the experienced professional digs in until he can answer each question with full confidence, because he knows he cannot get it wrong. An approved report containing an error may amount to false expert evidence, with civil and criminal liability for the professional.

And there is the most frustrating scenario: the party spots the expert's error but has no party-appointed expert, and the moment passes. At the appeal stage there is no further examination, and reversing the decision to produce new evidence is extremely hard. That is why the right moment to bring in the party-appointed expert is the beginning: named within the deadline of CPC, art. 465, § 1 (Brazilian Code of Civil Procedure), he follows the work from the expert's appointment onwards, and every flaw is flagged while it can still be corrected: inside the examination, not on appeal.

The party-appointed expert at every moment

Preliminary, complementary and supplementary questions based on the analysis of the evidence
Attendance at the forensic site visit, act by act
Verification of the appointed expert's methodology and immediate identification of flaws
Technical grounding for appeals and interlocutory appeals, including hearings before the higher courts
Translation of technical complexity: the report the court-appointed expert respects and the layperson understands

A forensic expert is not allowed the possibility of error.

It falls to the party-appointed expert to make sure no error goes unnoticed, and no sound finding goes unrecorded.

When the incident happens, the evidence decides the outcome