VFC & Quickbooks Case Study

Using VFC to aid Financial Investigations

MD5 often have to find alternative ways to extract key case evidence. In this instance, one of our analysts used our proprietary software product, VFC, alongside our eForensics solution. This allowed us to deliver a truly bespoke solution for one of our customers. We wanted to share the idea in the hope it may benefit your own investigations.

Accounting software such as QuickBooks and Sage can be a very valuable source of evidence when investigating financial cases, such as:

  • Fraud
  • Internal Business Problems
  • Staff Investigations
  • IP theft

Often with accounting programs such as these, a proprietary file format is used that can be difficult to view outside of the native application. The challenge for a forensic investigator is providing the information identified within the respective applications in a format that can be easily understood by everybody involved in a case.

When it comes to QuickBooks and Sage, investigators will have some success with tools such as EnCase and Nuix. However, providing this information to a client in a user-friendly format can often prove challenging. Virtual Forensic Computing (VFC) software, by MD5 can offer an alternative approach.

In a recent Fraud case investigated by MD5, our analyst used VFC to create VM copies of a number of computer exhibits. These were all running QuickBooks and contained QuickBooks application data. By doing this, our analyst was able to browse, identify and extract a significant volume of key evidence which directly related to the investigation. The data was exported to Excel spreadsheets and extracted from the Virtual Machine environment. Our analyst then uploaded the data to our eForensics online review platform for further investigation.

Read the full story here: Quickbooks VFC Case Study

For further information, please Contact Us now for your free no obligation quotation.

  • “MD5 supported my family and I to retrieve personal information in tragic circumstances. Their care, compassion and professionalism made a huge difference to us. Personal and genuine help when we needed it most.”

  • “We all appreciate the support and help you and MD5 have provided us.  Your software and customer service help considerably in our forensic work; particularly in the preparation of evidence in a user friendly way. - A North East Police Force

  • … I just mentioned your name and how helpful you were to my Inspector.  I imaged a drive which had some positive keywords on Monday and thought I would have a look at it using vfc.  The results were extremely impressive.  It showed the suspect using a website to download illegal content and also showed the actual folders on his desktop.  Makes proving this case really easy.  Thanks again.

  • “I found your VFC Demonstration most useful as it is an area I have been discussing with a colleague and how we would be able to utilise the standalone VM to assist in communicating evidence to lay people. The addition to be able to stitch in a second drive is a brilliant addition to the product as we are now able to fully replicate the users environment rather than just their Windows installation drive. I was scratching my head as to why a user in the wild would ever want to put their paging file on another drive and can happily confirm that I have never seen it but I’m more confident we can overcome the issue thanks to your input.”

  • “VFC is a very useful tool for us as the screenshots we can show a jury far outweigh simply writing about a topic.”

  • “VFC has become an essential tool in our forensic investigator's toolkit. It provides investigators an insight into the suspect's perspective by actually seeing the user's desktop, settings and user environment. Screen captures from the suspect's ‎environment add significant weight to the forensic report when describing how the suspect utilized the computer to facilitate the crime. VFC is truly a tool that I rely upon and use in all my computer investigations!”

  • “Your assistance and eDisclosure package was very useful, it enabled me to fully review all the documents from the computers and was made available to the defence during the service of the papers.”

  • “Leader of International drugs trafficking & money-laundering ring jailed for 27 years. The ringleader behind an international multi-million-pound drugs trafficking and money-laundering ring in South Yorkshire has been sentenced to 27 years in jail. See more at: http://www.itv.com/news/calendar/update/2013-07-30/leader-of-international-drug-and-money-laundering-ring-jailed-for-27-years  ”

  • “Working with MD5 is an Absolute Pleasure.”

  • “Data received, with relief! Thanks for your efficient service and clear communication throughout.”

  • “Juries get stuck looking at our technical printouts and reports. Instead, we booted the image using VFC with judge, jury and everyone else in the court room. It was clear to see what had really happened.”

  • “VFC - A great product of real use as a forensic examiner.”

  • “I was very satisfied with MD5's performance in relation to the recent eDisclosure exercise with which they assisted.”

  • “MD5 were able to extract vital contact details from a severely fire damaged phone this proved extremely important in identifying who the phone belonged to.”

  • XERA iConect
  • Crown Commercial Service Supplier
  • Cyber Essentials Plus Certified
  • NEWA 2017
  • MSAB Logo
  • Cellbrite Logo
  • Sherlock Oxygen Forensics
  • XRY
  • Guidance Software