Crime shows such as CSI, USB sticks and email boxes that hold gigabytes of data: Companies stop employees stealing or misusing company information by analysing metadata automatically stored by software applications. Peter Mercer visited Wellington to promote Intella.

The following article was published in on www.stuff.co.nz. You will find the full text of the article below. Link to the article.

Crime show hints give forensic headaches

By TOM PULLAR-STRECKER - The Dominion Post    Last updated 05:00 02/11/2009

Fictional crime shows such CSI, USB data sticks and email inboxes that can hold gigabytes of data are all making it harder for businesses to stop employees stealing or misusing company information, says Australian computer fraud expert Peter Mercer.

Shows such as CSI are teaching fraudsters some of the basics in how to cover their tracks, such as the importance of clearing the hard drives on their computers, he says. "Those kind of shows can give people a bit more information than you would want."

Meanwhile, the volume of data and range of document types that need to be analysed risks swamping investigations.

Mr Mercer, chief executive of Vound Software, visited Wellington to promote Intella, an anti-fraud tool that lets non-technical staff manage investigations by searching for keywords in documents and file attachments and mapping the relationships between computer users, documents and devices.

"We had a recent case where somebody had scanned a document and emailed it so keyword searches weren't going to help. But we were able to look at all the pictures the person had sent, and from there work out that was an issue."

In another case, a staffer was detected printing an allegedly stolen document two hours before leaving the company.

Barry Foster, a forensic expert with consultancy Deloitte, who used to head the police electronic crimes lab in Auckland, says fraud is on the rise because of the economic downturn. Deloitte, which uses Intella in its own investigations, was contacted by four companies in a single day last month, all concerned by suspicions of data theft, some involving "high-level staff".

Despite the growing sophistication and complexity of computer fraud, Mr Mercer says some big cases have been cracked by analysing metadata – information about information – automatically stored by software applications.

He points to the settlement of a huge legal dispute in Hong Kong. A document was purported to have been printed at a certain time, but there are rumours metadata revealed that was before the make and model of the printer in question had been manufactured.

Another multimillion dollar case that he worked on involving a subdivision dispute was quickly solved after message identity fields showed an email had been forged from a joke email."

REDEYE FORENSICS organises an Open Seminar for Korean law enforcement organizations. The main topic of this seminar is e-Discovery and e-mail forensics with Intella.

Date: Friday, December 11, 2009
Time: 02:00pm - 05:00pm

The seminar program:
- 02:00 - 02:45 Global Forensics Technology news
- 02:45 - 03:00 Coffee break
- 03:00 - 05:00 e-Discovery and e-mail forensics with Intella.

Location: Seminar room, B1F, BMS B/D, 829 Yeoksam-dong, Gangnam-gu, Seoul 135-936, South Korea

To subscribe for this open seminar, please contact This e-mail address is being protected from spambots. You need JavaScript enabled to view it

Architect of Innovative Email Investigation Software Product Intella™ to Address HTCIA Asia-Pac Conference Email files are an evidence-rich source for computer forensics investigators and technicians. Vound, LLC’s Intella™ enables the investigator to visually examine email and documents to quickly and easily find pertinent evidence and relationships.

Evergreen, Colorado (PRWEB) November 23, 2009 - Vound, LLC announced today that Mr. Peter Mercer, founding co-partner of Vound and chief architect of Intella™, the exciting new and innovative email investigation and eDiscovery software product, will speak on the opening day of the High Technology Crime Investigation Association (HTCIA) 3rd Annual Asia Pacific Regional Training Conference. The conference will be held in Hong Kong on December 2-4, 2009.

Mr. Mercer’s address is entitled “Large Scale Email Forensics and LLP Issues.” Mr. Mercer will also lead a conference workshop on the subject of “Deconstructing e-mail database structures.” His comments will focus on examining the ever growing, evidence-rich email files that are proliferating in business and personal communications today.

As the chief architect of Intella™, Mr. Mercer led the development and introduction of one of the most innovative email investigation tools on the market today. Intella™’s powerful indexing search engine and its unique visual presentation enables investigators to quickly and easily search and review email and electronically stored information to find critical data, visualize relevant relationships, and drill down to the most pertinent evidence.

With Intella™, investigators can easily:

• - Preview email and data files for investigation and eDiscovery
• - Gain deeper insight through visualization
• - Search email, attachments, embedded images, archives, headers and metadata
• - Drill deeply using Intella’s unique facets
• - Group and trace email conversations
• - De-duplicate and cull email and files for post-processing
• - Export results in a choice of formats for reports or post processing

Intella™ is used for such applications as: investigating improper email usage, uncovering inappropriate images, disclosing intellectual property theft, and eDiscovery preparation.

About Vound, LLC.
Vound, LLC is a U.S.-based digital forensic software company with operations in Europe and Australia. Vound’s flagship product, Intella™ is in use at enterprises, consulting firms, law enforcement agencies, law firms, and government regulatory bodies world-wide.
For more information about Vound, LLC and Intella™, visit: http://www.vound-software.com

The Intella™ development team is pleased to announce that Intella™ Release 1.2.2 is now available: Improved support for Lotus Notes NSF files, an Update Check feature, improved Previewer and more.
 

RELEASE NOTES - Intella™ Release 1.2.2 contains the following improvements:
 

• Stability improvements have been made for Lotus Notes (NSF) file indexing and exporting. In earlier releases, on rare occasions, an NSF file (usually a corrupt file) caused Lotus Notes to crash. When that happened, Intella™ would be shut down, too.  Enhancements in Release 1.2.2 will prevent Intella™ from crashing under that circumstance. Under that circumstance, Intella™ will now continue processing the remainder of the file.
  
  Note that the Vound Forum contains a number of tips for fixing corrupt NSF files!  You can register on the Vound Forum at this location:  http://support.vound-software.com/
   
• An Update Check feature has been added that checks online whether a new Intella™ version is available.  This option may be switched off.
   
• The Previewer features several improvements:
  - For archives (e.g. ZIP files) an Entries tab is shown that lets the user see and navigate the contents of the file.
  - The Properties tab shows an additional number of metadata fields. 
  - Icons are shown for known file types, making e.g. Word files instantly recognizable.
  - Finally, a number of usability improvements have been made.
   
• Previously, during a Refresh operation Intella™ would occasionally mistakenly report changed items when the evidence files had, in fact, not been changed.  This has been fixed.
   
• The Add Source wizard remembers the last path of the chosen source files.
   
• When navigating with the Previewer from result to result, the Results table will now adapt its selected row accordingly.
   
• The "Export to PST" option is now explicitly disabled when Outlook cannot be found, rather than producing errors during export.
   
• A number of fixes have been made for retrieving and interpreting mail messages and for indexing corrupt ZIP files.