A global insurance company instructed Hawkins on a matter requiring digital forensics services. The insured had made a significant claim for the theft of luxury jewellery from their home. Luckily, the claimant was able to provide still images from their home security system digital video recorder (DVR) of the reported burglary, as well as mobile phone digital photographs of the stolen jewellery.
However, the insurer had sufficient reasons to suspect that the insured was falsifying not only the home burglary, but also the theft of the jewellery, and the subsequent insurance claim. These reasons included some of the common warning signs in fraudulent insurance claims, such as the insurance policy being setup only a few days prior to the reported theft, limited and mixed information provided in the insured’s claim statements, as well as minimal damage to the property. Due to these concerns, the insurer instructed Hawkins to forensically examine the insured’s devices to determine the metadata of the DVR still images and mobile phone digital photographs, produce a timeline of events and prepare a detailed expert witness report.
Digital Forensic Investigation
The insured only provided their Swann DVR and Apple iPhone for forensic examination by Hawkins after they were served a court order instructing them to do so. Our investigator was able to acquire a copy of both the live and deleted data stored on each device, having bypassed the password for the DVR in the process as the insured had ‘forgotten’ it; an all-too-common excuse in fraudulent cases.
Upon analysing the extracted data, including the metadata of the DVR still images, Exchangeable Image File Format (EXIF) data of the mobile phone digital photographs, and system logs, we identified that the dates and times of the devices had been manually changed to display false dates and times. Metadata is data that provides information about aspects of other data, such as the created, last modified, and last accessed dates and times. EXIF data is a standard that defines specific information relating to images captured by a digital camera, such as created date and time, device make and model, and GPS location. Therefore, Hawkins could evidence that the still images and digital photographs had in fact been taken after the date and time of the reported burglary. Furthermore, after viewing the video footage recovered from the DVR, and not just relying on the still images provided, it was clear that the so-called burglary had in fact been staged. This was evident in the way that the individual entered the property by calmly obtaining a door key from under the door mat, as well as the witness statement information not correlating with the events that took place.
Case Outcome
The digital forensic investigation, and subsequent expert witness report from Hawkins, was completed within 24 hours of receipt of the devices. This was made possible by a combination of the knowledge and experience of the Hawkins’ Investigator and the digital forensic software Hawkins has invested in, which can rapidly process and extract the relevant data. After the insurer had reviewed the expert witness report, they proceeded to reject the policyholder’s insurance claim, cancelled the insurance policy, and brought criminal proceedings against them.
