Your Business News

How digital forensics preserves data and assists receivers and lenders

April 16, 2021

Authored by RSM Canada LLP

Corey Houle, CPA, CA shared this article

Archived Article Please note that this article is reflective of the relevant legislation, regulations, and information at the time of publishing and does not contemplate any changes that have occurred since that time.


With Canada still in the grip of the coronavirus pandemic, nearly 18 per cent of the country’s 1.1 million businesses are considering declaring bankruptcy or shutting down for good, according to the Canadian Federation of Independent Business.

While most will cooperate with their lenders, there will inevitably be a subset of unscrupulous entrepreneurs and business owners who will try to protect their business, and their assets, at all costs. In recent years, debtors have gone to increasing lengths to frustrate attempts at gaining access to their business data, including making incriminating emails, financial spreadsheets and other key files by causing such files to disappear from their laptops, phones, computer systems and cloud servers.

In some cases, the removal or destruction of documents may only be the entry point to a deception or fraud that has been going on for a period of time.

To address such issues during insolvencies, it’s imperative that banks or the receivers look to digital forensics to gather evidence, build their case and maximize recovery.

When things go missing

When a business defaults on its loan, and a lender appoints a receiver to take possession of the company’s assets, time is of the essence. In what we often describe as a race to the swiftest, the receiver must seize control of the business’ operations before important documents are hidden or destroyed so that evidence is preserved. Receivers may also have to seek court orders, such as access orders or document preservation orders, to compel a debtor and its management to cooperate with the receiver by providing the documents.

In some cases, the removal or destruction of documents may only be the entry point to a deception or fraud that has been going on for a period of time. In others, a panicked business owner might delete emails that prove preferential payments were made to reduce personal liabilities. Over the years, we’ve seen files disappear, passwords withheld, laptops wiped, and hard drives and equipment removed from the debtor’s premises entirely.

Scenarios like these necessitate the involvement of an experienced digital forensic team.

Gathering and preserving evidence

Entrusting a nonspecialist information technology person with a USB drive to copy over large amounts of data from a company’s servers is akin to allowing a police officer to stomp all over a crime scene before a forensic specialist shows up—there is a good chance the evidence won’t be admissible if the matter ever goes to court.

Upon taking possession of a business, it’s vital for the receiver to gather and preserve digital evidence quickly and accurately, in a forensic manner. That way, even if the receiver doesn’t plan to analyze the data immediately, you can be confident in knowing you have an accurate and admissible snapshot of the company’s malpractices, if the time for litigation comes.

Building your case

It could take a legal team months, or even years, to manually review the many terabytes of data that exists on an average company’s servers. However, working closely with digital forensic specialists can greatly speed up the evidence gathering and analyzing process.

Trained cyber investigators can effectively sort through the volumes of data using the latest artificial intelligence and data analytics tools, and forensically recover deleted information that a nefarious business owner assumed was gone for good. Even in the rare instances when a company manages to successfully wipe everything from its phones, laptops and servers, the act itself is still valuable evidence because it proves the business owner was trying to hide something. In one recent case, our in-house digital forensic team managed to recover emails from a company’s cloud server that showed the business’ owners had plotted to destroy evidence—and this was helpful to the lender in court.

Putting all the pieces together

As the pandemic continues to push Canadian businesses to the brink, this year is likely to see an increase in business failures and bankruptcies if government stimulus programs come to an end. Desperate and out of options, some unethical business owners will do whatever they can to get out of their financial obligations.

But those who are considering, or who have already caused, the destruction of valuable information can be outsmarted. By leveraging leading digital forensic capabilities, receivers, banks and other lenders can better gather and preserve data from defaulted businesses and reconstitute missing data so that all the pieces of the puzzle are put together.

With an airtight case and a complete picture of the inner financial dealings of a business, and a case that is properly built, receivers and the lenders who appoint them can increase the chances of higher realizations during insolvency proceedings.

Let's Talk!

Call us at 1 855 363 3526 or fill out the form below and we'll contact you to discuss your specific situation.

  • Topic Name:
  • Should be Empty:

This article was written by Bryan A. Tannenbaum, Ryan  Duquette and originally appeared on 2021-04-16 RSM Canada, and is available online at

RSM Canada Alliance provides its members with access to resources of RSM Canada Operations ULC, RSM Canada LLP and certain of their affiliates (“RSM Canada”). RSM Canada Alliance member firms are separate and independent businesses and legal entities that are responsible for their own acts and omissions, and each are separate and independent from RSM Canada. RSM Canada LLP is the Canadian member firm of RSM International, a global network of independent audit, tax and consulting firms. Members of RSM Canada Alliance have access to RSM International resources through RSM Canada but are not member firms of RSM International. Visit for more information regarding RSM Canada and RSM International. The RSM trademark is used under license by RSM Canada. RSM Canada Alliance products and services are proprietary to RSM Canada.

FCR a proud member of RSM Canada Alliance, a premier affiliation of independent accounting and consulting firms across North America. RSM Canada Alliance provides our firm with access to resources of RSM, the leading provider of audit, tax and consulting services focused on the middle market. RSM Canada LLP is a licensed CPA firm and the Canadian member of RSM International, a global network of independent audit, tax and consulting firms with more than 43,000 people in over 120 countries.

Our membership in RSM Canada Alliance has elevated our capabilities in the marketplace, helping to differentiate our firm from the competition while allowing us to maintain our independence and entrepreneurial culture. We have access to a valuable peer network of like-sized firms as well as a broad range of tools, expertise, and technical resources.

For more information on how FCR can assist you, please call us at 1 855 363 3526

Important Notice:

FCR will now redirect you to CCH Portal where your FCR Client Portal login is located.

Share This