HSBC Insider Trading (2012) — Commercial Forensic Suites

A senior trader was suspected of front-running. His corporate laptop was imaged. Investigators used EnCase to index over 500,000 emails and Excel files for suspicious patterns.

## Background

A senior trader was suspected of front-running. His corporate laptop was imaged. Investigators used EnCase to index over 500,000 emails and Excel files for suspicious patterns.

## Learning Objective
Use enterprise-grade tools for automated indexing, keyword searching, and evidence export.

## Scenario
You are the lead digital forensic investigator assigned to this case. Based on the real-world events described, you must analyze the available evidence, reconstruct the timeline, and produce a forensic report.

### Key Facts
- Case: HSBC Insider Trading (2012) — Commercial Forensic Suites
- Year: 2012
- Domain: Cyber Forensics
- Difficulty: Expert

## Evidence Available

Refer to the dataset at: https://github.com/arora200/aplly_case_db/tree/main/datasets/fss303-hsbc-insider-trading

## Investigation Questions

1. How does EnCase create a legally defensible audit trail?
2. What search strategies would you use to find insider trading evidence across 500,000 emails?
3. Why is an unalterable audit log critical for FCA regulatory proceedings?
4. Compare commercial forensic suites vs. open-source tools for this investigation.
5. Design a keyword search strategy to detect front-running patterns.

## Deliverables

1. Forensic Report — Document your findings, methodology, and conclusions
2. Timeline Reconstruction — Map the sequence of events
3. Evidence Log — Document all evidence collected with hash values
4. Legal Admissibility Checklist — Ensure your evidence meets evidentiary standards

## Expert Insight
Commercial tools are not just about finding the needle; they are about defending how you found the needle in court.

## Forensic Takeaway
EnCase's ability to create a 'case file' with an unalterable audit log was critical. Every search and export was logged for the FCA.