Document Examination

Employee Fraud and Internal Corporate Investigations in Kenya

Employee Fraud and Internal Corporate Investigations in Kenya Independent forensic investigations into fraud, collusion and data theft inside your organisation, run so the evidence holds up at the disciplinary hearing, in the Employment and Labour Relations Court and in a criminal case. Instruct Us on Your Matter Call +254 100 177 094 Reviewed by Paul Ooko, Lead Forensic Investigator, Ultimate Forensic Consultants Ltd. Last updated 1 October 2026. Quick answer An internal corporate investigation establishes what an employee or group of employees did, how, and with whose help, using evidence collected lawfully and kept in a verifiable chain of custody. Ultimate Forensic Consultants secures and analyses devices, email, system logs, payment and procurement records and documents, then reports to your board, audit committee, HR or legal team. The report supports dismissal, criminal referral and civil recovery. We are independent of the people under investigation, and we do not decide guilt: that remains the employer’s decision after a fair hearing. The schemes we investigate, and where the evidence sits Internal fraud rarely announces itself. It shows up as small anomalies in records that someone with access can control. Each scheme leaves a different trail. Scheme Typical warning signs Where we look Payroll fraud and ghost employees Staff who cannot be physically verified, duplicate bank accounts, unexplained allowances or overtime Payroll system logs, bank details against HR files, approval trails, ID and document verification Procurement fraud and kickbacks Repeat awards to one supplier, inflated prices, split orders, new vendors with no history Vendor master data, tender files, supplier registration and ownership, communications between buyers and suppliers Fictitious suppliers and false invoices Vendors sharing addresses, phone numbers or bank accounts with staff Link analysis of vendors, staff and bank accounts, invoice metadata and document examination Expense and claims fraud Recycled receipts, altered amounts, claims for unattended events Receipt forensics, email and calendar records, mobile money and card statements Cash skimming and lapping Unreconciled receipts, delayed banking, customer complaints about unrecorded payments Till and ledger data, bank deposits, CCTV, M-Pesa and Paybill reconciliations Stock theft and inventory manipulation Write-offs that repeat, shrinkage that tracks one shift or one storekeeper Stock system audit logs, gate and CCTV records, dispatch documents Data theft and IP leakage Bulk downloads before resignation, files sent to personal email or cloud, a rival launching a copy of your product Forensic images of laptops and phones, email and cloud logs, USB and printing history Conflict of interest and insider-assisted external fraud Undisclosed ownership of a supplier, staff tipping outsiders, repeated losses at one branch Company registry records, communications, system access logs, SIM and mobile money links where relevant Run it properly: five rules that protect your case Most internal fraud cases are weakened by how the employer handled them, not by the fraud. These are the rules we build every engagement around. Secure evidence before anyone is confronted Once a suspect is alerted, files are deleted and phones are reset. We image devices and preserve logs first, quietly. Investigate independently Anyone implicated, or reporting to someone implicated, stays out of the investigation. We report to the board, audit committee or counsel. Collect lawfully and proportionately Access to devices, email and personal data must follow your policies and the Data Protection Act. Unlawfully obtained evidence creates a second problem. Keep the chain of custody Every device and file is logged, hashed and documented, so the evidence can be authenticated under Sections 106A and 106B of the Evidence Act. Give the employee a fair hearing Dismissal that skips notice and a hearing can be found unfair even where the fraud is real. Our report feeds the process. It does not replace it. What UFC delivers Digital evidence acquisition Forensic imaging of laptops, phones, servers and cloud accounts, with recovery of deleted files and messages. Transaction and document analysis Tracing payments and approvals, and forensic examination of invoices, contracts, signatures and altered records. Link and relationship analysis Connecting staff, vendors, bank accounts, phone numbers and companies to expose collusion and undisclosed interests. Structured interviews Planned, documented interviews of witnesses and subjects, conducted without coercion and recorded properly. Asset tracing and recovery support Identifying where diverted funds went, to support civil recovery, freezing applications and settlement negotiations. Report, hearing and court support A clear findings report for the disciplinary panel, a referral pack for the police or EACC, and expert testimony in court. Two illustrative cases: ghost employees and inventory manipulation These scenarios are composites of patterns we see in Kenyan organisations. Names, sectors and figures are changed or indicative, and they are not reports of a specific client’s matter. Payroll fraud: ghost employees on a multi-site payroll What was suspected A manufacturer with several sites noticed that payroll cost was rising faster than headcount. Finance and HR each suspected the other’s records. What we examined Payroll master data and audit logs, HR personnel files, physical verification of staff at each site, bank and mobile money details of every payee, and a forensic image of the payroll officer’s workstation. What the record showed A group of payees could not be verified as real people, with no attendance records and no supervisor who knew them. Several shared the same bank account or phone number. Their records were created and edited after hours under one officer’s login, and approvals came from a supervisor whose credentials were being used by someone else. How the money moved Net pay for the ghost payees was paid into a small set of accounts. Link analysis tied those accounts to a relative of the payroll officer. What the report supported A fair disciplinary hearing, a criminal referral with a complete evidence pack and a civil recovery claim. It also set out the control failures: no segregation of duties, shared credentials and no periodic headcount verification. Inventory manipulation: write-offs that followed one storekeeper What was suspected A distributor saw repeated “damaged goods” write-offs at one warehouse that did not match supplier returns or insurance claims. What we examined Stock system adjustment logs,

Employee Fraud and Internal Corporate Investigations in Kenya Read More »

How to Prove a Digital Document Was Altered: PDF Metadata Examination in Kenya

PDF Metadata Examination Kenya · Digital & Document Forensics The Contract Says 2019. The File Disagrees. Every digital document carries a second, invisible record of its own history — one that isn’t written by whoever typed the visible text. PDF metadata examination in Kenya is how that hidden record gets read, and how backdated contracts and forged agreements get caught. 3Independent metadata sources per document type 106AEvidence Act standard for electronic records 0Alterations made during examination In short A digital document’s visible content and its actual history are recorded separately. PDF properties, Word’s internal revision structure, and a photograph’s EXIF data all capture when a file was truly created, edited, and saved — independent of whatever date appears in the printed or displayed text. PDF metadata examination in Kenya compares these hidden records against the document’s claimed date to establish whether a contract, agreement, or letter is genuine. Why a Digital Document Can’t Fully Hide Its Own History A paper document only shows what’s on the page. A digital one carries a second record most people never think to look at — created automatically by the software that produced it, without the author’s involvement or awareness. This is the foundation of PDF metadata examination in Kenya: comparing what a document claims about itself against what the file format was actually built to record. This matters because the most common way a fabricated document gets caught isn’t a spelling mistake or an inconsistent signature — it’s a mismatch between the story the document tells and the story its own file structure tells. Three sources carry most of that story: PDF properties, Word’s internal revision data, and EXIF metadata in photographed signature pages. 📄 PDF Properties & Metadata Every PDF embeds a Document Information Dictionary and often XMP metadata recording creation software, creation date, and modification history — set by the computer, not the author. 📝 Word Revision History A .docx file is a compressed archive of XML parts. Author names, save timestamps, and sometimes prior revisions can persist inside that structure long after visible track changes are cleared. 📷 EXIF Data Photos of signed signature pages — sent over WhatsApp or email — often carry a capture timestamp, device model, and sometimes GPS coordinates, independent of anything written on the page itself. “You can retype a date. You cannot retype the moment your computer says the file was actually born.” PDF Properties: What the Document Information Dictionary Reveals Open the properties panel of almost any PDF and you’ll find a small set of fields most people ignore: Author, Producer, CreationDate, ModDate, and often the specific software version used to generate it. These fields are written automatically at the moment of export or save — a contract “created” using a version of Adobe Acrobat or Microsoft Word that didn’t exist yet at the claimed contract date is, on its own, close to conclusive. Beyond the visible properties panel, many PDFs also carry XMP metadata — a more detailed, XML-based record embedded in the file that can include edit history, prior filenames, and the specific application and operating system used at each save. Where a PDF has gone through multiple saves or exports, XMP metadata can preserve a trail of those events even after the visible properties panel has been manually edited to show something else. Anatomy of a Backdated PDF What the Document Claims vs. What Its Properties Actually Record A simplified, illustrative property panel — annotated the way an examiner reads it during a PDF metadata examination in Kenya. Document text states:“Executed this 4th day of March, 2019” CreationDate:2026-05-14 11:42:07POSTDATES CLAIM ModDate:2026-05-14 11:47:52SAME-DAY EDIT WINDOW Producer:Microsoft® Word for Microsoft 365VERSION DID NOT EXIST IN 2019 Author:DESKTOP-6XJ2P\\userDEVICE NAME UNRELATED TO SIGNATORY XMP Edit History:2 prior save events detectedCONTRADICTS “ORIGINAL SCAN” CLAIM FAIL Directly contradicts the document’s claimed history WARN Inconsistent, needs corroboration PASS Consistent with genuine timeline Word Revision History: What Survives “Accept All Changes” A .docx file is not a single block of text — it’s a ZIP archive containing multiple XML files that separately describe the document’s content, formatting, comments, and revision data. Clicking “Accept All Changes” removes the visible track-changes markup from the reading view, but it doesn’t always purge every trace of that history from the underlying file structure, especially where a document has been saved rather than freshly exported as a clean copy. Examiners look specifically at the document’s internal author list — every account name that has ever edited the file, in what’s sometimes a longer list than the document’s visible signatories would suggest — alongside embedded save timestamps and, in some cases, remnants of deleted comments or prior paragraph versions. A contract whose internal author history includes a name entirely unconnected to either party, or whose earliest recorded edit postdates the agreement’s claimed signing date, raises exactly the kind of question a court or opposing counsel needs answered. EXIF Data: When the “Original Signed Copy” Is Just a Photo An enormous number of disputed agreements in Kenya don’t arrive as clean PDFs at all — they arrive as a photograph of a signed page, taken on a phone and sent over WhatsApp or email. That photograph carries its own metadata, called EXIF (Exchangeable Image File Format) data, which can include the exact date and time the photo was taken, the camera or phone model used, and — where location services were enabled — GPS coordinates for where the photo was captured. This becomes significant when a photographed “original” signature page is claimed to have been signed at one time and place, but its EXIF capture timestamp — or the compression pattern typical of a specific messaging app’s re-encoding — tells a different story. Even where an image has been forwarded and re-compressed multiple times, forensic examination can often still establish the file lineage and, where original EXIF data survives, the true capture window. Backdated Contracts: Reading the Three Sources Together The strongest findings rarely rest on a single metadata field — they come from

How to Prove a Digital Document Was Altered: PDF Metadata Examination in Kenya Read More »

What Makes a Forensic Document Report Admissible in a Kenyan High Court

What Makes a Forensic Document Report Admissible in a Kenyan High Court By Ultimate Forensic Consultants Ltd | Forensic Document Examination Specialists, Kenya Every year, forensic document reports are rejected in Kenyan courts — not because the science was wrong, but because the examiner failed to satisfy legal requirements that have nothing to do with science. Advocates who instruct document examiners without understanding these requirements often discover the problem only when opposing counsel rises to object. By then, it is too late. This article sets out, precisely and completely, the legal and scientific framework that determines whether a forensic document report will be accepted by a Kenyan High Court. It is written for litigation advocates, corporate counsel, and anyone who needs to understand what separates a report that wins from one that fails. The Statutory Foundation: What the Evidence Act Actually Says The admissibility of forensic document evidence in Kenya is governed primarily by the Evidence Act (Cap. 80), in its current revised form. There is no single section that deals with document examination in isolation. Admissibility depends on the combined operation of several provisions, each of which must be satisfied. Section 48: Opinions of Experts Section 48 of the Evidence Act is the foundational provision for all expert evidence in Kenya. It permits the court to receive the opinion of an expert “upon a point of foreign law, science or art, or as to identity or genuineness of handwriting or finger impressions.” Three elements flow from this section that every document examiner must satisfy: 1. The examiner must qualify as an expert. The court must be satisfied — through examination-in-chief — that the witness possesses specialised knowledge, skill, experience, or training that the ordinary person does not possess. Qualifications are not assumed. They must be established on the record before the report is tendered. An examiner who cannot articulate the scientific basis of their methodology, or who cannot explain how their training prepared them to apply it, will struggle to be accepted as an expert even if their conclusions are correct. 2. The opinion must be grounded in the examiner’s area of expertise. Section 48 permits opinion evidence on “the identity or genuineness of handwriting.” This specific language confirms that handwriting and questioned document examination falls squarely within the scope of admissible expert opinion in Kenya. The examiner’s opinion must, however, stay within their demonstrated competence. An examiner instructed to examine handwriting who then offers opinions on ink chemistry — without establishing additional qualification in that area — risks having those additional findings challenged. 3. The basis for the opinion must be disclosed. Section 54 of the Evidence Act requires that an expert witness state the facts upon which their opinion is based. A report that simply states a conclusion (“the signature is forged”) without disclosing the comparative features, the methodology applied, and the reasoning that leads from the examination to the conclusion will be insufficient. Courts routinely scrutinise the reasoning pathway, not just the outcome. Section 50: Opinion as to Handwriting Section 50 provides a specific mechanism for opinion evidence about handwriting. It permits opinion evidence by a person who is “acquainted with the handwriting of the person by whom [the document] is supposed to be written.” This section is broader than expert evidence alone — it allows lay witnesses to comment on handwriting they recognise. For the forensic document examiner, however, Section 48 remains the relevant gateway, and Section 50 is a supplementary basis available to non-expert witnesses or to support the examiner’s findings. Section 77: Reports by Government Analysts and Document Examiners Section 77 provides an important procedural mechanism in criminal proceedings. It permits a document purporting to be a report “under the hand of a Government analyst… or of any… document examiner… upon any person, matter or thing submitted to him for examination or analysis” to be used as evidence. The court may presume that the signature on the report is genuine and that the person signing it held the qualifications they professed to hold. Critically, Section 77(3) preserves the court’s right to summon the document examiner and examine them on the subject matter of the report. This is not merely a theoretical power — it is exercised. A forensic document examiner should prepare every report as if they will be required to defend it under cross-examination, because in contested matters, they will be. Section 78A: Electronic and Digital Evidence Forensic document examination increasingly intersects with digital evidence. Section 78A of the Evidence Act provides for the admissibility of electronic messages and digital material, provided certain conditions regarding reliability and integrity are met. For examiners dealing with digitally produced or altered documents, this provision creates additional obligations around how digital evidence is captured, preserved, and presented. The Five Pillars of an Admissible Forensic Document Report Based on the statutory framework and the pattern of how Kenyan courts have scrutinised expert evidence, an admissible forensic document report must satisfy five requirements simultaneously. Failure on any one of them creates vulnerability. Pillar 1: Examiner Qualification — Established, Not Assumed The report must identify the examiner, set out their qualifications and training in forensic document examination specifically (not forensics generally), and disclose the number of years and nature of their practical experience. This profile must be capable of being established under oath during examination-in-chief. The Kenyan courts do not apply the US Daubert standard or the English Turner standard in terms. However, the underlying concern is identical: is this person genuinely qualified to form the opinion they have expressed? An examiner with training limited to a short course, or whose experience is predominantly in uncontested matters, is more vulnerable than one whose qualifications and case history are substantial and documented. The examiner’s profile in the report should include: the institutions at which they trained, the methodologies in which they are specifically qualified, any professional body memberships, and a statement of the number of court appearances in which they have given expert testimony. This is not self-promotion —

What Makes a Forensic Document Report Admissible in a Kenyan High Court Read More »