Learn how to use the Print Screen function on your personal computer keyboard to save evidence and prepare it for court presentation.

Max, a CFE, needed a way to quickly capture evidence found on a fraud perpetrator's computer. Instead of printing out page after page from a query in QuickBooks, he instead took a screenshot of the evidence and printed it out. This saved him time and energy which he put towards trying to crack the case. Learn how this simple method of using a personal computer's Print Screen function can save you time and help you keep track of important evidence. 1  

If you're old enough to have used DOS (or Disk Operating System) on early personal computers, you'll remember the Print Screen button on your keyboard. You would simply push the button and, voilà, the hamsters would start churning and your printer would spit out the image on your computer screen.

While DOS is a thing of the past, the Print Screen button isn't. It's still up there next to F12 key. Of course, when you push it now, nothing happens. But I'll show you how to use it and how it can be an effective tool in your investigative practice.

How to use it
In a Windows-based system you have to hold down the Ctrl key while you push the Print Screen button. This will capture a digital image of whatever is on your screen and store that image on your clipboard where you can paste it to either Microsoft Word or Paint. If you paste it into Word, the image resizes itself to fit within the document, which makes the information hard to read. So I recommend that you use Paint. To access Paint click on the Start button located on your task bar, select All Programs, followed by Accessories and then Paint. Once you've opened Paint, go to the Edit pull-down menu and select Paste. You should see the digital copy of the captured screen. Save this file, and you're done.

The button's uses
I commonly use the Print Screen button in two distinct ways - documenting evidence and preparing presentations.

Documenting evidence
In today's evolving paperless society, most practitioners have run into a case in which the only records available for review are electronically stored in a database of some sort, whether it be proprietary software or QuickBooks. You may have the option of printing a report as documentary evidence, but sometimes this requires printing several hundred pages to capture one page of evidence. This is a great opportunity to use the Ctrl Print Screen command instead.

Using this command allows you to run a search query within the client's program and then capture the results that are shown on the screen. QuickBooks and most other programs don't offer an option to print the results of a Find query so the Ctrl Print Screen command can help you print just what you need.

When you use Ctrl Print Screen for documentary evidence there are a couple of extra steps you should take. First, ensure that the Windows task bar is shown on the bottom of the screen. This shows which program you were using when you captured the digital image and it can show the time and date you performed the procedure. In most Windows configurations, the default clock on the far right end of the task bar will act as your time stamp. And, secondly, to achieve a date stamp move your mouse pointer over the top of the clock. In most cases, an automatic popup box indicating the date will appear automatically. Now you have digital evidence that your query showed the stated results in the software at a specific point in time.

Preparing presentations
Since we have these images saved as bitmap files, it's now easy to insert them into a compelling PowerPoint presentation for a judge or jury. You can also use Paint to select smaller images within the bitmap file and then increase their sizes for greater impact.

I often zoom in directly on important evidence on a slide containing the original Print Screen bitmap and create a new slide on which the information is larger and more legible. This allows you to emphasize a point without losing your audience.

In our forensic accounting endeavors, we're often asked to review the expert report of other accountants or the depositions of parties involved. It can be very compelling to scan images of the deposition into an Adobe Acrobat file, highlight the self-incriminating text, and then Ctrl Print Screen this image into your PowerPoint presentation. We worked on one case in which the individual was playing shell games with his money to avoid creditors. Using his own deposition against him, it was very easy to establish that there were no valid business purposes for his movement of funds among companies.

Press this button for help
The original designer of the personal computer keyboard couldn't have known that you can use the Print Screen button to help catch fraudsters and present evidence. Now you know a better way to capture screens and crooks. (Be sure to read the case history that follows.)

1 This fictitious case is for illustrative purposes. 

Case history

Ctrl Print Screen helped prove company wasn't hiding information

In the initial meeting with the insuree's management they presented four purchase invoices from the company that manufactures the product. Of those invoices, two were from the year prior to our review period, which meant the item could have been in inventory during that time. Management gave two item numbers for these products and explained that the invoices and the numbers undoubtedly were for purchases made by employees for personal use but conducted through the company to achieve discount pricing. My job was to find out if management was telling the truth.

I first verified that all the transactions with this vendor were accounted for by searching through the company's QuickBooks file for all check register payees for the vendor name along with likely variations. I used Ctrl Print Screen to document the findings of the search by payee queries.

I then needed to determine the disposition of these items by looking at the sales history for the given item numbers. Per the company's software, the two item numbers showed no sales history, and even more concerning, no purchase history. I had two invoices but the software insinuated that the company never bought this item for sale. This could have been explained by the employee purchasing the item directly without the item going into inventory. But I now had the first hint that the company's software records were going to be a problem.

Both of the item numbers showed the vendor listed on the provided invoices as the supplier. I queried the system for all item numbers associated with the vendor and found that the two item numbers were the only ones from that vendor. I used Ctrl Print Screen to document the results of the search.

I found it odd that the items were assigned numbers but were never received into the inventory system. Since I had invoices for these items, I reviewed the receiving records for the corresponding dates, which showed that the items had clearly been received into inventory but not under the item numbers provided by management. When I queried the company software it didn't recognize these other numbers as valid. I now had four item numbers for these items, two of which showed no sales history and two more that the system didn't recognize. I once again used Ctrl Print Screen to document my findings.

Because I was able to find where the items were received into inventory, I decided to use the inventory transaction report to track the disposition of each item. After two complete reviews of the 736-page inventory transaction report for the year of purchase, it became apparent that each item was still in inventory at year end until I realized the next problem with the software: during the review period the inventory transaction report was only showing inventory receipts. Purchases and other issuances weren't represented in the report I was viewing. Apparently, due to a system upgrade that occurred in our review period the receiving information was retained farther than the sales information. In fact there was a four-month gap between when the items in question were purchased and when the company's accounting system started showing sales invoice transactions. I sorted all invoices by date to show the earliest date the software recorded invoices. I used Ctrl Print Screen to document this information. I later found that even the invoices shown in the computer system weren't showing up on inventory transaction reports generated by the software for more than a year after the invoice history actually started in the software. Luckily the date of the alleged sale of the item was available in the sales invoice history queried directly in the software even though it was in the blackout period of the sales invoice history in the inventory transaction reports.

Now that I had established that the item had been purchased and placed into inventory, it was time to answer the question of whether the client sold the item to the specific customer in question. I queried the company's proprietary sales system, which was designed so that each invoice had to be assigned to a customer. Therefore, our first search was on the account for the specific customer in question. A listing of invoices came up for this customer and I used Ctrl Print Screen to document the listing directly from the clients system. I then printed all the invoices for this client and reviewed them for the item in question. I didn't find each item in the invoices to the customer in question.

When I documented the company's sales process, I noted that all sales are required to be made in the name of the specific customer. However, management said that this policy wasn't in effect during the period under review. Because I knew that the customer wasn't invoiced directly for the purchase, it was time to expand the search to the generic customer account: "Cash."

This company had an average of 91 invoices per day for a total of more than 30,000 invoices per year, all of which were electronically stored in its database with no hard copies kept. Due to the limitations of the inventory transaction report and the fact that the system showed no sales history when queried directly, a line-by-line review of all Cash invoices during the period in question was required. After a lengthy review I determined that this item wasn't sold to anyone under the Cash account.

I then located inventory count records that were taken a few months prior to the alleged sale to the specific customer. These inventory records did show the item numbers that the software no longer considered to be valid; however, no inventory was shown on hand. When combined with the results of the review of sales invoices these inventory records helped solidify the possibility that the company likely didn't sell each item to the specific customer.

So what about the other two item numbers and the two invoices from the point after our review period? An examination of the inventory transaction report quickly led to the finding that these two invoices were received under the two item numbers originally supplied by management. Because the inventory transaction report for this later period did show sales history as well as receiving history it was easy to follow the trail of the items. They were received on the dates indicated on the invoices and sales invoices were found in the immediate days following the receipt into inventory. The sales invoices were then retrieved from the system and I found that both invoices were in fact to employees as stated by management from the beginning. I later determined that the item numbers showed no history because of the limitations of the proprietary software - a 36-month limit on querying for sales invoice history and a five-year limit on querying for receipt history. Because our review period was seven years earlier the software simply didn't look back far enough when it ran the query.

While I'd liked to have isolated the invoices directly selling the first items received, it just wasn't possible because the sales history for that point wasn't available. Even though I couldn't prove where the first items went, I was able to reasonably prove that the company didn't sell those items to anyone, including the specific customer, during the period in question. The period in question was a full year after the items were received into inventory. Furthermore, I could prove that management's initial statement that these items were only bought by employees through the company was true when complete transactions were available.

I've used Ctrl Print Screen in many engagements but it was especially useful in this one. As you can imagine, there were points in this investigation where I suspected that the company had manipulated the data to cover up something. For this reason, I used the date and time stamp feature for all of my Ctrl Print Screen images. This allowed me to prove that the system did yield the stated results at the stated point in time even if the data changed mysteriously overnight. Luckily, all the problems and inconsistencies turned out to be related to the software and not a malicious attempt by the company to hide information. Problem is, sometimes you never know until you reach the end of the engagement.

Kevin A. Andrews, CFE, CPA, is a forensic accountant with Forensic CPAs, LLC, in Birmingham, Ala.