Case Study: Uncovering Fraud at ​Shitaker & Sons Construction Through Digital Forensic Artifacts

(All names and identities have been changed)

 

Background

​Shitaker & Sons Construction, founded in 1965 in Raleigh, North Carolina, grew into a $45 million regional contractor by 2025. The closely held corporation was 60% family-owned—Harold (25%), Daniel (20%), Sarah (10%), and Ethan (5%)—with 40% held by Kashes Capital. Family tensions and shareholder pressure set the stage for conflict.

The Dispute

CEO Daniel pushed for expansion, clashing with CFO Sarah’s focus on stability. Ethan was undecided. In 2023, Kashes Capital offered a $10 million buyout for 20% more shares. Daniel supported it, Sarah opposed it, and Harold’s indecision fueled tensions.

The Fraud

Daniel inflated revenues by $1.2 million using fake invoices to a shell company, Triangle Consulting, siphoning $750,000 for personal expenses. He manipulated cloud-based accounting records to hide the fraud, presenting falsified reports to the board.

Digital Forensics Investigation reveals:

Sarah’s suspicions led to hiring Digital4nx Group, who uncovered key artifacts:

  1. Email Artifacts: 23 deleted emails from Daniel to triangle.consulting22@gmail.com, sent from his home IP, contained fake invoice PDFs and instructions. A draft contract lacked verifiable details.
  2. Accounting Record Artifacts: 47 deleted invoices totaling $750,000, tied to Triangle Consulting, had altered timestamps. A hidden transaction log showed Daniel’s account overriding audit trails.
  3. Bank Transaction Artifacts: Bank portal logs and browser cache files linked Daniel’s laptop to 15 transfers to his personal accounts. A deleted email receipt confirmed a $50,000 mortgage payment.
  4. Cloud Storage Artifacts: A hidden OneDrive folder, “_archive,” held 12 falsified financial reports with backdated timestamps. A recovered spreadsheet outlined Triangle Consulting’s fake services.
  5. System Log Artifacts: Server logs showed 12 unauthorized logins by Daniel, disabling audit trails. Firewall logs and a user activity report confirmed encrypted Gmail connections and permission escalations.

The 80-page forensic report, with screenshots and flowcharts, provided admissible evidence.

The Shareholder Conflict

​Kashes Capital sued for $2 million, alleging fraud. Ethan sold his 5% stake to them, increasing their influence. Sarah countersued Daniel, who filed a defamation suit. Legal costs reached $300,000.

The Fallout

The scandal caused $8 million in lost contracts and 30 layoffs. Daniel was ousted, paying $500,000 in restitution. Kashes Capital installed a non-family CEO, eroding family control. Sarah became interim CEO, but the legacy was tarnished.

Analysis

Daniel’s fraud exploited family trust and weak digital oversight. Artifacts like emails, invoices, and logs, uncovered through forensics, proved his actions. Poor governance and succession planning enabled the crisis, with external shareholders exploiting the turmoil.

Result and Resolution

Financial Restitution: Daniel forfeited his $3 million stake, redistributed to the family and Kashes Capital. His $600,000 beach house funded an employee trust, and $150,000 was paid from his investments.

Shareholder Compromise: Kashes Capital dropped their lawsuit for an extra board seat, preserving family control and delaying the IPO.

Family Reconciliation Plan: A governance charter mandated quarterly mediated meetings. Daniel served as a non-voting consultant, and Ethan stayed engaged.

Community Restitution: A pro bono community center project, funded by the trust, regained $3 million in contracts.

The resolution, finalized in July 2025, capped legal fees at $350,000 and preserved the company.