Computers store far more information than is immediately apparent. Operating systems, file systems, applications, browsers, user accounts, external storage devices, and system logs can leave digital traces that allow processes to be technically reconstructed, sometimes long after an event has occurred.

LB Forensik's computer forensics services focus on the professional securing, analysis and evaluation of these digital traces on Windows PCs, notebooks, Apple Mac systems, hard drives, SSDs and other storage media.

Depending on the question, it is possible, for example, to investigate which files were present or deleted, when certain user activities took place, which external storage devices were connected, which internet activities can be traced, or whether there are technical indications of malware, manipulation, or unauthorized access.

The decisive factor is not the largest possible amount of extracted data. The goal of a forensic investigation is a technically verifiable answer to the specific evidentiary question.

We further explain the fundamental requirements for digital evidence in the article "Integrity of Digital Evidence" . In investigations that also involve smartphones or tablets, computer analysis can be combined with our mobile forensics .

What is computer forensics?

Computer forensics is a subfield of digital forensics. It deals with the structured securing, examination, reconstruction, and evaluation of digital traces on computers and their associated storage systems.

The subject of the investigation may include, among other things, desktop PCs, notebooks, MacBooks, hard drives, SSDs, USB storage devices, memory cards, external drives or selected server and network data.

A professional investigation begins with a clearly defined question:

Which digital traces can technically confirm, refute, or reconstruct a specific process in time?

Only then is it determined which systems need to be secured and which forensic artifacts need to be examined.

What questions can computer forensics answer?

Depending on the available data and the scope of the investigation, the following can be examined, among other things:

• which files were present on a computer,
• when files were created, modified or deleted,
• whether deleted data can still be recovered,
• which user accounts were used,
• which programs were run or installed,
• which external storage devices were connected
• which internet and browser activities can be tracked,
• whether there are indications of unauthorized access,
• whether technical traces of malware exist,
• whether files might have been copied or transferred to external storage devices,
• whether manipulations or deletion actions are traceable,
• which events are related in time.

Not every question can be answered based on a single artifact alone. Often, a reliable overall technical picture only emerges through the correlation of several independent data sources.

Forensic preservation of a computer

A computer analysis should fundamentally distinguish between securing the original system and the subsequent analysis.

In suitable cases, a forensic backup of relevant data carriers or data sets is created first. The subsequent analysis is then performed, if possible, on the backup or a designated working copy.

This is intended to prevent the original system from being altered by unnecessary investigation steps.

Which backup method is suitable depends on the system state, the encryption, the type of data carrier and the specific evidentiary question.

Hard drive forensics

Traditional hard drives can contain extensive forensic information.

In addition to currently visible files, depending on the file system and further use, deleted files, file system structures, metadata and other digital artifacts may also be present.

A hard drive analysis can therefore go far beyond simply opening visible folders and files.

SSD forensics

The examination of modern SSDs differs in important aspects from that of classic magnetic hard drives.

Technologies such as wear leveling, garbage collection, and TRIM influence how data is stored internally and handled after deletion processes.

The widespread assumption that deleted files can be recovered from an SSD in the same way as from a traditional hard drive is therefore technically unreliable.

Even if file contents can no longer be reconstructed, other artifacts can provide evidence that files, applications, or certain activities existed.

File system forensics

File systems organize files, directories, and associated metadata.

Depending on the operating system and storage medium, different file systems may be relevant.

The analysis can provide information about files, directory structures, timestamps, and other file system artifacts.

It must be taken into account that different timestamps have different technical meanings and can be changed by various system processes.

Windows forensics

Windows systems generate numerous digital artifacts during their use.

Depending on the question, relevant information may include user profiles, registry data, event logs, file system information, shortcuts, program execution artifacts, browser data and information about connected devices.

By combining several of these sources, certain user and system activities can be reconstructed chronologically.

Mac forensics and macOS

Apple systems also contain numerous forensically relevant data sources.

When examining Mac, MacBook and macOS, particular attention must be paid to the file system used, security mechanisms, user accounts and any possible drive encryption.

Modern Apple systems differ significantly from classic Windows PCs in their technical specifications. Therefore, the backup strategy must be adapted to the respective hardware and operating system generation.

Linux forensics

Linux systems can be particularly relevant for servers, development environments, and technical workplaces.

Depending on the distribution and configuration, system logs, user information, shell histories, file system artifacts, configuration files, and other technical data can be examined.

Which traces are present depends heavily on the specific system configuration.

RAM forensics and volatile data

Not all relevant information is permanently stored on a hard drive or SSD.

A running computer can contain volatile information in its memory.

Depending on the system state and the objective of the investigation, backing up the working memory may therefore be relevant.

RAM data can contain information about running processes, network connections, or other system states active at the time of backup.

This information is always lost when the system is switched off.

Live forensics or a switched-off system?

The decision of whether to switch off a running computer or to examine and secure it while it is running can have significant implications for the evidence.

A running system can contain volatile information. At the same time, every interaction with a running computer changes its state.

In encrypted systems, it may also be relevant whether a data carrier is already mounted in a decrypted state at the relevant time.

Therefore, there is no single correct recommendation for every case.

In the event of a specific incident involving evidence or security concerns, it is advisable to clarify, if possible before taking any further action, which security strategy is technically appropriate.

Forensic examination of deleted files

Deleting a file does not automatically mean that all information is immediately gone in every storage system.

Depending on the file system, storage medium, deletion method and further use, data or file remnants may still be present.

However, with SSDs, TRIM and internal memory cleanup mechanisms can significantly limit recovery.

Therefore, the recovery of deleted data can never be guaranteed in general.

Traces may remain even without restoration.

For a forensic investigation, it is not solely crucial whether the complete contents of a deleted file can be recovered.

Other system artifacts may provide clues about previous files or activities.

This can make it relevant, for example, whether a particular file name, storage path or usage process can still be traced in other data structures.

Examine files and documents

Documents can contain additional technical information besides their visible content.

Depending on the file format, metadata, time information, author information, or other properties may be present.

This data may be relevant to questions about the creation, editing, or origin of a document.

However, metadata must be evaluated in a technical context, as it can fundamentally be changed.

USB forensics and external storage devices

In cases of suspected data leaks or unauthorized data copies, the crucial question is often whether external storage media were used.

Computers can leave traces of connected USB devices.

Depending on the operating system and data availability, information about specific devices or their use may be present.

This information can be correlated with file, user, and time information.

Is it possible to prove which files were copied to a USB stick?

This question must be examined on a case-by-case basis.

The fact that a particular USB storage device was connected does not automatically prove which files were copied to it.

Therefore, in order to technically reconstruct a possible data leak, various artifacts must be compared with each other.

This distinction is particularly important in matters relating to labor law or white-collar crime.

Browser forensics and internet activity

Web browsers can generate extensive digital traces.

Depending on the browser, user profile and data state, for example history, downloads, cookies, cache data, saved session information or other browser artifacts may be relevant.

This allows certain internet activities to be placed in a chronological order, if necessary.

Here too, the following applies: A single browser artifact should not automatically be equated with a specific natural person.

Download and upload activities

In certain investigations, it is relevant whether files were downloaded from the internet or transferred via online services.

Browser data, file system artifacts, application information and possibly other logs can provide clues.

Whether a specific upload or download can be reliably proven depends on the available technical evidence.

Email forensics on computers

Email communication can leave relevant information on different levels.

In addition to visible messages, local mail databases, attachments, header information, cache data and other artifacts can be examined.

In complex cases, local computer analysis can be combined with an examination of the relevant email account or other available data sources.

Cloud traces on a computer

Even when files are stored in a cloud service, local traces can still be left on a computer.

Synchronization programs, local directories, cache data, configurations, and other artifacts can provide clues about the use of a cloud service.

However, local computer artifacts and data actually held by the cloud provider are different sources of evidence and must be evaluated separately.

Malware and malicious software scan

If a compromised computer is suspected, it can be checked whether there are any technical indications of malware or other unwanted changes.

This allows for the examination of files, processes, autostart mechanisms, system configurations, event logs, and other artifacts.

A professional analysis is not limited to simply stating that a virus scanner has detected a specific file.

What is crucial is rather which technically verifiable traces are present and which conclusions can be drawn from them.

Computer hacked – can an attack be proven?

Whether previous unauthorized access can be proven depends on what traces are still present.

Relevant information may be found in system logs, user accounts, applications, browser data, network traces, or other artifacts.

However, the absence of a detectable artifact does not automatically prove that an attack never took place.

Likewise, a single technical anomaly does not automatically prove a successful compromise.

Ransomware and encryption attacks

Various forensic questions can arise after a ransomware incident.

This includes, for example, the possible initial attack path, affected user accounts, executed programs, timelines, and which systems were affected.

In the case of corporate incidents, such an investigation can be part of a more comprehensive incident response analysis.

Investigate suspected manipulation

In disputes, the question may arise as to whether files, documents or other digital information were subsequently altered.

Computer forensics can examine existing metadata, file system information and other technical artifacts, checking for inconsistencies.

However, a technical anomaly is not automatically proof of deliberate manipulation.

Conversely, the absence of an anomaly does not prove that a file has never been modified.

Reconstructing user activity

Modern operating systems generate numerous artifacts during their use.

By correlating different sources, it may be possible to reconstruct which activities took place on a system at specific times.

A distinction must be made between the activity of a user account and the identity of a natural person.

The fact that a particular user account was active does not automatically prove which person was actually sitting in front of the computer.

Timeline analysis – reconstructing events chronologically

One of the most powerful methods in computer forensics is the temporal correlation of different digital traces.

This allows, for example, file system events, system logs, program executions, browser activities, USB connections and other artifacts to be placed in a common temporal context.

Such a timeline can help to reconstruct complex processes step by step.

Timestamps must be interpreted correctly from a technical standpoint. Different systems may use different time zones, time formats, and meanings of time values.

Examine computer and smartphone together

Digital matters are rarely limited to a single device today.

A document may have been created on a computer, synchronized via a cloud service, opened on a smartphone, and then sent via a messenger.

In complex cases, therefore, the joint examination of different devices can be considerably more informative.

LB Forensics can combine computer and mobile forensics within a common investigation strategy.

Encrypted computers and data storage devices

Modern computers increasingly use drive and file encryption.

For example, BitLocker may be relevant for Windows systems and FileVault for Apple systems.

Whether and how encrypted data can be accessed depends on the system state, configuration, and available access information.

Therefore, existing encryption should be taken into account when planning for evidence preservation.

Forensic backup instead of simple file copy

Copying visible files to a USB stick is not equivalent to a full forensic backup.

A professional backup process documents which system or data carrier was used, which method was employed, and which data set was backed up.

Depending on the case under investigation, cryptographic hash values ​​can be used to document the integrity of defined data sets in a traceable manner.

A hash value does not automatically prove the truth or authorship of a file's content. It primarily allows for a comparison of whether a defined data set has changed compared to a documented reference state.

Write blocker and protection of the original data carrier

Suitable data carrier analyses can employ hardware or software methods designed to prevent or minimize unintentional write access to an original medium.

Which method is suitable depends on the specific data carrier and the backup strategy.

The aim is to preserve the original state of the evidence as far as technically possible and to document changes in a traceable manner.

Chain of Custody and Evidence Chain

In legally relevant investigations, the analysis result is not the only important factor.

Equally crucial can be the ability to trace which device was examined, when it was acquired, how it was secured, and on which data set the subsequent analysis is based.

This documented chain of evidence is often referred to as the Chain of Custody.

Forensic report and expert opinion

A comprehensive technical analysis is only useful if the results are presented in a comprehensible manner.

Depending on the assignment, relevant findings can therefore be documented in an investigation report or an expert analysis.

Good forensic documentation distinguishes between:

• established technical facts,
• used examination methods,
• technical conclusions,
• existing restrictions and
• Questions that cannot be answered based on the available data.

Further information can be found at our expert office for IT and mobile forensics.

What should be avoided before a computer forensics investigation?

In a potential evidentiary case, ill-considered actions could alter existing evidence.

• Do not delete or move files prematurely.
• Do not use any cleanup programs.
• Do not reset a computer to factory settings.
• Do not perform a new operating system installation.
• Do not format an SSD or hard drive.
• Do not install unnecessary updates.
• Do not carry out any antivirus or repair measures without prior assessment.
• Avoid connecting external storage devices unnecessarily.
• Do not delete log files or user profiles.

A running system should not be shut down automatically. Volatile data or the state of encryption can be relevant to the backup strategy.

Computer forensics for businesses

In companies, computer forensics can be particularly relevant in cases of suspected data leaks, unauthorized access, malware, internal manipulation, compliance violations, or other security incidents.

Technical possibilities and legal frameworks must be taken into account together.

Therefore, an investigation should be focused on a specific question and a clearly defined scope of investigation.

Computer forensics in employee cases

During internal investigations, workstation computers may contain important digital traces.

Possible questions concern, for example, data copies, external storage media, file activities, or other technical processes.

A forensic investigation does not replace the review of the admissibility of a measure under labor law or data protection law.

Computer forensics for lawyers and courts

Digital data can play a crucial role in civil, criminal, labor, or economic proceedings.

LB Forensik provides support in the technical securing, analysis and evaluation of digital evidence.

A distinction is made between technically verifiable facts and more extensive legal assessments.

Computer forensics for private individuals

Private individuals can also have computers and data storage devices forensically examined.

Typical questions include, for example, suspected unauthorized access, data loss, suspected manipulation, malware, deleted data, or securing digital evidence for legal proceedings.

Computer forensics nationwide in Germany

LB Forensik supports companies, lawyers, authorities and private individuals nationwide in securing and investigating digital systems.

Depending on the circumstances, the securing or investigation can take place on site or under controlled investigation conditions.

Regional information can be found, for example, under IT forensics for Stuttgart , IT forensics for Düsseldorf and IT forensics for Hanover.

Limits of computer forensics

Professional computer forensics can reveal extensive digital traces. However, it cannot answer every question.

• Deleted data is not always recoverable.
• Overwritten data may be permanently lost.
• TRIM and SSD-internal processes can limit recovery.
• Encryption can prevent or hinder access to data.
• Not all user activity leaves a clear digital record.
• A user account is not automatically synonymous with a specific natural person.
• A timestamp must be interpreted technically.
• The absence of an artifact does not automatically prove that an event never took place.

A professionally sound investigation therefore not only identifies traces found, but also the limits of their significance.

Frequently asked questions about computer forensics

What is computer forensics?

Computer forensics is the structured securing, analysis, and evaluation of digital traces on computers and storage media. The goal is the technical reconstruction of specific events based on available data.

Which computers can be forensically examined?

Depending on the system and the question being asked, Windows PCs, notebooks, Apple Mac systems, as well as associated hard drives, SSDs and external storage media can be examined.

Can it be determined which files were deleted?

This can happen depending on the file system, storage medium, and subsequent use. Even if file contents cannot be recovered, other artifacts may still indicate the existence of previous files.

Can deleted files be recovered?

Partially. The chances of success depend heavily on the storage medium, file system, deletion process, and subsequent use. With SSDs, TRIM and internal cleanup processes in particular can limit recovery.

Is it possible to determine when a file was deleted?

Under certain conditions, various artifacts can provide clues about a deletion process or its temporal relationship. However, an exact deletion time cannot always be determined.

Is it possible to determine who deleted a file?

Digital traces can link activities to a system or user account. However, this does not automatically reveal which natural person actually performed the action.

Is it possible to determine if a USB stick was connected?

Depending on the operating system and data state, traces of connected USB devices may be present.

Is it possible to determine which files were copied to a USB stick?

This needs to be verified using multiple data sources. The mere presence of a connected USB device does not automatically prove that a copying process actually took place.

Can a hacked computer be examined?

Yes. In cases of suspected unauthorized access, existing system, file, user, browser, application and, if applicable, network traces can be analyzed.

Is it possible to determine when a hacker gained access?

If suitable logs and other artifacts are available, it may be possible to narrow down the timeframe of potential access. However, a complete reconstruction is not always possible.

Can malware be detected?

If corresponding artifacts are still present, they may indicate malware, suspicious programs, or unusual system changes.

Is it possible to determine which websites were visited?

Browser profiles can contain history, cache, downloads, and other artifacts, depending on the data state. However, private modes, deletions, and other factors can influence the data situation.

Can deleted browser data be recovered?

Depending on the browser, file system, and storage state, this may be partially possible. A complete recovery cannot be guaranteed.

Can emails be investigated?

Yes. Locally stored email data, attachments, and other technical information can be analyzed, depending on the system used.

Can cloud activity be tracked on a computer?

Local synchronization and application artifacts can provide clues about the use of certain cloud services. Additional cloud data may be required for a complete evaluation.

Is it possible to determine if files have been manipulated?

An investigation can examine technical anomalies, metadata, and inconsistencies. However, not every change can be definitively identified or attributed to a specific person.

Can a computer that is switched off be examined?

Yes. Non-volatile data on existing storage media can be backed up and analyzed, depending on encryption, condition, and technical accessibility.

Should a suspicious computer be shut down?

Not automatically. With a running system, volatile RAM data or a previously decrypted data carrier can be relevant. Therefore, the appropriate backup strategy should be clarified before any intervention, if possible.

What is RAM forensics?

RAM forensics examines data from the volatile memory of a running system. This data can include information about active processes and other current system states.

Can an encrypted hard drive be examined?

This depends on the encryption method, system state, and existing access information. Existing encryption should be considered as early as possible in backup planning.

What is a forensic image?

A forensic image is a backup of a data carrier or data set created using a defined method, which can then be used for analysis. The specific backup method depends on the object being investigated.

What does Chain of Custody mean?

The chain of custody documents the chain of evidence. It is intended to make it traceable which piece of evidence was taken over, how it was handled, and on what data basis the investigation was conducted.

How long does computer forensics take?

The duration depends primarily on the amount of data, the number of devices, encryption, the specific questions being asked, and the required depth of investigation. Therefore, a reliable estimate is often only possible after knowing the precise scope of the investigation.

Can a reset or newly installed computer be examined?

Yes, an investigation can still be worthwhile. However, resetting, reinstalling, and subsequent use may overwrite previous data or otherwise render it unavailable. What information can still be gleaned must be examined on the specific system.

Is a screenshot sufficient as digital proof?

A screenshot can document a visible state, but it typically contains significantly less technical contextual information than the underlying original data source. Therefore, for a more in-depth forensic evaluation, the original data source should be preserved whenever possible.

What should I do if I want to have a computer forensically examined?

Avoid unnecessary changes to the system and document its current state. For a running or encrypted system, determine the best course of action before shutting it down or making any further interventions.

Request computer forensics through LB Forensics

If a computer, notebook, Mac or data storage device needs to be examined after a security incident, in case of suspected manipulation, data loss or in connection with a legal dispute, it is recommended to coordinate as early as possible.

For an initial assessment, the device type, operating system, available data storage media, encryption status and the specific question are particularly relevant.

LB Forensics can then determine which data sources should be secured and which examination method is suitable for the evidentiary question.

Professional computer forensics is not about finding as much data as possible. The crucial factor is to methodically secure digital traces, interpret them correctly from a technical standpoint, and document them in a traceable manner.