When private messages suddenly become known to another person, a smartphone exhibits unusual activity, or after a breakup there is suspicion of continued access, mere assumptions are insufficient. What matters is identifying the actual digital traces present and the technically justifiable conclusions that can be drawn from them.

With our Freiburg branch, we offer private individuals, companies, and lawyers a regional contact for IT forensic investigations. Our focus is on securing and analyzing digital data from smartphones, computers, and other relevant systems. Private clients frequently encounter issues such as unauthorized access, deleted communications, suspicious user accounts, or securing digital information for legal disputes.

Freiburg also possesses a unique technological background. The healthcare industry, life sciences, medical technology, IT, environmental technologies, and a strong research landscape characterize the city. As a result, not only personal data but also research information, development status, technical documentation, and confidential company knowledge can be subject to forensic investigation.

IT forensics in Freiburg – technical clarity instead of hasty assumptions

A professional investigation doesn't begin with searching for a desired result. First, a specific question is defined: Are there indications of unauthorized access? Are deleted messages still technically relevant? Which devices are connected to a user account? Can unusual file activity on a computer be reconstructed chronologically?

Only then can it be determined which data sources are needed. This could be a smartphone, but also a computer, a storage device, an existing backup, or another accessible data set.

Forensic analysis also means clearly defining technical limitations. An unknown login does not automatically identify a natural person. A connected USB stick does not prove file transfer. High battery consumption is not evidence of spyware. Meaningful evidence often only emerges from the interplay of several independent pieces of evidence.

Mobile phone forensics for private individuals in Freiburg

Smartphones are often the central data source in private investigations. Messengers, emails, photos, user accounts, cloud connections, contacts, and numerous apps can contain information that contributes to reconstructing a digital process.

An examination may be useful, for example, if you want to clarify:

• whether there are indications of unauthorized access,
• whether technically unusual applications or configurations can be identified,
• whether unknown devices are connected to personal accounts,
• whether a former partner might still have access rights
• whether deleted WhatsApp messages can still be technically evaluated,
• whether photos, videos or documents can still be saved,
• or whether digital information should be documented in a traceable manner.

Which data is actually accessible depends on the smartphone model, operating system, security status, encryption, and the technically feasible extraction methods. Our article " What is Smartphone Forensics?" provides an overview.

Mobile phone hacked or monitored – what clues are conclusive?

Many affected users initially notice unusual symptoms: the battery drains faster, the smartphone gets warm, data usage increases, or unexplained logins occur. Such observations can warrant an investigation. However, on their own, they do not prove a compromise.

Depending on the device, applications, permissions, account information, system artifacts and other technically available data can be examined.

A meaningful analysis should not focus solely on classic spyware. Known login credentials, still-authorized devices, active cloud connections, or linked messenger sessions can also explain why personal information becomes accessible to another person.

Can a former partner still access my data?

After a breakup, digital connections that were deliberately established during a relationship can persist. Shared Apple or Google accounts, family sharing, saved passwords, tablets, computers, or other authorized devices can be relevant in this regard.

The central question, therefore, is not solely whether a spyware app exists. First, it should be clarified through which technical means the relevant information could even be accessed.

Depending on the initial situation, this may lead to an examination of the smartphone and other relevant data sources.

Forensic investigation of spyware and stalkerware

If there is a concrete suspicion of surveillance software, the device should not be hastily cleaned or reset. Changes to the system, in particular, can affect existing traces.

The investigation will consider the technically available data without prejudice. It cannot be guaranteed that every conceivable compromise or every previously existing malware will be detected.

A negative result therefore initially means that no corresponding reliable evidence was found within the examined database. It does not automatically prove that access could not have occurred at an earlier time.

Forensic examination of WhatsApp messages

Messenger communication often plays an important role in private disputes, threats, fraud cases and other legal matters.

A forensic analysis of WhatsApp data goes beyond simply reading a visible chat. Depending on the available data, messages, timestamps, participant information, media, documents, group structures, and other technical artifacts can be examined.

A screenshot, on the other hand, only documents a visible representation. For a more in-depth technical evaluation, the original data is significantly more informative.

Detailed information can be found under Forensic analysis of WhatsApp messages.

Deleted WhatsApp messages – what else is possible?

Whether deleted messages can be recovered cannot be answered definitively. A guarantee of recovery would be technically irresponsible.

Crucial factors include the device, operating system, WhatsApp version, database status, existing backups, and the use of the smartphone after deletion.

Other data sources may also be relevant. For example, an older backup or a communication partner's smartphone may contain a different message state than the device currently being examined.

Therefore, if important information has been deleted, WhatsApp should not be reinstalled prematurely and the smartphone should be used as little as possible.

Recover or prove photos, videos and documents

Private investigations don't just focus on messages. Deleted pictures, videos, documents, or other files can also be relevant.

However, modern smartphones use encrypted flash memory and complex storage mechanisms. This significantly differs their capabilities from those of traditional hard drives.

Additional data sources such as backups, synchronized data sets, or other devices can therefore form an important part of the investigation.

iPhone forensics in Freiburg

For an iPhone, the examination options depend on factors such as the model, iOS version, security configuration, and device condition.

Modern iPhones cannot be treated the same as traditional storage media. Depending on the technical specifications, different extraction methods and data volumes are suitable.

Therefore, the first step is to determine which data is needed for the specific question and which technically available backup method is suitable.

Further basic information can be found in our article What is iPhone forensics?

Android forensics – manufacturer and software version are crucial

Android smartphones differ considerably. Manufacturer, model, chipset, Android version, and security patch can influence which extraction and analysis options are available.

A blanket statement like "Android can be fully read" would therefore be inaccurate. The technical specifications of the specific device must be assessed.

Further information can be found in our knowledge article What is Android forensics ?.

Computer forensics for private individuals

Some digital processes cannot be understood solely through a smartphone. Windows PCs, Macs, and laptops may contain additional traces.

Depending on the system, user activity, file system information, browser data, connected devices and locally stored information can be examined, among other things.

This can be relevant, for example, if WhatsApp or other services were also used on a computer, files were exchanged between multiple devices, or a user account was logged in on different systems.

Phishing, smishing and online fraud

After a phishing link, a fraudulent SMS or an online scam, the question often arises as to what actually happened technically.

Was only a website opened? Were login details entered? Was a file downloaded? What activities occurred subsequently?

Depending on the circumstances, messages, emails, browser information, downloads and other traces can help to reconstruct the sequence of events.

A forensic investigation can document technical connections. However, it does not automatically identify the natural person behind a phone number, domain, or technical infrastructure.

Digital evidence for lawyers and court proceedings

In a legal dispute, the content of a message or file is not the only decisive factor. Its origin, storage method, and technical classification can be equally relevant.

Therefore, a distinction is made between a simple visual inspection and a verifiable forensic investigation.

For suitable datasets, hash values ​​can be used to verify the continued integrity of a defined backup. However, a hash value does not prove the veracity of the content, nor does it automatically prove authorship.

Our knowledge article on the integrity of digital evidence explains this in more detail.

Our IT forensics branch in Freiburg

Clients from Freiburg and southern Baden benefit from having a regional contact point. The branch office allows for direct coordination on-site and simplifies the handover process, especially for sensitive smartphones, computers, and other digital evidence.

This is particularly relevant in private cases because smartphones today serve simultaneously as communication tools, authentication devices, cameras, data storage, and access points to personal user accounts. Therefore, an investigation should be organized in such a way that the necessary scope and handling of the device are clearly defined beforehand.

Freiburg as a research, health and technology location

Freiburg is not only a university town, but also boasts a strong scientific and technological environment. Healthcare and life sciences, medical technology, information and communication technology, as well as environmental economics and renewable energies are among the key areas of expertise for the city.

Furthermore, there is a close connection between the university, non-university research institutions, and technology-oriented companies. This results in digital data sets with sometimes considerable economic or scientific value.

Research information, development documents, project data, technical documentation, and personal information can be distributed across various devices and systems. Therefore, in cases of suspected manipulation or data leakage, it is essential to first determine which data sources are actually relevant to the investigation.

Digital forensics for the healthcare and life sciences industries

In the healthcare, biotechnology, and medical technology sectors, sensitive information can take many different forms. Besides personal data, it can include research findings, technical developments, project documentation, or internal communications.

In the case of a specific security incident, the scope of the investigation should therefore be precisely defined. Not every piece of technically available information is necessarily relevant to the question at hand.

Especially with sensitive data, a targeted investigation is often more sensible than a blanket evaluation of complete data sets.

Research and development – ​​digital traces in the event of potential know-how loss

Research and development data is often generated over extended periods and processed on multiple systems. Desktop computers, laptops, mobile devices, and external storage media can document different parts of a process.

In cases of suspected unauthorized disclosure, for example, file activity, time information, external storage media and other technical artifacts can be examined.

A distinction must be made between technical observation and interpretation. The fact that a file has been opened does not automatically mean that it has been copied or shared.

IT forensics for companies in Freiburg

Different investigation questions arise when dealing with corporate smartphones than with private smartphones. Typical reasons might include:

• Suspected leakage of confidential data,
• conspicuous file activity prior to an employee change,
• Using external USB storage devices,
• deleted or altered business data,
• compromised user accounts,
• internal security incidents,
• or the securing of electronic evidence.

Which systems actually need to be investigated depends on the specific suspicion and the relevant time period.

Data theft by employees – what can computer forensics reveal?

If there is a concrete suspicion of the disclosure of company data, work computers, notebooks, company mobile phones and external data storage devices may contain relevant traces.

A common mistake is to overinterpret individual technical events. The detection of a connected USB device initially only shows that a connection has been established.

Determining whether specific files have been copied may require additional evidence. Multiple matching traces within a clearly defined time period can be particularly informative.

Cyber ​​incidents – combining evidence preservation and damage limitation

During an ongoing cyber incident, it is essential to limit the further risk to a company. At the same time, uncoordinated deletion, cleanup, or reinstallation measures can alter relevant technical traces.

Therefore, decisions should be made early on regarding which systems need to be isolated, which data needs to be backed up, and which measures need to be documented.

Forensic evidence preservation must not hinder necessary hazard prevention. Both objectives must be aligned with the specific incident.

Forensic software – tool selection based on the object of investigation

We use several specialized forensic solutions to examine different devices and data sources. The crucial factor is not the number of programs, but their appropriate application to the specific question at hand.

Cellebrite Inseyets

Cellebrite Inseyets is used particularly for the structured analysis of mobile digital data. Depending on the smartphone and available extraction capabilities, relevant artifacts can be filtered, correlated, and technically evaluated.

Cellebrite Digital Collector

Digital Collector supports suitable backup procedures for computers and digital storage media. The specific procedure depends on the hardware, operating system, encryption, and investigation objective.

Cellebrite Inspector

Inspector serves for the further investigation of computer forensic data sets and supports the structured analysis of relevant artifacts.

X-Ways Forensics

X-Ways Forensics enables detailed investigations of file systems, data carriers, partitions and other computer forensic structures.

MOBILedit Forensic and MEFF 3 Pro

MOBILedit Forensic and MEFF 3 Pro complement the tool base for mobile investigations and can open up additional analysis avenues depending on the device and the question being addressed.

However, automatically generated software results do not replace expert evaluation. For important findings, it may be advisable to check the underlying raw data or verify the results with another tool.

Quality management and expert competence

LB Detektive GmbH has a quality management system certified by TÜV NORD according to DIN EN ISO 9001, the scope of which includes IT forensics. In addition, the expert is certified according to DIN EN ISO/IEC 17024.

Both certifications address different levels. Quality management defines organizational processes; personnel certification concerns the proven competence of the certified individual.

For a forensic investigation, traceable work steps, controlled handling of digital evidence, and the separation between technical findings and professional interpretation are particularly relevant.

Three typical examination situations

Private information remains known after a separation

A former partner appears to have access to content that should no longer be accessible. Instead of immediately assuming surveillance software, various technical access methods are examined and narrowed down based on the available data.

A deleted chat becomes relevant in a legal dispute.

Part of the communication is no longer visible on the smartphone. First, it is checked which data sources are still available. Only then can it be assessed whether a reconstruction is technically feasible.

Confidential development data may have left the company.

Before an employee leaves the company, unusual file activity is detected. Relevant systems, external storage devices, and chronologically consistent artifacts are compared without prematurely concluding that a single event constitutes data theft.

How does a forensic investigation proceed in Freiburg?

1. Clarify the facts and the objective of the investigation

First, it is defined which technical process actually needs to be answered.

2. Determine relevant devices and data sources

It will be determined whether a smartphone, computer, data storage device, backup or other accessible data sources are needed.

3. Organize the handover via the Freiburg branch.

For clients from Freiburg and the surrounding region, the handover of digital investigation objects can be coordinated via the regional branch.

4. Create a suitable backup

The method depends on the device, operating system, encryption, technical condition, and the question being investigated.

5. Analyze data in a targeted manner

Relevant artifacts are examined and, if necessary, correlated with other traces in terms of time and content.

6. Document results in a comprehensible manner

Depending on the assignment, the technical findings are compiled in an investigation report or further expert documentation.

What should be avoided before an examination?

• Do not hastily reset a suspicious smartphone to factory settings.
• Do not attempt to remove suspected spyware on your own.
• Do not install any unknown analysis or cleanup programs.
• Do not reinstall WhatsApp if relevant messages have been deleted.
• Do not unnecessarily overwrite existing backups.
• Use devices with relevant deleted data as little as possible.
• Document any unusual reports and timestamps whenever possible.

IT forensics in Freiburg, southern Baden and the region

Our Freiburg branch is the contact point for clients from the city and the entire southern Baden region. Our regional catchment area includes, among others, Emmendingen, Waldkirch, Bad Krozingen, Breisach am Rhein, Müllheim, Lahr, Offenburg, Lörrach, Weil am Rhein, Titisee-Neustadt and Villingen-Schwenningen.

This allows us to cover not only Freiburg but also important areas of the Breisgau, Markgräflerland, Ortenau, the Black Forest, and the southern Upper Rhine region. For matters extending beyond this region, our other service areas in Baden-Württemberg are also available.

Frequently asked questions about IT forensics in Freiburg

Does LB Forensik have a branch in Freiburg?

Yes. Clients from Freiburg and southern Baden can use the regional branch to coordinate their forensic case and organize the handover of relevant equipment.

Can I have my phone checked for unauthorized access?

Yes. Depending on the device, technically available clues about possible access routes, suspicious applications, account connections, and other relevant artifacts can be examined.

Is it possible to determine if my ex-partner is monitoring my smartphone?

Potential technical access routes can be investigated. This includes not only spyware scenarios, but also, where applicable, known login credentials, connected devices, and synchronized accounts.

Can all spyware be reliably detected?

No. A complete guarantee of proof would not be technically sound. The reliability and limitations depend on the device, the potential attack, the time of the attack, and the available data.

Can deleted WhatsApp messages be recovered?

Under certain conditions, messages or remaining artifacts may still exist. Whether a reconstruction is possible must be examined based on the specific data available.

Can the authenticity of a WhatsApp chat history be verified?

If the original smartphone or a suitable extraction is available, the underlying data structures can be examined much more deeply than with an isolated screenshot.

Can MacBooks and Windows PCs also be examined?

Yes. The specific backup and analysis method depends on the hardware, operating system, encryption, and the question being investigated.

Is it possible to determine whether company data has been copied?

Depending on the available data, file activity, external storage devices, and other artifacts can be examined. A single technical hit is often insufficient to prove a concrete data breach.

Can research and development data be analyzed?

Yes. Especially in technology- and research-oriented companies, a targeted examination of relevant end devices and data carriers can be useful in the case of a concrete suspicion.

Can a cyber incident be reconstructed retrospectively?

This may be possible if suitable systems, protocols, or other data sources are still available. The potential scope of the investigation depends on the specific incident.

Does a forensic program already constitute an expert opinion?

No. Software extracts, structures, and visualizes technical data. An expert opinion, on the other hand, requires a defined question, expert review, and a comprehensible evaluation.

How much does a forensic examination cost in Freiburg?

The costs depend on the research question, the type of equipment, the number of data sources, technical accessibility, the volume of data, and the required documentation. Therefore, in more complex cases, the necessary scope of the investigation is first defined.

Initial forensic assessment via our Freiburg branch

If you suspect unauthorized access, need deleted communications, or want to secure digital information for legal proceedings, the affected device, the specific anomaly, and the relevant time period are particularly important for the initial assessment.

For companies, it should also be clarified which systems might be affected and whether any changes have already been made. This will then allow for the determination of which backup and investigation method is appropriate for the specific situation.

Further in-depth information on smartphone, computer and messenger forensics as well as digital evidence preservation can be found in our knowledge database.