When private messages are leaked even though no one should have access to them, a smartphone exhibits unusual activity, or important communication suddenly goes missing, suspicions of digital intrusion quickly arise. However, there is a crucial difference between a suspicious observation and technically verifiable unauthorized access.

Our IT forensics services in Bayreuth are therefore specifically aimed at private individuals who need clarity about activity on their smartphones, computers, or within their digital accounts. Instead of confirming assumptions, we examine the available data objectively: What digital traces actually exist? What can be reconstructed chronologically? Which statements are technically reliable – and where does the evidentiary value of the available data end?

Furthermore, we support companies, law firms, and other clients in securing and analyzing digital evidence. In a university, research, and business location like Bayreuth, this can involve not only personal devices but also research information, business communications, company data, and technical know-how.

Do you suspect unauthorized access to your smartphone?

Many private investigations don't begin with a single, clear technical incident, but rather with a series of anomalies. Someone else knows the content of private conversations. Messages appear to have been read. An unknown device appears within a user account. After a breakup, there's a suspicion that the former partner is still receiving information.

Such observations should be taken seriously, but not interpreted hastily.

Unauthorized access doesn't necessarily have to occur via a traditional spyware app. Possible causes include known login credentials, devices that remain logged in, linked messenger sessions, cloud synchronizations, or previous permissions granted.

A forensic investigation therefore considers not only the question "Is spyware installed?", but the overall technical picture.

Mobile phone forensics for private individuals from Bayreuth

Today, a smartphone is often the most important piece of digital evidence for a private individual. Communication, photos, messaging apps, emails, contacts, user accounts, and numerous other personal details all converge on a single device.

An examination may be useful, for example, if you want to clarify:

• whether there are indications of unauthorized access,
• whether unusual apps or configurations can be detected,
• whether other devices are connected to personal accounts,
• whether WhatsApp or Messenger data is still available,
• whether deleted communication could be technically reconstructed,
• whether digital access paths will continue after a separation,
• whether relevant photos, messages or documents can be saved,
• or whether digital information should be documented for legal purposes.

Which data is actually accessible depends largely on the smartphone model, operating system, security status, encryption, and the technically feasible extraction method. We explain the basics in the article " What is Smartphone Forensics?".

Phone hacked – which clues are truly reliable?

A rapidly draining battery, a warm device, high data usage, or occasional crashes can have numerous causes. None of these observations, taken individually, proves a compromise.

Of greater forensic interest are technical artifacts and their interrelationships. Depending on the device, applications, permissions, account information, system data, and other available traces can be examined.

A negative result must also be correctly interpreted. If no reliable evidence is found within the examined database, this does not automatically mean that access could not have occurred at an earlier time.

The scope of a finding is always limited by the actually available data basis.

Digital access after a separation

Separation and relationship conflicts are among the most sensitive areas of private IT forensics. There is often suspicion that a former partner still has access to personal communications, photos, or other information.

However, especially in long-term relationships, digital services were often set up jointly. Passwords were known, tablets were shared, family features were activated, or user accounts were logged in on multiple devices.

This allows access to information without the installation of traditional spyware.

Depending on the circumstances, the smartphone should therefore not be considered in isolation. User accounts, linked devices, messenger connections, and other technically plausible access methods can also be relevant.

WhatsApp as evidence: more than just a screenshot

WhatsApp communication often plays a central role in private conflicts, threats, fraud cases and legal disputes.

A screenshot, however, only documents the image displayed on the screen. For a more detailed technical evaluation, the original data source is much more relevant.

Depending on the available extraction options, messages, time information, participant assignments, media, documents, group information and other WhatsApp artifacts can be examined.

We explain the technical possibilities in more detail under "Forensic analysis of WhatsApp messages".

Deleted WhatsApp messages – what else is possible?

The statement "deleted always means permanently lost" is just as disingenuous as the promise that every deleted message can be recovered.

The decisive factor is the specific data situation.

Depending on the device and application, databases, media, backups, or other existing artifacts may be relevant. An older backup may also contain information that is no longer visible in the current data.

However, modern smartphones use encryption and complex storage mechanisms. Therefore, a complete data recovery can never be guaranteed.

If deleted information is important, the device should be used as little as possible and WhatsApp should not be reinstalled prematurely.

Forensic examination of photos, videos and documents

It's not always about messaging apps. Private disputes can also revolve around photos, videos, documents, or other files.

The first step is to determine where the information in question was originally stored. Besides the smartphone itself, backups, synchronized data, or other devices may be relevant.

The same applies to deleted files: recovery options depend on storage technology, encryption, the deletion process, and further use.

iPhones and Android devices require different investigation methods.

A modern iPhone cannot be examined like a traditional hard drive. The same applies to modern Android smartphones.

On Apple devices, factors such as model, iOS version, device condition, and security configuration influence the available options. Android devices also differ significantly depending on the manufacturer, chipset, Android version, and security patch.

Therefore, for each device, it is first determined which type of data backup or extraction is technically available and makes sense for the specific question.

Further information can be found in our specialist articles on iPhone forensics and Android forensics.

Computer forensics for private matters

Some digital processes cannot be understood solely through a smartphone. Windows PCs, Macs, and laptops may contain additional traces.

Depending on the system, user activity, file system information, browser data, connected devices and installed programs can be examined, among other things.

This can be relevant, for example, if messengers were also used on the computer, a user account was logged in on multiple devices, or files were transferred between different systems.

Further technical background information can be found under What is computer forensics ?.

Phishing, online fraud and compromised user accounts

After a phishing or fraud incident, there is often concern that the entire smartphone has been compromised. Technically, this is not necessarily the case.

For a meaningful investigation, it is essential to first reconstruct what actually happened: Was a link opened? Were login credentials entered? Was a file downloaded? Was there any subsequent unusual account activity?

Depending on the circumstances, messages, emails, browser information, downloads and other technical traces may be relevant.

A forensic investigation can help document the digital process. However, it cannot automatically identify the natural person behind a fraudulent server, phone number, or user account.

Digital evidence for lawyers and legal disputes

In private disputes, simply finding a piece of information is often not enough. The source and how it was secured can be crucial later on.

Therefore, we distinguish between a simple visual inspection and a verifiable forensic investigation.

For data relevant to evidence, it is documented which object of investigation was present, which securing method was used, and on which data basis the subsequent analysis was carried out.

For suitable datasets, hash values ​​can be used to verify their continued integrity. Our article on the integrity of digital evidence explains what hash values ​​can – and cannot – do.

Which forensic software do we use?

Smartphones, computers, and data storage devices differ significantly in their technical specifications. Therefore, we do not work with a single universal solution, but rather with several specialized forensic systems.

Cellebrite Inseyets

Cellebrite Inseyets is used particularly in the field of mobile forensics. Depending on the device and available extraction techniques, smartphone data can be analyzed in a structured manner and relevant artifacts can be evaluated for the respective research question.

Cellebrite Digital Collector and Inspector

For computer and data carrier investigations, specialized tools such as Cellebrite Digital Collector and Inspector are available for data acquisition and subsequent examination of digital data sets.

X-Ways Forensics

X-Ways Forensics enables in-depth investigations of file systems, storage media, partitions, and other computer forensic structures. This can be particularly important for detailed file system analyses.

MOBILedit Forensic and MEFF 3 Pro

MOBILedit Forensic and MEFF 3 Pro complement the possibilities for mobile investigations and can open up additional analysis paths depending on the device and task.

However, the software used does not solely determine the quality of the result. Automatically generated hits must be professionally reviewed and evaluated within their technical context. Therefore, a software report is not automatically an expert opinion.

Bayreuth: University city, research location and economic center of Upper Franconia

Bayreuth has its own dedicated structure for digital forensic investigations. In addition to its role as a regional center, the city is characterized by its university, research institutions, public facilities, healthcare sector, services, and manufacturing and technology-oriented companies.

The connection between science and business, in particular, means that digital information can have very different meanings. Besides traditional company data, research documents, project information, technical documentation, development statuses, and other know-how can be worthy of protection.

For a forensic investigation, this means: the goal is not to gather the largest possible amount of data. The crucial factor is identifying those devices and data sources that are actually relevant to a specific question.

IT forensics for companies and institutions in Bayreuth

Business assignments focus on different issues than a private smartphone review.

Typical occasions might include:

• Suspected leakage of confidential information,
• unusual file activity prior to an employee's departure,
• Using external USB storage devices,
• deleted or altered business data,
• compromised user accounts or computers,
• internal security incidents,
• Cyberattacks
• or the securing of electronic evidence.

Especially when dealing with sensitive corporate or research data, the scope of the investigation should be precisely defined. A targeted analysis can be more informative than the undifferentiated evaluation of large datasets.

USB stick found – does that prove data theft?

No. This is a good example of why technical findings must be formulated carefully.

Under certain conditions, a computer system can document that a specific USB device was connected. However, this does not automatically mean that confidential files were copied to that device.

For a more thorough evaluation, additional evidence must be considered. Only the interplay of several artifacts can potentially support a more concrete sequence of events.

Cyber ​​incident: React first or secure evidence first?

Both must be coordinated.

In the event of an ongoing security incident, damage control takes priority. At the same time, uncoordinated new installations or deletion measures can eliminate digital traces that are later needed for root cause analysis.

Therefore, decisions should be made as early as possible regarding which systems need to be isolated, which data needs to be backed up, and which measures need to be documented.

Verifiable quality instead of automated software reports

LB Detektive GmbH has a quality management system certified by TÜV NORD according to DIN EN ISO 9001, the scope of which includes IT forensics. In addition, the expert is certified according to DIN EN ISO/IEC 17024.

These are two different levels: Quality management concerns defined organizational processes; personnel certification concerns the proven competence of the certified person.

For the client, the most important factors are transparent investigation procedures, controlled handling of the data, and a clear separation between technical findings and professional interpretation.

Three typical situations from our examination practice

Private communication no longer seems to be private.

After a breakup, another person has access to content that should only be on the user's smartphone. Instead of immediately assuming spyware, possible technical access points are narrowed down and the available data is then systematically examined.

Deleted messages become important in a legal dispute.

A particular communication history is no longer fully visible. First, it is examined which data sources are still available. Only then can it be assessed whether a reconstruction has any technical prospect of success.

Company data may have leaked before an employee left the company.

Unusual file activity occurs within a narrowly defined period. Instead of immediately concluding that this is data theft, relevant computer systems, external storage devices, and other technical traces are compared.

This is how a forensic investigation begins.

1. What needs to be clarified?

It doesn't start with software, but with a specific question. This allows us to determine which digital traces might be relevant.

2. Which data sources are suitable?

Depending on the case, smartphones, computers, data storage devices, backups, or other accessible data repositories may be important.

3. Which security method is suitable?

The procedure depends on the device, operating system, encryption, and investigation objective. Identical bit-for-bit backup is not possible in every technical configuration of modern smartphones.

4. Which pieces of evidence support or refute the initial assumption?

The data is not only searched for individual keywords. Relevant artifacts are classified technically and chronologically and, where meaningful, correlated with each other.

5. What conclusions can actually be drawn from this?

The results are documented in such a way that a distinction can be made between established technical facts, expert interpretation, and unanswerable questions.

Before the investigation: These errors can alter digital traces

• Do not reset a suspicious smartphone prematurely.
• Do not delete suspected spyware on your own.
• Do not install any unknown analysis or cleanup programs.
• Do not reinstall WhatsApp if you have deleted important messages.
• Do not unnecessarily overwrite existing backups.
• Use a device with relevant deleted data as little as possible.
• Document any unusual reports, times, and observations.

IT forensics for Bayreuth and Upper Franconia

Our services are available to private individuals, companies, and law firms in Bayreuth and the surrounding Upper Franconian region. This includes, among others, Kulmbach, Hof, Coburg, Forchheim, Bamberg, and other locations in the area.

For cases relating to the Nuremberg metropolitan region, our regional IT forensics page for Nuremberg is also available.

Frequently asked questions about IT forensics in Bayreuth

I think someone is monitoring my phone. What should I do first?

Avoid making hasty changes to the device. Note or document any specific abnormalities and first have it checked to determine which examination is appropriate based on your device and the question at hand.

Is it possible for private individuals to have their mobile phones examined?

Yes. Unauthorized access, suspected spyware, deleted communications, account problems, and digital conflicts after a separation are typical reasons for private investigations.

Is it possible to determine if my ex-partner has access to my data?

Depending on the circumstances, technical access routes can be investigated. These can include not only the smartphone but also connected accounts and devices. Whether specific access can be proven depends on the available evidence.

Can all spyware be detected?

No. Such a guarantee would not be technically sound. The possibilities for proof depend, among other things, on the device, operating system, potential attack, time of the attack, and available data.

Are deleted WhatsApp messages permanently lost?

Not necessarily. Under certain circumstances, data or other relevant artifacts may still be present. However, a complete recovery cannot be guaranteed.

Is it possible to verify if a WhatsApp screenshot is genuine?

The screenshot itself has limited value. If the original smartphone or a suitable data extract is available, the underlying communication data can be significantly more informative.

Can a Mac or Windows computer also be examined?

Yes. The specific procedure depends on the hardware, operating system, encryption, device condition, and the question to be answered.

Can a company determine whether data has been copied?

Under suitable conditions, file activity, external storage devices, and other system artifacts can be examined. Whether a specific copy operation can be verified must be assessed based on the total available traces.

Is a forensic program sufficient for an investigation?

Software can extract data and display artifacts. The expert interpretation, verification of correlations, and evaluation of the findings' significance remain the responsibility of the investigator.

How is the scope of the investigation determined?

The starting point is the device, the specific abnormality observed, the relevant time period, and the desired investigation goal. From this, it can be derived which security measures and analyses are actually required.

Confidential initial assessment for a case from Bayreuth

If you suspect unauthorized access to your smartphone, need deleted communications, or want to secure digital information for a dispute, a few details are crucial: Which device is affected? What exactly have you noticed? How long have you suspected this? Has the device been reset, updated, or otherwise modified since then?

In corporate cases, the relevant time period, the affected systems, and the specific suspicion are also important. Only then is it determined which security and investigation method is technically appropriate.

Further understandable explanations on smartphone, computer and messenger forensics as well as on digital evidence preservation can be found in our knowledge database.