Unauthorized access to a smartphone, missing messages, suspicious account activity, or potentially copied company data cannot be reliably resolved through mere speculation. What matters is identifying the actual digital traces present, how they might have originated, and what technical conclusions can be drawn from them.

For clients in Erlangen, we examine smartphones, computers, data storage devices, and other digital evidence . Private individuals contact our forensic team particularly in cases of suspected unauthorized access, deleted communications, compromised accounts, or digital disputes following a separation. For businesses, the focus is on data leaks, internal suspicions, cyber incidents, and the protection of sensitive research, development, and business data.

Erlangen possesses a unique local context for this. Science, research, medical technology, and technology-oriented companies shape the location and its connection to the Nuremberg metropolitan region . Where development knowledge, personal information, and confidential project data are processed digitally, precise evidence preservation can be crucial for the technically verifiable reconstruction of an incident.

IT forensics in Erlangen: What can actually be proven?

Professional IT forensics begins with a specific question. Was a smartphone accessed without authorization? Are there still traces of deleted communications? Were specific company files copied? Which systems were affected by a cyber incident?

Only by defining the question can the necessary equipment and data sources be determined. A distinction is made between observed anomalies, technical findings, and their expert interpretation. This separation prevents individual artifacts from being prematurely interpreted as proof of a particular process.

Mobile phone forensics for private individuals in Erlangen

Smartphones are among the most data-rich personal devices. Messenger communication, photos, contacts, emails, app data, user accounts, location information, and cloud connections can all be relevant for reconstructing a digital event.

A forensic smartphone examination can be useful in various situations, including:

• Suspected unauthorized access to a smartphone
• possible spyware or technical manipulation
• unknown account or device connections
• deleted WhatsApp or Messenger messages
• deleted photos, videos, or other data
• digital conflicts after separation or divorce
• Securing electronic evidence for legal proceedings

The information that is actually accessible depends on the specific device, operating system, security status, encryption, and the data that is still available.

Phone hacked or monitored?

Unusually high battery consumption, device overheating, or increased data traffic do not prove surveillance. Such anomalies can have numerous normal technical causes.

In cases of concrete suspicion, objectively verifiable traces are examined. Depending on the device, applications, permissions, system artifacts, user accounts, and other relevant information may be included.

Especially after a breakup, potential access doesn't necessarily have to involve spyware. Other authorized devices, known passwords, Apple or Google accounts, email access, and synchronized cloud services can also be relevant.

An open-ended investigation must also be able to conclude that no reliable technical evidence can be found to support the suspected compromise.

Deleted WhatsApp messages and digital data

Deleted messages or files can sometimes be recovered under certain conditions. However, recovery cannot be guaranteed. Modern smartphones use encryption, flash memory, and complex storage mechanisms that significantly affect the availability of deleted data.

Depending on the device, messenger databases, media, backups, or other artifacts can be examined. If important data has been deleted, the device should ideally not be reset or used unnecessarily.

iPhone, Android and mobile forensics

iPhones and Android devices require different investigation strategies. For Apple devices, factors such as model, iOS version, device condition, and security configuration influence the available options. For Android devices, additional factors include differences between manufacturers, chipsets, operating system versions, and security updates.

Depending on the device, tools such as Cellebrite UFED, MOBILedit Forensic, MEFF 3 PRO, and other specialized systems can be used. Further information can be found in our Mobile Forensics section.

Computer forensics: Not just finding files, but reconstructing processes.

When examining a computer, the temporal context is often crucial. When was a file created, opened, modified, or deleted? What user activity can still be traced? Which external storage devices were connected? What other system traces correspond to the investigated time period?

Windows PCs, Macs, SSDs, and other storage media have different forensic properties. For corresponding investigations, tools such as Cellebrite Collector, Cellebrite Inspector, and X-Ways Forensics, as well as other specialized tools, can be used.

Erlangen: Digital forensics at the intersection of research, medical technology and technology

Erlangen's profile raises questions that differ from those of traditional commercial or administrative centers. Research institutions, medical and medical technology facilities, and technology-oriented companies work with data whose value can extend far beyond individual files.

Research findings, technical documentation, development documents, project communication, personal information and internal know-how can be distributed across various end devices, user accounts and storage systems.

Therefore, in cases of concrete suspicion, the broadest possible analysis is not necessarily the most sensible approach. First, it must be determined which data might be affected, where corresponding traces are to be expected, and which time period is actually relevant for the investigation.

Research and development data as digital evidence

Research and development projects often generate complex digital origin histories. Files are edited, copied, versioned, exchanged, and synchronized across different systems over extended periods.

Therefore, in the event of a potential data breach, the mere presence of a specific file on a system is not the sole determining factor. Depending on the specific question, file system information, timestamps, user activity, external storage devices, and other artifacts can be compared.

A distinction must be made between a technically detected activity and its significance. For example, the fact that a file was opened does not automatically prove that it was subsequently shared with a third party.

IT forensics for companies in Erlangen

Corporate forensics becomes particularly relevant when a concrete suspicion needs to be technically verified. This could involve the leakage of confidential information, unusual file activity, compromised user accounts, or a cyber incident.

Typical research questions include:

• Were any confidential files copied or deleted?
• Which external storage devices were used?
• Were there any unusual activities prior to changing employers?
• Has a user account been used without authorization?
• What digital traces exist relating to a specific event?
• Which systems were affected by a security incident?

Data leakage upon termination of employment or change of employer

Cases of suspected misuse of company information, such as dismissal, suspension, or change of employer, can be particularly time-sensitive. If there are concrete indications of the potential theft of company information, it is crucial to clarify early on which digital evidence must be preserved.

Depending on the case, work computers, notebooks, company mobile phones, external data storage devices, user accounts or other systems may contain relevant traces.

A single finding is often insufficient. For example, the connection of a USB storage device initially only proves its connection to the computer. Whether specific files were transferred to it is a separate question requiring investigation.

Further information on such matters can be found in our section on data theft.

Cyber ​​incidents and compromised systems

In a cyber incident, two requirements collide: an ongoing attack must be contained, while existing digital traces may be relevant for later reconstruction.

A hasty reinstallation or cleanup can alter information. Conversely, a compromised system should not be unnecessarily operated solely for the purpose of preserving evidence.

The data sources required depend on the specific incident. End devices, user accounts, system information, email data, or other digital sources can each document different parts of the event.

Digital evidence preservation begins before analysis.

The quality of an investigation does not depend solely on the analysis software used later. Even the acquisition and preservation of digital evidence can influence what conclusions can be drawn later.

The appropriate method depends on the object being examined and the technical setup. A traditional data storage device can be handled differently than an encrypted smartphone, an SSD, or a modern Mac.

With appropriate security measures, cryptographic hash values ​​can be used to verify the integrity of a dataset. A documented chain of custody can additionally record when and how an object of investigation was received, secured, and processed.

Cellebrite, X-Ways and specialized forensic tools

For different types of investigations, tools such as Cellebrite UFED, Cellebrite Collector, Cellebrite Inspector, X-Ways Forensics, MOBILedit Forensic and MEFF 3 PRO, as well as other specialized tools, are available.

Software alone does not constitute reliable forensic analysis. A tool can extract, structure, and present data. Crucially, it requires expert evaluation: How did an artifact originate? What conclusions can be drawn from it? What alternative explanations exist? And where does the technical significance end?

Certified quality and expert competence

LB Detektive GmbH has a quality management system certified by TÜV NORD according to DIN EN ISO 9001, the scope of which includes IT forensics. In addition, the expert is certified according to DIN EN ISO/IEC 17024.

This combines organizationally defined quality processes with demonstrably qualified expert competence. For clients, transparent investigation procedures, controlled handling of evidence, and clear technical documentation are particularly relevant.

Typical cases examined in Erlangen

Private individual: Access after a separation

Another person appears to still possess confidential information. Possible technical access routes via smartphone, accounts, synchronized devices, and known login credentials are being investigated before a cause is assessed.

Technology company: Suspected leak of project information

Confidential development documents appear to have been leaked to people outside the intended circle. Instead of evaluating all company data, the relevant time period, affected systems, and technically suitable data sources will first be narrowed down.

Employee case: Suspicious activities prior to leaving the company

Shortly before a change of employer, unusual file activity is detected. Relevant file system traces, user activity, and external storage devices can be correlated chronologically to technically narrow down the process.

How does an IT forensic investigation proceed?

1. Define the research objective

The initial suspicion is transformed into a concrete technical question.

2. Determine relevant evidence

An assessment is being conducted to determine which smartphones, computers, data storage devices, or other data sources can actually contribute to clarifying the situation.

3. Secure data properly

The backup procedure is adapted to the device, operating system, and investigation objective.

4. Analyze digital traces

Relevant artifacts are examined and, if necessary, compared with other data sources in terms of timing and content.

5. Document results

Depending on the scope of the commission, the findings can be compiled into a structured investigation report or expert opinion.

What should be avoided before an examination?

• Do not hastily reset a potentially compromised smartphone.
• Do not remove suspicious apps manually.
• Do not install any unknown spyware or cleaning programs.
• Do not unnecessarily modify computers and data storage devices.
• Use devices with deleted data as little as possible.
• Document unknown logins and security alerts.

IT forensics in Erlangen and the metropolitan region

Our service area includes Erlangen, Herzogenaurach, Forchheim, Höchstadt an der Aisch, Fürth, and other locations in the Nuremberg metropolitan region. Thanks to close economic and infrastructural ties, we can handle both private and business investigations from across the entire region.

There is also a dedicated webpage for Nuremberg . Clients can have individual smartphones or computers examined, as well as more complex cases involving multiple digital pieces of evidence.

Frequently asked questions about IT forensics in Erlangen

Can I, as a private individual, commission a mobile phone forensics analysis?

Yes. Private investigations often concern potential unauthorized access, deleted communications, user accounts, smartphones, or digital evidence for personal and legal disputes.

Is it possible to determine if my smartphone has been hacked?

Existing technical traces of possible unauthorized access can be examined. Whether a compromise can actually be proven depends on the device, operating system, possible access method, and the data still available.

Can deleted WhatsApp messages be recovered?

A complete or partial reconstruction may be possible under certain technical conditions. However, a successful restoration cannot be guaranteed.

Is it possible to check if a former partner still has access to my data?

Depending on the circumstances, smartphones, bank account details, and other potential access points may be examined. In addition to malware, authorized devices or known login credentials, for example, may also be relevant.

Can research or development data be forensically examined?

Yes. Depending on the system and the question being asked, for example file activities, user activities, external storage media and other digital artifacts can be examined and compared over time.

Is it possible to determine if files have been copied to a USB stick?

Connecting a USB storage device and subsequent file activity can leave traces under certain circumstances. Whether the transfer of specific files can be proven depends on the overall data situation.

Can cyberattacks be investigated retrospectively?

This may be possible if suitable data sources are still available. Which systems and information are needed depends on the specific attack scenario.

What is the difference between a forensic report and an expert opinion?

An investigation report documents the technical investigations and findings carried out. An expert opinion, on the other hand, answers a defined evidentiary or technical question based on clearly presented investigation and evaluation steps.

How much does an IT forensic investigation cost in Erlangen?

The effort required depends on the research question, the number of devices, the amount of data, technical accessibility, and the desired documentation. For more complex issues, the necessary scope is therefore initially defined based on technical expertise.

Request IT forensics services in Erlangen

For an initial assessment, four pieces of information are particularly helpful: Which device or system is affected? What specific findings were observed? When did the relevant event approximately occur? And has the device been used, modified, or reset since then?

Based on this, it can be determined which digital evidence is actually needed and which preservation and analysis method is suitable for the specific question. Further in-depth technical information can be found in our knowledge database on digital forensics.