A smartphone is suddenly behaving strangely. Private messages seem to have been seen by someone else. After a breakup, there's a suspicion that a former partner still has access to digital accounts. Or files on a computer have been deleted, altered, or possibly transferred to an external storage device.

In such situations, it's not about assumptions, but about digital traces. The IT forensics team in Ingolstadt supports private individuals, companies, lawyers, and other clients with the technical securing, examination, and evaluation of digital data. Smartphone forensics and computer forensics are particular areas of focus.

Smartphones and computers can be crucial data sources, especially for private individuals. Messengers, user accounts, browsers, photos, documents, cloud connections, and system information can contain clues about what actually happened on a device. The goal is not to find a specific result, but rather to identify which conclusions can be derived from the available data in a technically verifiable way.

Mobile phone and computer forensics for Ingolstadt – two central data sources

Many digital processes can no longer be viewed in isolation on a single device. A WhatsApp account can be connected to a computer. Photos are synchronized between smartphones and the cloud. Login credentials are stored in browsers. Emails are accessed on multiple devices. Documents move between laptops, smartphones, USB drives, and online storage.

Therefore, in more complex cases, it can be useful to consider both the smartphone and the computer together. While the mobile device primarily reflects communication, apps, account connections, and mobile activities, a computer may contain additional file, browser, user, and storage traces.

Which devices actually need to be examined is determined by the specific question being asked. A larger amount of data is not automatically better. Professional digital forensics focuses on those data sources that can contribute to clarifying the facts of the case.

Mobile phone forensics in Ingolstadt – when the smartphone itself becomes evidence

The smartphone is one of the most personal digital devices available. It combines communication, photos, videos, contacts, email, messaging, user accounts, cloud services, and numerous applications into a single system.

For private individuals from Ingolstadt, a forensic examination is relevant, for example, in the following cases:

• Suspected unauthorized access to the smartphone,
• possible spyware or stalkerware,
• suspicious account accesses,
• digital surveillance after a separation
• deleted WhatsApp messages,
• missing photos, videos or documents,
• Phishing, smishing, or online fraud,
• threats and digital stalking,
• or the safeguarding of digital information for a legal dispute.

The extent of a technical investigation depends on factors such as the manufacturer, model, operating system, security level, encryption, and available extraction methods. Our article " What is Smartphone Forensics?" explains the basics.

Phone hacked – can unauthorized access be detected?

The suspicion of a hacked smartphone often arises from conspicuous observations: unusual battery consumption, unknown logins, changed settings, or personal information that has apparently become known to another person.

Such anomalies are initially indications, not proof. A rapidly draining battery can have numerous technical causes. Similarly, unusual data usage, in itself, does not prove surveillance.

A forensic investigation therefore considers the technically available information in context. Depending on the device, applications, permissions, account connections, system artifacts, and other relevant data can be examined.

It is particularly important not to search exclusively for traditional malware. Unauthorized access can also occur via known login credentials, still-authorized devices, linked accounts, or other legitimate functions that are being used by an unauthorized person.

My ex-partner knows my private information – is my smartphone being monitored?

Especially after breakups, suspicions often arise that a former partner still has access to private information. Technically, this doesn't necessarily mean spyware is involved.

During a relationship, devices and accounts are often deliberately linked. Login credentials are shared, tablets are used jointly, family features are set up, or computers are connected with the same user accounts.

After a breakup, such connections can continue unnoticed.

A proper investigation therefore considers possible access routes and attempts to technically distinguish between an actual compromise and existing account connections.

Investigate spyware and stalkerware on smartphones

If there is a concrete suspicion of surveillance software, the smartphone should not be reset or cleaned prematurely. Doing so could alter or delete precisely the information that would later be relevant for an investigation.

The analysis is conducted in an open-ended manner to determine whether the technically available data contains any indications of suspicious applications, configurations, or other anomalies.

It is important to note an important limitation: No reputable forensic investigation can guarantee the detection of every conceivable or previously existing compromise. A negative finding means that no corresponding reliable evidence was found within the examined dataset. It does not automatically prove that unauthorized access never occurred.

WhatsApp forensics – technically examining messages

WhatsApp communication can be of significant importance in private disputes, threats, fraud cases, or other legal conflicts.

A forensic investigation goes beyond a simple screenshot. Depending on the available data, messages, time information, media, participant information, and other technically relevant structures can be examined.

This is particularly important when the authenticity or context of a communication plays a role. A screenshot initially only documents the displayed image. It does not automatically contain the underlying messenger data.

Further information can be found under Forensic analysis of WhatsApp messages.

Can deleted messages and files be recovered?

One of the most frequently asked questions is whether deleted WhatsApp messages, photos, documents or other data can be recovered.

A blanket promise would be irresponsible. Whether deleted information is still available or recoverable depends heavily on the device and its subsequent use.

For smartphones, modern encryption and storage mechanisms play a crucial role. For computers, the file system, storage medium type, overwriting, and, in the case of SSDs, especially cleanup mechanisms like TRIM, can influence the possibilities.

Additional data sources can still be relevant. These include, for example, existing backups, synchronized systems, or other devices on which the same information has been stored or processed.

Computer forensics Ingolstadt – Examining Windows PCs, notebooks and Macs

Computers generate numerous digital artifacts during their use. Files are created, opened, modified, and deleted. Programs are launched, websites are visited, users are logged in, and external devices are connected.

Computer forensics attempts to connect such individual technical traces and reconstruct comprehensible processes from them.

Depending on the operating system and the specific question, the following can be examined, for example:

• Files and file system information
• deleted data, insofar as it is still technically available,
• User activities,
• Browser and download information,
• System logs,
• connected USB devices,
• external hard drives and other data storage devices,
• installed or used programs,
• local email data,
• Cloud applications and synchronization traces,
• as well as temporal relationships between different events.

Is it possible to determine what happened on a computer?

Computer forensics does not reconstruct events based on a single, universal log file. Instead, meaningful evidence arises from the combination of various artifacts.

Let's assume a USB stick was plugged into a computer. This technical proof initially only means that the device in question was connected to the computer.

It does not yet prove that specific files were copied onto it.

Only when additional traces are present – ​​such as corresponding file activities, matching time information or other system artifacts – can a more reliable overall picture emerge.

This separation between finding and interpretation is an essential component of professional computer forensics.

Examine mobile phone and computer together

Especially in private cases, the combined consideration of several devices can be crucial.

A smartphone may not provide a clear explanation for why someone else's private communications have become public. However, a shared computer may still contain active browser sessions, account connections, or other relevant information.

Conversely, a computer may contain evidence of an activity whose communication or authentication took place via a smartphone.

However, a cross-device analysis does not mean indiscriminately evaluating all private data. The scope of the analysis should be limited to the specific question being addressed and the relevant time period.

Digital evidence for lawyers and legal disputes

If digital data could later become relevant to a lawyer, an insurance company, or in legal proceedings, attention should be paid to ensuring verifiable backups at an early stage.

A distinction must be made between content, integrity, and interpretation.

A cryptographic hash value can be used, for example, to verify the continued integrity of a defined, secured dataset. However, it does not automatically prove that the content is true or originates from a specific person.

These differences are explained in our article on the integrity of digital evidence.

IT forensics for companies in Ingolstadt

Ingolstadt possesses a unique economic and technological structure. Automotive, mobility, industrial development, digitalization, and research are closely intertwined. At the same time, these sectors generate vast amounts of confidential digital information.

Therefore, different questions may be relevant for businesses than for a private smartphone. These include, for example:

• Suspected data theft,
• unusual file activity prior to an employee's departure,
• Use of external storage media,
• Deletion or manipulation of business data,
• compromised user accounts,
• Cyber ​​incidents,
• or the securing of relevant computers and data storage devices for internal or legal investigations.

Automotive and mobility – sensitive development data as a subject of investigation

The Ingolstadt economic region is particularly heavily influenced by the automotive and mobility industries. Digital forensics can become relevant in this environment when there is concrete evidence of the leakage of confidential information, unauthorized file activity, or manipulation.

Development documents, technical documentation, project data, presentations, calculations, or other information can be distributed across various systems. Workstations, laptops, mobile devices, and external storage media can therefore document different parts of the same process.

In cases of suspected data breach, it is crucial to technically reconstruct the possible transmission path. The mere existence of a confidential file on a computer does not prove data theft.

AI, connected mobility and research in Ingolstadt

Alongside its industrial importance, Ingolstadt is increasingly developing into a science and digital hub. Universities, research institutions, artificial intelligence, and networked mobility are creating an environment in which data itself is becoming a valuable economic and scientific asset.

For forensic investigations, this means that not only classic office documents are relevant. Depending on the case, development stages, source and project data, research documents, or other technical information may also be subject to investigation.

Especially with research and development data, a precise research question is important. No more data should be analyzed than is necessary for the specific research purpose.

Data theft by employees – what can actually be determined?

A typical corporate case begins shortly before or after an employee leaves. Files are missing, an external storage device was used, or there is a suspicion that confidential information was taken.

An investigation can compare various technical traces. These can include file accesses, connected storage media, browser and cloud artifacts, or other system information.

It remains important to exercise professional caution: The connection of a USB stick is not automatic proof of data theft. Likewise, activity under a user account does not necessarily identify the individual who was actually using the device.

Forensic science should not conceal these boundaries, but rather make them visible.

Cyberattack on a computer – why early backup can be important

In a cyber incident, two goals exist side by side: the ongoing damage must be limited and relevant technical traces should be preserved as far as is reasonable.

Uncoordinated cleanups, reinstallations, or deletion actions can alter data that may later be needed for reconstruction.

With running computers, there is the added risk that volatile information in RAM can be lost as soon as the device is switched off. With encrypted systems, an already accessible state can also be lost.

Therefore, the decision between isolation, live backup, shutdown and further analysis should depend on the specific incident.

Forensic preservation of computers and data storage devices

A professional investigation, using appropriate systems, begins with a controlled backup of the relevant data. The analysis is then carried out, if possible, on a defined basis for investigation and not unnecessarily on the original data.

For traditional storage media, forensic images and write-protection methods can be used, for example. For running, encrypted, or technically complex systems, other backup strategies may be necessary.

Smartphones represent a distinct device class. A classic bit-by-bit copy , as with a conventional hard drive, is often not possible with modern mobile devices. In these cases, it is essential to document which extraction method was used and the actual amount of data recovered.

Professional forensic software for mobile phones and computers

Different objects of investigation require different tools. Therefore, we do not work with a single software solution, but with specialized systems for mobile and computer forensic investigations.

Cellebrite Inseyets

Cellebrite Inseyets is used particularly for the acquisition and analysis of mobile digital data. The specific data that can be extracted depends on the individual smartphone and its security status.

Cellebrite Digital Collector

Digital Collector supports the forensic acquisition of computers and digital storage media. The appropriate procedure depends, among other things, on the operating system, hardware, encryption, and current device status.

Cellebrite Inspector

Cellebrite Inspector supports the analysis of computer forensic data sets and enables the structured examination of relevant artifacts.

X-Ways Forensics

X-Ways Forensics is used for detailed investigations of data carriers, partitions, file systems and other computer forensic structures.

MOBILedit Forensic and MEFF 3 Pro

MOBILedit Forensic and MEFF 3 Pro complement the mobile tool base and can offer additional analysis and evaluation options depending on the device and the investigation question.

The software used provides technical data and supports its structuring. However, it does not replace a professional assessment. Therefore, an automated software report is not equivalent to an expert opinion.

Verifiable quality in digital examinations

LB Detektive GmbH has a quality management system certified by TÜV NORD according to DIN EN ISO 9001, the scope of which includes IT forensics. In addition, the expert is certified according to DIN EN ISO/IEC 17024.

For clients, it is particularly important that the subject of the investigation, the securing method, relevant work steps and technical findings are documented in a comprehensible manner.

Technical findings and legal conclusions are kept separate. Forensic analysis first answers the technical question of what traces are present and what conclusions they actually allow.

Three typical cases from mobile phone and computer forensics

Case 1: After a breakup, private messages remain known.

A private individual discovers that a former partner has access to content that should no longer be accessible. Instead of solely searching for spyware, potential technical access points are examined. Smartphones, user accounts, and possibly other shared devices may be relevant in this process.

Case 2: Deleted messages are needed for a legal dispute

An important part of messenger communication is no longer visible. First, it is examined which data sources are available and which data can be technically secured. Only then can a reliable assessment be made as to whether reconstruction is still possible.

Case 3: Confidential development data may have been copied.

A company notices unusual activity on an employee's laptop before they leave. The investigation focuses on the relevant time period and correlates file activity, external storage devices, and other system artifacts. Individual technical events are not prematurely interpreted as evidence of a data breach.

How does an IT forensic investigation proceed in Ingolstadt?

1. Define the research question

First, it is clarified which technical issue needs to be addressed. The more precise the question, the more targeted the investigation can be.

2. Determine relevant devices

It will be checked whether a smartphone, computer, data storage device, backup or other data sources are needed to answer the question.

3. Consider the condition of the equipment

An encrypted computer that is switched on may require a different procedure than a PC that is switched off. The options also vary for smartphones depending on the model and system state.

4. Securely back up data

The appropriate security method is selected and documented based on the specific object under investigation.

5. Analyze relevant traces

The data obtained are specifically evaluated for artifacts relevant to the research question and, if necessary, correlated with each other over time.

6. Evaluate results professionally

Technical findings are examined for their actual significance. Alternative explanations and technical limitations are taken into account.

7. Document the examination

Depending on the assignment, the results will be recorded in a comprehensible technical documentation or a more detailed expert report.

What should you avoid before a forensic examination?

Especially in cases of potential unauthorized access or deleted data, well-intentioned actions can complicate subsequent investigations.

• Do not hastily reset a suspicious smartphone to factory settings.
• Do not attempt to delete suspected spyware yourself.
• Do not install any "anti-spy" or cleanup programs.
• WhatsApp Do not unnecessarily reinstall for relevant deleted messages.
• Do not overwrite existing backups.
• Avoid using computers with potentially deleted data unnecessarily.
• Do not restart an evidence PC that has already been switched off, solely for the purpose of reviewing it.
• Do not reflexively shut down a running encrypted computer in the event of a relevant incident.
• Document any anomalies, error messages, and relevant timestamps.

IT forensics in the Ingolstadt and Upper Bavaria area

Our area of ​​operation includes not only Ingolstadt but also the surrounding region with Eichstätt, Neuburg an der Donau, Pfaffenhofen an der Ilm, Schrobenhausen, Manching, Gaimersheim, Kösching and other places in the region.

Due to its location between several important Bavarian economic and technological areas, there are also close regional connections to Munich , Augsburg and Nuremberg.

This allows both private investigations and more extensive corporate matters to be handled regionally and, if necessary, nationwide.

Frequently asked questions about IT forensics in Ingolstadt

Can I have my mobile phone checked for unauthorized access in Ingolstadt?

Yes. Depending on the smartphone and available database, clues regarding relevant applications, account connections, configurations, and other technical anomalies can be investigated.

Is it possible to determine if my phone has been hacked?

A forensic investigation can search for technically available evidence of a compromise. However, there is no guarantee that every possible or past attack can be proven.

Can an ex-partner still have access to my smartphone?

Technically, various access methods are possible. Besides malware, known login credentials, linked accounts, or devices that are still authorized are conceivable.

Can deleted WhatsApp messages be recovered?

This depends on the device, database status, available backups, and subsequent usage. A general recovery guarantee is not possible.

Can a Windows PC be forensically examined?

Yes. Depending on the question being asked, file systems, user activities, system information, browser data and traces of external devices can be examined, among other things.

Can a Mac also be examined?

Yes. Apple computers can be forensically examined. Hardware generation, macOS version, APFS, and FileVault can influence the appropriate backup method.

Is it possible to determine if a USB stick was connected?

Under certain conditions, a computer may contain information about connected USB devices. However, the connection alone does not prove that specific files have been copied.

Is it possible to determine if files have been stolen?

Depending on the available data, various technical traces can indicate a potential data leak. For a reliable assessment, several matching artifacts should be examined.

Can a smartphone be completely copied bit by bit?

With modern smartphones, a classic, full sector-by-sector backup is often not possible. The actual amount of data that can be recovered depends on the device, operating system, security status, and extraction method.

Is a screenshot considered digital evidence?

A screenshot can document relevant information, but it lacks the same technical depth as the underlying original data source. For more comprehensive authentication, the original device or data set is usually more informative.

Is a software report already a forensic report?

No. Forensic software supports the extraction and analysis of technical data. An expert report, however, requires a defined research question, a comprehensible methodology, expert review, and proper interpretation.

How much does mobile phone or computer forensics cost in Ingolstadt?

The effort required depends on the type of device, the number of data sources, technical accessibility, the amount of data, the research question, and the desired documentation. For more complex cases, the scope of the investigation should therefore first be defined by a specialist.

Preserving digital traces early

In cases of unauthorized access, deleted messages, or suspicious activity on a computer, the state of existing data can be crucial. Further use, reinstallation, resetting, or independent cleanup attempts can alter relevant traces.

For an initial assessment, the affected device, the specific anomaly, the relevant time period, and any changes that have already occurred are particularly important. From this, it can be determined which forensic securing and examination measures are appropriate for the specific case.

Further specialist information on smartphones, computers, digital evidence and investigation methods can be found in our knowledge database on digital forensics.