Digital traces often emerge long before it's even clear that they will later be needed for an investigation. An iPhone stores communication and system information, a Windows computer documents user and file activity, and a cloud service can contain additional data. LB Forensik examines digital data on smartphones, computers, storage media, backups, and accessible cloud systems for private individuals, companies, and lawyers in Regensburg.

The focus is on a specific technical question. Were messages deleted? Did another person possibly access a smartphone? When was a file used or modified? Was company data copied to an external storage device? Can events from multiple devices be linked chronologically? IT forensics attempts to reconstruct such processes based on existing artifacts, without drawing conclusions from individual technical findings that go beyond what the data itself allows.

Specialized forensic systems are available for securing and analyzing evidence. Depending on the device, operating system, and investigation objective, we use tools such as Cellebrite, X-Ways Forensics, Belkasoft, and MOBILedit Forensic . No single tool covers all data sources equally well. Therefore, if relevant findings are identified, cross-checking with another method may be advisable.

IT forensics for Regensburg: Areas of investigation at a glance

• Mobile phone forensics for Apple iPhones and Android smartphones
• Computer forensics for Windows PCs, notebooks and Apple Macs
• Analysis of WhatsApp and other digital communication
• Examination of deleted and not immediately visible data
• Check for technically detectable evidence of unauthorized access
• Analysis of hard drives, SSDs, USB sticks and other storage media
• Evaluation of existing backups and accessible cloud data
• Reconstruction of relevant file, user, and system activities
• Investigation of potential data leaks and internal incidents
• temporal correlation of traces from multiple digital data sources
• Forensic preservation of defined data sets
• Comprehensible documentation of evidence and investigative steps

We also explain the technical basics and further questions in our knowledge database on digital forensics . There, individual methods and data sources are addressed separately, so that the regional service page does not unnecessarily repeat the same content.

What digital traces can be examined?

Digital forensics doesn't just examine visible files. Operating systems, apps, and applications generate additional information during their use that may later be relevant for reconstructing an event.

Depending on the system, this includes, for example, app databases, communication information, file metadata, browser artifacts, user logins, system logs, connected storage devices, cloud synchronizations and time-related system information.

Which of these traces are actually informative depends on the question being investigated. Different artifacts are relevant when investigating suspected data leakage than when determining whether a specific message was present on a smartphone or when a file was last used.

Mobile phone forensics for Regensburg for iPhone and Android

Mobile phone forensics in Regensburg deals with digital traces on smartphones and the associated data sources. Modern mobile devices often contain a significant portion of a person's private or business communication. Messengers, photos, videos, apps, browser data, and user accounts reside on a single device and can be technically interconnected.

A forensic smartphone examination therefore goes beyond simply manually reviewing the visible content. Depending on the device and available data, app databases, messages, media, files, call information, timestamps, and certain system, location, and connection artifacts can be examined.

The data that is available depends on the manufacturer, model, operating system version, security status, encryption, and technically possible extraction method.

iPhone forensics on Apple devices

With an Apple iPhone, hardware, iOS, and cryptographic protection mechanisms work closely together. Therefore, it cannot be reliably guaranteed before a technical examination that all data from an iPhone can be read.

Depending on the device's state, data such as messages, app data, photos, videos, files, browser information, timestamps, and other system artifacts may be available. Local backups and authorized iCloud data can also represent additional data sources.

The current state of the device can be of particular importance. A powered-on iPhone that has already been unlocked since the last restart can offer different forensic possibilities than the same device immediately after a restart.

Further technical background information can be found in the published article "What is iPhone forensics?".

Android forensics for Samsung, Google, Honor and other manufacturers

Android smartphones do not constitute a technically uniform system. Manufacturer, model, chipset, Android version, and security patch significantly influence the possibilities of forensic data recovery.

Depending on the device, messenger data, app databases, files, images, videos, browser information, system artifacts and other usage information may be relevant.

Especially with Android devices, choosing the right tool is crucial. Different forensic solutions may support different extraction methods or data areas, depending on the manufacturer and device.

Technical analysis of WhatsApp communication

Messenger data can become relevant in private conflicts, fraud cases, stalking, employment law matters, or internal company investigations. WhatsApp is regularly among the most important mobile data sources in these cases.

A forensic WhatsApp analysis is not limited to reading a visible chat. Depending on the data available, messages, participant information, group structures, timestamps, images, videos, documents, voice messages, and other app artifacts can be analyzed.

We explain the technical possibilities in more detail under "Forensic analysis of WhatsApp messages".

Deleted messages: What can still be recovered?

A deleted WhatsApp message cannot be automatically recovered. Whether usable artifacts remain depends on factors such as the operating system, app version, database status, existing backups, and further use of the smartphone.

Under suitable conditions, database information, media, backups, or other data sources can enable a complete or partial reconstruction. However, a guarantee of recovery would not be technically sound.

Even a negative finding must be interpreted correctly. If no relevant message is found in the examined database, it does not automatically follow that it never existed. It could, for example, have already been completely removed or have only existed in an unavailable data source.

Why a chat screenshot is not the same as a forensic extraction

A screenshot merely documents the visible display on a screen. It does not automatically contain the underlying WhatsApp database, internal identifiers, or other app artifacts.

If the original device or a suitable extraction method is available, additional technical information can be used for comparison. This allows for a significantly more in-depth examination of the database than is possible with a single image.

Computer forensics in Regensburg for Windows and macOS

Computer forensics in Regensburg examines technical traces on desktop PCs, notebooks, Apple Macs, and their associated storage media. A computer documents numerous processes during its use, although these are not necessarily immediately visible later.

Depending on the question, files, file system structures, metadata, deleted data, user accounts, browser information, program activities, system logs, external storage media and local cloud artifacts can be examined.

The most significant insights often arise from the interplay of multiple traces. A single timestamp or USB entry should therefore not be interpreted without its corresponding technical context.

We explain the methodology in more detail in the article "What is Computer Forensics?".

Can the use of a USB stick be traced?

Windows systems can store various pieces of information about connected USB devices. Depending on the data, device identifiers and temporal relationships, for example, can be determined.

The technical proof that a USB stick was connected to a computer does not, however, prove that a copying process took place. To determine whether a concrete data transfer occurred, additional artifacts must be considered.

This can include file accesses, recently used files, file system information, timestamps, and other user or system activities.

When was a file created, opened, or modified?

File systems and programs can generate various timestamps. Depending on the system, these can be used to obtain clues about creation, modification, access, or other processing operations.

However, such timestamps should not be interpreted in isolation. Copying processes, cloud synchronizations, software, and operating system processes can all influence time information. A more reliable assessment therefore considers several matching artifacts.

Deleted files, SSDs and data recovery

Whether deleted files can be recovered depends heavily on the storage medium. Magnetic hard drives, SSDs, and the flash memory of mobile devices behave differently from a technical standpoint.

With modern SSDs, data erasure mechanisms can cause deleted data to become inaccessible relatively quickly. Other factors include the file system used, encryption, the time of deletion, and subsequent system usage.

IT forensics goes beyond mere data recovery. If a file is to be evaluated as digital evidence, its origin, metadata, time reference, and other system artifacts can also be relevant.

IT forensics for private individuals from Regensburg

Digital forensics is not limited to businesses or criminal proceedings. Private smartphones and computers can contain significant amounts of relevant information in personal conflicts or legal disputes.

Private customers contact LB Forensik, for example, when unauthorized access to a smartphone is suspected, messages have disappeared, digital stalking is occurring, or communication needs to be secured and technically examined in a traceable manner for a legal question.

Suspected hacked or monitored mobile phone

High battery consumption, heat generation, unknown messages or unusual data traffic are not, in themselves, proof that a smartphone has been compromised.

A forensic investigation therefore examines, without prejudice, whether any relevant technical anomalies are actually present. Depending on the device, apps, configurations, profiles, system information, communication artifacts, and other data can be analyzed.

Equally important is the threshold of a negative finding. If no evidence of unauthorized access is found in the available data, this does not necessarily prove that a compromise did not occur at an earlier time.

Digital evidence in cases of stalking, separation, and personal conflicts

Messenger messages, files, photos, user accounts, or other digital information can become relevant in private disputes. However, technical accessibility and legal entitlement are two different issues.

LB Forensics only examines devices, accounts, and data sets for which it has the appropriate authorization. Secret access to other people's smartphones or user accounts is not a permissible forensic investigation.

Digital investigations for companies in Regensburg

Regensburg combines a strong industrial and technological base with universities, research institutions, and numerous medium-sized companies. Particularly in sectors such as the automotive industry, electrical engineering, semiconductor technology, IT, sensor technology, and other technology-oriented industries, extensive business data sets are generated.

In cases of internal suspicion or IT security incidents, several data sources can therefore become relevant simultaneously: workstations, notebooks, smartphones, external data carriers, email systems, user accounts or cloud applications.

Suspected data leak by employees

In the event of a suspected data breach, the first step should be to investigate which transmission methods are technically feasible. USB storage devices are just one possibility. Cloud storage, email, web applications, or messaging apps may also be relevant, depending on the circumstances.

A forensic investigation can therefore compare file accesses, external storage devices, browser activities, cloud artifacts, and other system information.

A single artifact should not be overinterpreted. Only when several independent traces fit together in terms of content and time can a more reliable overall technical picture emerge.

Analysis following a cyber incident

Following a suspected attack, for example, user activity, system logs, suspicious files, persistence mechanisms, network clues and other artifacts can be examined.

In an ongoing incident, containment and evidence preservation must be considered together. A powered-on and already decrypted computer can present a different forensic starting point than the same system after a restart.

Therefore, the blanket recommendation to immediately switch off every affected device is not technically correct in every case.

Cellebrite for mobile data and smartphone analytics

We use Cellebrite primarily for securing and analyzing mobile and other digital data sources. Depending on the device and security status, different extraction methods may be available.

However, the technical extraction is only the basis of the investigation. What remains crucial is which artifacts are actually present and how they are evaluated in relation to the specific research question.

X-Ways Forensics for Computers and Data Storage Devices

X-Ways Forensics enables detailed investigations of file systems, hard drives, SSDs and other storage media.

This allows for the examination of existing and deleted files, metadata, file system information, and other technical structures. Detailed file system analysis can be particularly relevant when dealing with questions about file usage, storage media, or deleted information.

Belkasoft for the correlation of different data sources

Belkasoft supports the structured analysis of digital artifacts from various sources. In more complex cases, this can help to relate communication, user activities, and other data to each other in terms of time and content.

MOBILedit Forensic as an additional method of mobile phone forensics

MOBILedit Forensic complements our capabilities for extracting and analyzing data from mobile devices. Especially given the wide range of technical specifications from different Android manufacturers, an additional extraction or analysis method can be beneficial.

Why not just one forensic program is used

Forensic tools have different strengths. One program might be particularly good at recognizing certain app structures, while another might process additional file system information or other artifacts.

In cases where relevant findings are present, a second method can therefore serve to verify their plausibility. However, the original data source always remains decisive. An automatically generated software hit is not yet a conclusive forensic finding.

Digital evidence preservation and data integrity

In an evidence-based investigation, it should remain traceable which data source was examined and on which dataset the analysis is based. The appropriate backup method depends on the specific device.

For example, under suitable conditions, a traditional data carrier can be secured differently than a switched-on smartphone or a running encrypted computer system.

Hash values ​​can be used to check the integrity of a defined dataset. However, a hash value does not automatically prove that the backup was complete or that the subsequent interpretation of a finding is correct.

Detailed technical information can be found under Integrity of Digital Evidence.

Chain of Custody: from device to documented findings

The chain of custody documents the handling of evidence. This can include the acquisition of a smartphone or computer, its unambiguous identification, the security measures taken, and other relevant transfers.

It should not be confused with technical integrity checks. A hash value verifies a defined set of data. The chain of evidence, on the other hand, documents how the object of investigation and the resulting backups were handled.

We explain the difference in detail in the published article " Chain of Custody in Digital Forensics".

How does an IT forensic investigation proceed?

Clarify the question

First, it is determined which technical process is to be investigated and which time period is relevant.

Determine relevant devices and data sources

Not every available device needs to be automatically examined. Smartphones, computers, storage media, backups, and cloud data are prioritized according to their relevance to the question at hand.

Capture initial state

Device model, operating system, security status, encryption and available access options can influence the appropriate backup strategy.

Secure data in a technically suitable manner

The data preservation method is adapted to the specific object under investigation. Where appropriate, the subsequent analysis is based on a defined data set.

Analyze relevant artifacts

Files, databases, communication information and system traces are specifically evaluated based on the previously defined research question.

Independent traces correlate

When multiple data sources relate to the same event, they can be compared chronologically and factually. This often allows for a more precise classification of an event than would be possible based on a single piece of data.

Separate findings from professional interpretation

The documentation should clearly show what technical findings were obtained, what conclusions can be drawn from them, and where the available data does not allow for a clear statement.

IT forensics in the Regensburg and Eastern Bavaria area

Regensburg is a significant economic, scientific, and technological hub in Eastern Bavaria. Digital investigations therefore affect both private devices and business IT systems in industry, technology, research, services, and medium-sized enterprises.

The surrounding region includes, among others, Neutraubling, Bad Abbach, Kelheim, Burglengenfeld, Schwandorf, Straubing, Cham, and Abensberg . These locations are mentioned here solely for geographical reference and are not presented as branches of LB Forensik.

For other areas of Bavaria, there are already independent and verified pages for IT forensics in Munich , Ingolstadt , and Augsburg.

For the specific case under investigation, the city limits are of secondary importance anyway. What matters are the available digital evidence, its condition, the relevant time period, and the technical question at hand.

What should be avoided before a forensic examination?

A smartphone that may be relevant as evidence should not be hastily reset to factory settings. Suspicious apps, messages, or files should also not be deleted independently if their origin or usage is to be investigated later.

Data recovery, cleanup, and anti-spyware programs can create new files and logs. This can alter the original data.

A computer that has already been switched off should not be restarted normally, even for a preliminary inspection. The operating system startup itself generates new activity and can modify existing artifacts.

Conversely, immediately shutting down a powered-on system is not always the right approach. Especially with encrypted devices, the current state can affect future backup options.

FAQ on digital forensics in Regensburg

Does LB Forensik also work for private individuals from Regensburg?

Yes. Depending on the specific question, private individuals can have smartphones, computers, data storage devices, existing backups, and authorized cloud data examined.

Can it be investigated whether my phone has been hacked?

A forensic investigation can look for technically detectable evidence of possible unauthorized access or compromise. What conclusions can be drawn depends on the specific device and the available data.

Can deleted WhatsApp messages be recovered?

Under certain conditions, remaining database information, backups, media, or other artifacts may allow for reconstruction. A complete recovery cannot be guaranteed.

Is it possible to determine if files have been copied to a USB stick?

Connecting a USB storage device can leave technically detectable traces. Whether a specific file transfer can be traced beyond that depends on other existing artifacts.

Can a smartphone and computer be examined together?

Yes. If multiple devices relate to the same issue, relevant information can be analyzed jointly and correlated with each other over time.

Is it possible to determine when a file was used?

Depending on the operating system and data type, file metadata, application traces, and other system artifacts can provide clues about a file's usage. However, a single timestamp should not be interpreted without technical context.

Can digital forensics definitively determine which person acted?

Not automatically. Digital artifacts can often be attributed to a device, user account, or technical process. This does not necessarily imply which natural person actually operated the device at the relevant moment.

Can a WhatsApp screenshot be technically verified?

A screenshot can be analyzed, but on its own it contains only limited technical information. If the original smartphone or a suitable extraction tool is available, additional app and communication artifacts can be used for comparison.

Which forensic software does LB Forensics use?

Depending on the device, data source and investigation objective, we use, among other things, Cellebrite, X-Ways Forensics, Belkasoft and MOBILedit Forensic.

Should a suspicious smartphone be reset or restarted?

This should not be done with a device that may be relevant as evidence without a prior technical assessment. A reset or restart can alter the available data and, in the case of modern smartphones, also the forensically relevant state of the device.