What actually happened on a smartphone, computer, or user account? This question is often the starting point of a digital investigation. LB Forensik investigates digital traces for clients from Rosenheim when communication has been deleted, unauthorized access is suspected, files have disappeared, or technical processes need to be reconstructed for a private, business, or legal matter.

Smartphones, Windows and macOS systems, hard drives, SSDs, external storage devices, existing backups, and accessible cloud data can all constitute relevant sources of evidence. The goal is not to gather the largest possible amount of data, but rather to obtain a comprehensible answer to the specific investigative question.

For technical data preservation and analysis, LB Forensics has various specialized tools at its disposal. Depending on the device, operating system, and investigation objective, we use, among others, Cellebrite, X-Ways Forensics, Belkasoft, and MOBILedit Forensic . Relevant findings are not evaluated solely based on software displays, but rather on the underlying digital artifacts.

Digital forensics in Rosenheim at a glance

• Forensic examination of Apple iPhones and Android smartphones
• Computer forensics for Windows and Apple macOS
• Analysis of WhatsApp and other digital communication
• Investigation of deleted or no longer visible data
• Examination for technically detectable indications of unauthorized access and compromises
• Analysis of hard drives, SSDs, USB sticks and other data storage devices
• Examination of existing backups and accessible cloud data
• Reconstruction of user, file, and system activities
• Temporal assignment and correlation of multiple digital traces
• Comprehensible documentation of security, analysis and technical findings

We also provide fundamental and in-depth specialist information in our knowledge database on digital forensics . There, individual procedures, technical terms, and typical evidentiary issues are explained separately and in detail.

What questions can IT forensics answer?

Digital forensics ideally doesn't begin with the instruction to "search everything." A clearly formulated question helps to narrow down relevant devices, time periods, and data sources, and to correctly evaluate technical findings.

In a private case, for example, it might be relevant whether deleted messages still exist. In a company, on the other hand, it might be necessary to investigate whether an external storage device was connected or whether a file was shared via a specific transmission method.

Possible research questions include:

• Were messages, files, or other data deleted?
• Are there any technical indications of unauthorized access?
• When was a specific file created, opened, modified, or deleted?
• What activities took place within a specific time frame?
• Was a USB stick or other external storage device used?
• Can messenger communication be analyzed using the original data?
• Are there any indications of a possible data breach?
• Can information from smartphones, computers, and the cloud be synchronized?
• What conclusions can an existing digital artifact actually draw?

Smartphone forensics in Rosenheim

Smartphones store communication data, media, app data, and numerous technical details in a very small space. At the same time, a significant portion of forensically relevant data is not immediately visible in the user interface.

Depending on the device, messages, call information, contacts, app databases, browser artifacts, photos, videos, files, time information, system data, and certain location and connection artifacts can be examined.

The information that is actually accessible depends, among other things, on the model, operating system version, security status, encryption, and available extraction method.

iPhone forensics for Rosenheim

With an Apple iPhone, the hardware, iOS version, device condition, and cryptographic security mechanisms all influence the possible investigation methods. Therefore, the achievable extraction depth cannot be reliably assessed based solely on the model name.

Depending on the initial situation, messages, app data, photos, videos, browser information, files, timestamps, system artifacts, and other information can be examined. Local backups or accessible iCloud data can also represent additional data sources.

A key component of a professional investigation is to distinguish between existing data, reconstructed information, and the interpretation drawn from it.

Technical background information on Apple's security architecture, extraction methods, and investigation limits is explained in the article " What is iPhone forensics?".

Android forensics for different manufacturers

Android is not a unified technical system. Samsung, Google, Honor, Xiaomi, and other manufacturers use different hardware and security configurations. The Android version, security patch, and device condition can also affect the available extraction methods.

Depending on the device, information such as messenger data, app databases, files, media, browser information, system artifacts and other usage information can be examined.

Using multiple forensic solutions can be useful if different tools access different data structures or if results need to be professionally cross-checked.

Examine WhatsApp and Messenger communication

In private conflicts, fraud cases, business disputes or criminal matters, messenger communication can represent a central source of data.

A forensic analysis is not limited to the visible chat. Depending on the data available, messages, timestamps, contacts, participants, group structures, images, videos, documents, voice messages, and other app artifacts may be relevant.

What should you keep in mind when taking WhatsApp screenshots?

A screenshot initially only documents a visible representation. It does not automatically contain the underlying message database, internal time information, or other artifacts of the original device.

If the original device or a suitable extraction is available, additional technical information can be used for comparison.

Can deleted WhatsApp messages be recovered?

This may be possible under certain technical conditions. However, a complete restoration cannot be guaranteed.

Relevant sources may include existing database information, backups, media holdings, or other connected data sources. Whether a complete, partial, or no reconstruction is possible will only become clear after examining the specific data set.

Computer forensics Rosenheim for Windows and macOS

Computers leave technical traces with almost every use. Programs are launched, files are opened, users are logged in, storage devices are connected, data is downloaded, and applications are synchronized with cloud services.

These activities can leave behind various artifacts. Depending on the research question, the following data sources, for example, may be suitable:

• File systems and file structures
• File metadata and timestamps
• Deleted files and remaining file artifacts
• User accounts and login information
• Browser history and downloads
• USB devices and external storage media
• Program and application traces
• System and event logs
• local cloud and synchronization artifacts
• further operating system information

Often, the real insight only arises from combining several artifacts. For example, the fact that a USB stick has been plugged in does not necessarily mean that specific files have been transferred to that storage device.

Further basic information can be found under What is computer forensics?.

Recover deleted files and data

Whether deleted data is still available depends heavily on the specific storage system. A traditional hard drive, a modern SSD, and the flash memory of a smartphone behave differently after a deletion process.

The file system, encryption, memory cleanup, time of deletion, and subsequent device usage all influence which information can still be reconstructed.

Therefore, a device that may be relevant as evidence should not be used unnecessarily or processed with any data recovery or cleanup software.

IT forensics for private individuals in Rosenheim

Private clients often require digital forensics in situations where personal and legal issues intersect. A smartphone or computer can then contain relevant information that cannot be reliably assessed through a normal review.

Typical occasions include:

• deleted or disputed communication
• Suspected unauthorized access to smartphone or computer
• fraud cases
• Stalking and harassment
• Separation or divorce
• Dispute over digital messages or files
• Securing relevant data before legal proceedings
• Unexplained changes to devices or user accounts

Has my smartphone been hacked or monitored?

Unusual behavior of a smartphone is not proof of a compromise. High battery consumption, heat generation, unknown notifications, or increased data traffic can have various causes.

A forensic investigation should therefore be conducted without prejudice. Depending on the device, system information, apps, configurations, profiles, communication data, and other technical artifacts can be examined.

Even a negative finding has its limits. If no evidence of a compromise is found within the available data, this does not necessarily mean that an attack did not occur at an earlier time.

Digital evidence in cases of separation and divorce

In private disputes, it is particularly important to distinguish between technical access and legal authorization.

LB Forensics only examines devices, user accounts, and data sets for which it has the appropriate authorization. Secretly accessing someone else's smartphone or accounts is not a permissible forensic service.

IT forensics for companies in Rosenheim

Rosenheim and the surrounding region are characterized by medium-sized businesses, services, trade, crafts, and supra-regional economic relationships. Digital incidents can therefore affect individual desktop computers as well as mobile devices, user accounts, external storage, and cloud applications.

Companies commission digital investigations, for example, in cases of suspected data leaks, internal employee cases, deleted company information, unauthorized copying, or after an IT security incident.

Suspected data theft or data leak

For the technical assessment of a potential data breach, a single artifact is often insufficient. A connected USB drive does not prove a copying operation, and an existing file does not necessarily indicate that it has been shared.

Depending on the circumstances, file accesses, external storage devices, cloud applications, browser activities, email data and other system information can therefore be compared.

IT forensic investigation following a cyber incident

Following a suspected attack, system logs, user activity, suspicious files, persistence mechanisms, network clues, and other technical artifacts can be examined.

In an ongoing incident, it must be considered that containment and evidence preservation can have different requirements. A running, encrypted computer can present a different forensic situation than a switched-off system.

Forensic analysis with Cellebrite

Cellebrite provides specialized methods for extracting and analyzing mobile and other digital data sources. Which method can be used in a specific case depends, among other things, on the device, operating system, and security status.

The technical extraction is only one part of the investigation. The crucial factor is the correct interpretation of the data obtained.

X-Ways Forensics for Computers and Data Storage Devices

We use X-Ways Forensics particularly for detailed investigations of computers, hard drives, SSDs and other data storage devices.

The tool enables, among other things, the examination of file system structures, files, metadata, deleted data, and other technical information. For complex issues, a highly targeted analysis of individual storage areas and artifacts can be performed.

Belkasoft for the correlation of digital artifacts

Belkasoft supports the structured analysis of various digital data sources. Especially with larger datasets, combining relevant artifacts can help to reveal relationships and temporal connections.

MOBILedit Forensic for mobile devices

MOBILedit Forensic expands our capabilities for extracting and analyzing data from mobile devices. This is particularly relevant given the technical diversity of different Android manufacturers and device models.

Why don't we just use a forensic program?

Forensic software interprets data. Therefore, different tools may recognize or display the same data set differently.

One program might be particularly good at processing certain app artifacts, while another might make additional file system information or metadata available. Therefore, in relevant cases, an additional method can serve as a technical cross-check.

The original data source always remains crucial. An automatically generated software display does not replace a professional evaluation.

How are digital evidence secured?

The appropriate procedure depends on the state of the device. A switched-off storage device, a switched-on smartphone, and a running encrypted computer do not automatically require the same backup method.

Where technically feasible, a suitable backup of the relevant data is created first. Further analysis can then be based on this backup, thus avoiding unnecessary changes to the original.

What does a hash value tell us?

A hash value can be used to verify the integrity of a specific digital dataset. If corresponding hash values ​​match, it is possible to check whether this data has been modified since a defined point in time.

However, a hash value does not automatically indicate that an extraction was complete or that a professional interpretation is correct. Integrity, completeness, and validity must be assessed separately.

Why is the handling of evidence documented?

In investigations relevant to evidence, it should remain traceable which device or data carrier was taken over, what condition it was in, what backup was carried out and on what data basis the analysis was performed.

This allows technical findings to be clearly assigned to a data source and a documented investigation step later on.

From investigation order to technical report

Define the question and time period

First, the process to be investigated and the time period to be considered are defined. This determines the relevant devices and data sources.

Capture the technical initial state

The device, operating system, security status, encryption and available access options are taken into account.

Prioritize and secure data sources

When dealing with multiple devices, the order of backups can be relevant. The method depends on the specific condition and the objective of the investigation.

Targeted analysis of artifacts

The analysis is guided by the research question. Files, databases, communication information, and system traces are not examined indiscriminately, but rather in a factual manner.

Reconstructing technical relationships

If multiple independent data sources are available, they can be compared with each other in terms of time and content.

The determination and interpretation differ

A technically sound documentation separates the directly established technical finding from the conclusions drawn from it and identifies the limits of the available data.

IT forensics in the Rosenheim area and southeastern Upper Bavaria

Rosenheim forms a central hub between Munich , the Chiemgau region, the Inn Valley, and southeastern Upper Bavaria. Its immediate regional surroundings include Kolbermoor, Bad Aibling, Raubling, Stephanskirchen, Prien am Chiemsee, Wasserburg am Inn, and Traunstein.

Proximity to Munich is also relevant for regional support. LB Forensik has a branch in Munich, which serves as an important regional contact point for clients from Rosenheim.

Further information about the location can be found at IT Forensics Munich . Another branch is located in Augsburg.

The other locations mentioned are solely for regional classification. No branch office is claimed to exist there.

What should be avoided before a forensic examination?

A potentially problematic smartphone should not be reset prematurely. Suspected malware or unknown apps should also not be deleted independently if their origin or activity is to be investigated later.

Data recovery, cleanup, and so-called anti-spy programs can also create new files and logs or modify existing data.

A computer that has already been switched off should not be started normally for the sole purpose of initial inspection. The startup of the operating system itself causes technical changes.

Conversely, immediately switching off the device is not always the correct approach. With a running encrypted system, the current device state can be relevant for later access to certain data.

FAQ about IT forensics in Rosenheim

Can LB Forensics examine smartphones belonging to private individuals from Rosenheim?

Yes. Private individuals are explicitly among our clients. Depending on the issue, we can examine smartphones, computers, data storage devices, existing backups, and accessible cloud data.

Is it possible to check if my iPhone has been hacked?

An investigation can look for technically detectable indications of possible unauthorized access or compromise. The conclusions that can be drawn depend on the device, the available data, and the achievable depth of investigation.

Can deleted WhatsApp messages be recovered?

This is possible under certain conditions. A complete recovery cannot be guaranteed because it depends on the device and the data that is actually still present.

Is it possible to determine when a file was deleted?

Depending on the file system and the existing data, timestamps, file system information, and other artifacts can provide clues to a deletion or modification process. However, not every process can be reconstructed down to the second.

Can a USB stick be traced to a company computer?

Windows and other systems can contain traces of connected storage media. However, the presence of a connection alone does not prove any actual data transfer.

Can a WhatsApp screenshot be checked for manipulation?

A screenshot can be technically analyzed, but on its own has limited significance. If the original device or a suitable additional data source is available, further artifacts can be used for comparison.

Can smartphones and computers be used to analyze data together?

Yes. If multiple data sources relate to the same issue, relevant artifacts can be considered together and correlated with each other over time.

Can IT forensics definitively determine who has used a computer?

Not in every case. Digital traces can be linked to a device, user account, or technical process. This does not automatically imply which natural person actually operated the device.

What software does LB Forensics use?

Depending on the data source and the question being asked, we use tools such as Cellebrite, X-Ways Forensics, Belkasoft and MOBILedit Forensic.

Does LB Forensik have a branch in Rosenheim?

No branch in Rosenheim is listed. The regionally relevant LB forensics branch is located in Munich. There is also a branch in Augsburg.

Should a suspicious smartphone be switched off?

There's no single answer to that. With modern encrypted smartphones, the current device state can influence forensic possibilities. Before restarting or switching off the device, the specific situation should be assessed using technical methods.

What information helps with the initial assessment?

Particularly important are the device type, model, operating system, relevant time period, known abnormalities, measures already taken, and the specific question that the investigation is intended to answer.