A smartphone suddenly behaves unusually, private information becomes known to another person, or important messages are deleted. In companies, on the other hand, conspicuous file activity, suspicious user accounts, or the potential leakage of research and business data can be grounds for a technical investigation.

For clients in Würzburg, we examine smartphones, computers, data storage devices, and other digital evidence with the aim of separating technical facts from assumptions. Especially in private cases, the goal is often not to extract as much data as possible, but to answer a specific question: Is there evidence of unauthorized access? Are there still digital connections to a former partner? Is deleted communication data still technically relevant? What information can be reliably secured?

Würzburg possesses a unique scientific and economic context. Research and development, life sciences, medical technology, computer science, and materials and surface technologies are key sectors of the city. This means that, in addition to traditional company data, research findings, technical documentation, and digital know-how can also be subject to forensic investigation.

IT forensics in Würzburg – what can actually be clarified technically?

Digital forensics begins with a verifiable question. An unknown login doesn't prove who actually accessed an account. A connected USB stick isn't automatic proof of data theft. And unusual battery drain on a smartphone isn't proof of spyware.

Therefore, relevant artifacts are evaluated in context. Depending on the circumstances, system information, apps, user accounts, timestamps, file system data, messenger artifacts, connected storage devices, or other technical information can be compared.

A reliable study must also openly identify what cannot be reliably determined based on the available data.

Mobile phone forensics for private individuals in Würzburg

Smartphones now contain a significant portion of personal communication and digital identity. WhatsApp and other messaging apps, photos, emails, contacts, user accounts, cloud services, and app data can contain relevant evidence in cases of private conflicts or security breaches.

Typical questions from private customers are:

• Does another person have access to my smartphone?
• Are there any indications of technical manipulation or spyware?
• Are unknown devices connected to my accounts?
• Can my former partner still access personal data?
• Can deleted WhatsApp messages be examined?
• Can deleted photos or other files still be recovered?
• How can digital evidence be secured for a legal dispute?

Which data is technically accessible depends on factors such as device model, operating system, encryption, security status, and available extraction methods. Our article " What is Smartphone Forensics?" explains the basics.

Phone hacked or monitored – not every suspicion means spyware

Many victims initially suspect a hidden surveillance app. However, much simpler access methods may also be relevant.

Known passwords, still-authorized tablets or computers, linked messenger devices, jointly set up Apple or Google accounts, and cloud synchronizations can result in information remaining accessible.

Therefore, an investigation should not be limited to searching for specific malware. Depending on the device, applications, permissions, user accounts, system artifacts, and other technical information can be examined.

Digital access after separation or relationship conflict

Especially after a breakup, previously shared digital structures can become problematic. A former partner may know login credentials, an old device may still be authorized, or a shared account may be synchronizing data.

Therefore, the first step is to clarify which digital access methods are realistic. Only then can a decision be made as to whether only the smartphone or also accounts and other devices should be included in the investigation.

This approach also helps to avoid unnecessary evaluations of personal data.

Technical analysis of WhatsApp messages

WhatsApp communication can be relevant in cases of breakups, threats, fraud, private disputes, or legal battles.

A forensic analysis is not limited to the visible chat text. Depending on the available data, messages, timestamps, participant information, media, documents, group information, and other technical artifacts can be examined.

A screenshot has a different technical significance than a verifiably secured original data source. For a more in-depth evaluation, the original smartphone or a suitable backup is therefore usually more informative.

Further details can be found in our knowledge article "Forensic analysis of WhatsApp messages".

Deleted WhatsApp messages – what might still be there?

Deleted communication is not automatically lost completely. However, it also cannot be reliably promised that every deleted message can be recovered.

Crucial factors include the device, operating system, WhatsApp version, database state, existing backups, and continued use after deletion. An older backup can also be relevant if it contained messages missing from the current data.

Therefore, if important information has been deleted, WhatsApp should not be reinstalled prematurely and the smartphone should not be reset if possible.

Deleted photos, videos, and documents

Other personal data may also be subject to investigation. However, modern smartphones use encrypted flash memory and complex storage mechanisms.

This significantly differs the possibilities from those of traditional hard drives. Therefore, in addition to the device itself, existing backups, cloud synchronizations, or other connected systems can also be important.

iPhone and Android forensics

iPhones and Android smartphones require a different technical approach. For Apple devices, the model, iOS version, device condition, and security configuration, in particular, influence the investigation possibilities.

With Android, there are significant differences between manufacturers, chipsets, operating system versions, and patch levels. Therefore, the backup and extraction method is determined individually for each device.

For more in-depth information, see iPhone forensics and Android forensics.

Computer forensics – reconstructing digital activities chronologically

A computer can contain numerous traces that are not immediately visible during normal use. Depending on the operating system, file system information, user activity, browser data, connected devices, and other system artifacts can be relevant.

The timing is often particularly important. When was a file opened or modified? What other events occurred during the same period? Was an external storage device connected? What other traces are related to this process?

Our knowledge article "What is Computer Forensics?" explains this in more detail.

Phishing, smishing and digital fraud

After receiving a fraudulent text message, email, or visiting a website, there is often concern that the entire smartphone or computer has been compromised.

For a technical assessment, the actual sequence of events must first be reconstructed: Which message was received? Which link was opened? Were login credentials entered? Was a file downloaded? What unusual events occurred afterward?

Depending on the circumstances, SMS messages, emails, browser data, downloads and other technical traces may be relevant for documenting the incident.

Digital evidence for lawyers and court proceedings

Anyone who intends to use digital information later in a legal dispute should not only pay attention to its visible content. The origin, storage method, and technical classification can be equally relevant.

For suitable datasets, cryptographic hash values ​​can be used to verify their continued integrity. However, a hash value proves neither the truth of the content nor which person performed a specific action.

Our knowledge article on the integrity of digital evidence explains the limitations and possibilities.

Würzburg as a research, medical and technology location

Würzburg boasts a unique combination of university, research, medicine, life sciences, and technology-oriented industry. Research priorities include experimental biomedicine, medical technology, materials science, structural and surface technologies, as well as computer science and business informatics.

This raises specific questions for digital forensics. Research data, test setups, technical documentation, project information, personal data, and intellectual property can have considerable scientific and economic value.

Such data is often not stored on just one computer. Workstations, laptops, mobile devices, storage media, and other data sources can document different parts of a process.

Forensic examination of research and development data

In research and development, data is often generated over extended periods. Files are versioned, modified, exchanged between workstations, and processed on different systems.

In cases of suspected data breach, the mere presence of a specific file is therefore not the only relevant factor. File system information, timestamps, user activity, and external storage media can also be important for reconstruction.

However, a technical finding should not automatically be interpreted more strongly than the data allows. For example, the fact that a file has been opened does not prove that it has been shared with a third party.

IT forensics for companies and institutions in Würzburg

Typical business-related questions might include:

• Was confidential business or project data copied?
• What external storage media were used?
• Were there any unusual file activities prior to a change of employer.
• Has a user account been used without authorization?
• Has research or development information possibly been leaked?
• Which systems were affected by a cyber incident?

The scope of the investigation should be tailored as closely as possible to the specific research question. Especially with research, health, or personnel data, a targeted investigation is regularly more useful than an undifferentiated analysis of large datasets.

Data theft during termination or employee change

Processes surrounding termination of employment, suspension, or a move to a competitor can be particularly sensitive. If there are concrete indications of unusual file activity, it should be clarified early on which systems need to be preserved as potential evidence.

Workplace computers, company mobile phones, notebooks, external data storage devices and other data sources can contain various technical traces.

The evidence that a USB stick was connected is only one part of the finding. Whether specific files were actually transferred must be assessed based on additional artifacts.

Cyber ​​incidents – investigate technical causes instead of just visible consequences

A cyber incident often requires a rapid response. At the same time, existing system states and logs can provide crucial clues about what happened.

A hasty reinstallation can alter evidence. Conversely, a compromised system should not be unnecessarily operated solely for forensic reasons.

Therefore, hazard prevention and evidence preservation must be coordinated depending on the situation.

Forensic data backup – quality is determined before analysis.

Powerful analysis software cannot fully compensate for inadequate data backup later on. Therefore, the first step is to determine how the respective object of investigation can be effectively backed up.

Smartphones, SSDs, traditional storage media, and modern computers have different technical requirements. Not every type of backup is possible or advisable for every device.

Further basic information is explained in our knowledge article "Forensic Data Backup".

Our forensic software – different tools for different data sources

We use several specialized systems for examining smartphones, computers, and data storage devices. The choice of tools depends on the device, operating system, and specific question being investigated.

Cellebrite Inseyets

Cellebrite Inseyets particularly supports the structured analysis of mobile data. Depending on the smartphone and the available extraction capabilities, relevant artifacts can be specifically examined and correlated.

Cellebrite Digital Collector

Digital Collector is used for suitable computer and data carrier acquisitions. The approach depends, among other things, on hardware, operating system, encryption, and the investigation objective.

Cellebrite Inspector

Inspector enables further analysis of computer forensic data sets and supports the structured evaluation of relevant artifacts within large data sets.

X-Ways Forensics

X-Ways Forensics is used for detailed investigations of file systems, data carriers, partitions and other computer forensic structures.

MOBILedit Forensic and MEFF 3 Pro

MOBILedit Forensic and MEFF 3 Pro complement mobile forensics and, depending on the device, enable additional technical analysis methods.

The number of programs is not the deciding factor. Software extracts and structures data. Only the expert evaluation determines the actual significance of an artifact for the specific research question.

Certified processes and expert assessment

LB Detektive GmbH has a quality management system certified by TÜV NORD according to DIN EN ISO 9001, the scope of which includes IT forensics . In addition, the expert is certified according to DIN EN ISO/IEC 17024.

The two levels must be distinguished. DIN EN ISO 9001 concerns defined organizational quality processes; certification according to DIN EN ISO/IEC 17024 concerns the proven competence of the certified person.

For clients, transparent processes, controlled handling of evidence, and technically understandable documentation are particularly relevant.

Three typical examination situations in Würzburg

Private: Still have access after a breakup?

Another person appears to still have access to private information. Instead of immediately assuming spyware, possible access points are narrowed down to smartphones, user accounts, cloud connections, and connected devices.

Private: Deleted communication becomes legally relevant

An important messenger history is no longer fully visible. First, we will examine which data sources are still available and which technical extraction methods are feasible. Only then can we reliably assess the prospects for reconstruction.

Research or business environment: Confidential data may have been leaked.

Within a defined timeframe, unusual file activity is detected. Instead of immediately concluding that this indicates a data breach, relevant systems, user activity, and external storage devices are examined in context.

How does an IT forensic investigation proceed?

1. Define the research question

At the beginning, it is defined which digital process actually needs to be clarified.

2. Select data sources

Only devices, storage media, or accounts with a direct connection to the question at hand will be included.

3. Secure data properly

The backup method is adapted to the device, operating system, encryption, and technical condition.

4. Analyze digital traces

Relevant artifacts are classified technically and chronologically and, if necessary, compared with other data sources.

5. Document results

Depending on the assignment, the findings can be compiled in an investigation report or an expert documentation.

What should be avoided before an examination?

• Do not hastily reset a potentially compromised smartphone.
• Do not remove suspicious apps manually.
• Do not reinstall WhatsApp if relevant data has been deleted.
• Do not install any unknown spyware or cleanup programs.
• Do not overwrite existing backups without careful consideration.
• Do not unnecessarily modify computers or data storage devices if there is a concrete suspicion of data leakage.

IT forensics in Würzburg and our areas of operation in Mainfranken

Our area of ​​operation includes Würzburg, Schweinfurt, Kitzingen, Ochsenfurt, Karlstadt, Marktheidenfeld, Bad Kissingen, Lohr am Main, Wertheim, Tauberbischofsheim, Bamberg and other towns and municipalities in Mainfranken and Unterfranken.

Due to Würzburg's location between Main-Franconia and the Franconian economic regions, there are also close connections to Nuremberg . Clients from the region can have individual smartphones and computers examined, as well as more complex cases involving multiple digital pieces of evidence.

Frequently asked questions about IT forensics in Würzburg

Can I, as a private individual, have my smartphone examined?

Yes. Common private inquiries concern unauthorized access, suspected spyware, deleted messages, user accounts, or digital evidence for personal and legal disputes.

Is it possible to determine if someone has access to my phone?

Existing technical traces of possible access routes can be examined. Whether a specific access can be proven depends on the device, the possible access route, and the data still available.

Can my former partner access my data without spyware?

Yes. Known login credentials, still-authorized devices, cloud accounts, or existing synchronization connections can provide alternative access methods.

Can deleted WhatsApp messages be examined?

Under certain circumstances, data or technical artifacts may still be present. However, a complete recovery cannot be guaranteed.

Can research or development data be forensically examined?

Yes. A precise question is crucial so that relevant systems and data sources can be specifically investigated.

Can it be proven whether a USB stick was used?

Under certain circumstances, computer systems can contain traces of connected USB devices. However, proof of the connection does not automatically prove the transfer of specific files.

Can cyberattacks be analyzed retrospectively?

This may be possible if suitable end devices, account information, logs or other relevant data sources are still available.

Is a software report already considered an expert opinion?

No. A software report presents extracted or structured data. An expert assessment additionally requires a defined question, technical interpretation, and a comprehensible derivation of the findings.

Which devices can be examined?

Depending on the question, smartphones, Windows PCs, Macs, notebooks, hard drives, SSDs, USB storage devices and other digital systems may be relevant.

How much does an IT forensic investigation cost in Würzburg?

The effort required depends on the research question, the number of devices, the amount of data, technical accessibility, and the desired documentation. Therefore, in more complex cases, the actual scope of the investigation is first defined.

IT forensics Würzburg - confidential inquiry

For an initial assessment, the affected device or system, the specific abnormality, the relevant time period, and any changes already made are particularly important. This information helps to determine the appropriate scope of the investigation.

Further understandable explanations on smartphone, messenger and computer forensics as well as on digital evidence preservation can be found in our knowledge database.