Digital evidence needs verifiable quality: How professional IT forensics must work today

Digital evidence is everywhere – but interpreting it correctly is challenging.

A smartphone can contain messages, photos, videos, contacts, app data, usage information, and numerous other digital artifacts. A computer can provide clues about user activity, connected storage media, files, programs, internet usage, and system processes. Servers, networks, and cloud environments generate further data that may be relevant in reconstructing an incident.

Modern investigative work has long since arrived in a reality where almost every complex case can have a digital component.

A company suspects the leakage of confidential design data. An employee account shows unusual activity. Files are missing after an employee leaves the company. A smartphone may contain sensitive communications. A law firm needs a technical reconstruction of certain processes. After a cyberattack, it must be determined which systems were affected and what traces can still be found.

In such situations, it is not enough to simply extract as much information as possible from a device.

The crucial questions are rather:

• Which data are relevant to the specific situation?
• Where does this data come from, technically speaking?
• How were they secured?
• Did the data being examined change during the backup or analysis process?
• What technical relationships can actually be established?
• What alternative explanations exist?
• What conclusions can be drawn from a digital artifact?
• Which statement would not be supported by the available data?

This separation between existing data and technically sound assessment is a key characteristic of professional IT forensics.

Data extraction is not yet digital forensics.

Modern forensic systems can process enormous amounts of data from computers, smartphones, and other digital systems. Messages can be categorized, files searched, timelines created, and technical artifacts automatically displayed.

This is valuable. However, it should not be confused with a completed forensic investigation.

A technical extraction first answers the question of which data could be obtained or represented using a specific method.

A forensic investigation must continue.

She must clarify the significance of individual pieces of information in relation to the specific research question.

This is relevant, for example, when determining whether:

• confidential files were copied or transferred,
• an external storage device was connected to a particular computer,
• certain user activities are technically traceable,
• Communication data reveal a concrete chronological sequence,
• Files were changed or deleted
• certain applications were used
• Cloud or synchronization processes have taken place,
• a system may have been compromised or
• multiple digital traces belonging to a single event.

Without a clearly defined research question, there is a risk of simply generating large amounts of data.

Professional digital forensics therefore does not mean extracting everything that is technically accessible. It means methodically securing, evaluating, classifying, and transparently documenting the digital information relevant to a defined case.

Forensic evidence collection begins before the actual analysis.

The quality of a digital analysis is often determined by how the original object of the analysis is handled.

Digital systems are dynamic. A running operating system modifies data. Applications write information. Smartphones communicate with mobile, Wi-Fi, and cloud infrastructures. Background processes can alter data sets. Even a seemingly harmless access can generate new system information.

Therefore, the evidence collection phase is one of the most sensitive parts of a forensic investigation.

Depending on the subject of the investigation, the following questions, among others, must be taken into account:

• Which device or data carrier was acquired?
• What condition was the object of investigation in?
• When was it acquired?
• Who handed it over?
• Which security method is technically suitable?
• Does a running system need to be treated differently than a switched-off system?
• How can the original data be protected as much as possible?
• How are working copies created?
• How is the integrity of the backed-up data checked?
• How are the individual steps documented?

There is no universal method that works for all smartphones, computers, servers and storage media.

An encrypted smartphone has different requirements than an external hard drive. A powered-on server requires different considerations than a powered-off workstation. A potential cyber incident could involve volatile information that would no longer be available after a restart.

Methodical forensics therefore begins with a technical assessment of the specific object of investigation.

Hash values: important for integrity checks, but not an automatic proof

In digital forensics, cryptographic hashing methods are frequently used to mathematically characterize data sets and to be able to control changes.

In simplified terms, a hash value can be thought of as a computationally generated characteristic value of a specific data set.

If the same data set is processed again using the same hashing method, a comparison of the hash values ​​can help determine whether the underlying data has changed.

Hash values ​​can therefore be an important component of integrity assurance.

However, they are not a magical seal of proof.

For example, a matching hash value does not automatically mean:

• that the correct object of investigation was selected,
• that the original data collection was legally permissible,
• that all relevant information was recorded,
• that a software evaluation was correctly interpreted or
• that a professional conclusion drawn from it is correct.

Hashing algorithms are a tool within a larger forensic process.

This classification is particularly important because professional IT forensics does not consist of individual technical measures, but rather of a traceable chain of securing, analyzing, evaluating and documenting.

Chain of Custody: Why a documented chain of evidence can be important

In investigations involving potentially evidentiary data, the question is not only what was technically found.

Equally relevant is what has happened to the object of investigation since its acquisition.

In this context, the term " chain of custody" or a documented chain of evidence is often used.

Depending on the specific task, the following can be documented:

• who has handed over an object of investigation,
• when the handover took place,
• how the object was marked
• who had access to it,
• when a backup was created,
• which security and analysis methods were used,
• which working copies were created and
• how the object of investigation was handled after its completion.

Such documentation can help a qualified third party to later understand how a digital investigation result was generated.

This is precisely a key quality principle for LB Forensics:

A result should not only be understandable; its development process should also remain traceable.

Mobile forensics: Why smartphones are among the most challenging objects of investigation

Smartphones are among the most information-rich digital devices today.

Depending on the device, operating system, application, configuration and available database, it may contain, among other things, communication information, app data, contacts, pictures, videos, documents, usage information and other digital artifacts.

At the same time, modern smartphones are among the most technically challenging objects to examine in digital forensics.

Reasons for this include:

• modern device cryptography,
• protected storage areas,
• Secure Enclave and similar security architectures,
• different operating system versions,
• regular security updates,
• App-specific databases and storage structures,
• Cloud synchronizations,
• different device states and
• rapid technological changes.

Therefore, whether certain data can be obtained from a smartphone can often only be reliably assessed after examining the specific device, the operating system version, the device's condition, and other technical factors.

Blanket promises like "We can fully read any smartphone" or "We restore all deleted messages" do not meet LB Forensik's understanding of quality.

Professional mobile forensics must also acknowledge its technical limitations.

Forensic software is a tool – not the truth.

Depending on the specific investigation task, LB Forensik uses various professional analysis and forensic solutions.

Depending on the case and technical task, this includes or may include systems and tools from the following areas:

• Cellebrite Premium
• UFED,
• Cellebrite Physical Analyzer
• MOBILedit Forensic,
• MEFF 3PRO,
• X-Ways,
• Belkasoft X,
• AXIOM magnet
• XRY
• FTK Imager
• and other specialized forensic analysis tools.

The existing technology is relevant. However, the question of how it is used is even more important.

Different programs can interpret, structure, or display the same dataset in different ways. Some artifacts are detected automatically. Others must be checked manually. In the case of complex or contradictory findings, comparison with other tools or with the underlying raw data may be necessary.

Therefore, LB Forensics operates on a simple principle:

The output of a software program is initially a technical result. It only becomes a reliable forensic finding through expert examination and classification.

Therefore, the question should not be which forensic program is supposedly "the best".

The crucial factor is which tool is suitable for the specific question and whether the results obtained with it are interpreted professionally.

Automatically generated forensic reports do not replace a professional assessment.

Modern forensic platforms can generate comprehensive reports within a short time.

Communication data is sorted. Contacts are linked. Images are categorized. Timelines are created automatically. App data is processed. File system artifacts are displayed in graphical interfaces.

This is a tremendous help for practical evaluation.

Problems only arise when an automatically generated report is mistaken for a professional expert assessment.

For example, a program can indicate that a specific file was present.

This does not automatically answer the question:

• who created this file,
• how she got onto the system,
• whether it was deliberately opened
• whether its content was known to a specific person,
• whether a synchronization service was involved or
• whether the file was generated by an automated process.

The software provides data.

The forensic evaluation must take into account technical contexts and alternative explanations.

Timestamps are important – but can still be misinterpreted.

In digital investigations, time information often plays a central role.

When was a file created?

When was it changed?

When was a system used?

When did communication take place?

When was an external storage device connected?

Such questions seem straightforward. Technically, they can be much more complicated.

Digital systems store different types of timestamps. Their meaning depends, among other things, on the specific operating system, file system, program, and data type.

Additionally, the following may be relevant, for example:

• Time zone settings,
• Summer and winter time,
• differing system times,
• File copy operations,
• Synchronizations,
• Backups,
• Server times,
• Cloud services and
• Application-specific storage formats.

Therefore, a single timestamp should not automatically be equated with a specific human action.

Professional forensics attempts to compare time information with other digital artifacts and thereby establish an overall technical context.

The strength of digital forensics lies in the reconstruction of connections.

A single digital find is not always decisive.

A reliable picture often only emerges when several technical traces are considered together.

A potential data breach could, for example, leave clues in various areas:

• A file was processed at a specific time.
• An external storage medium was connected to the system.
• System artifacts document certain activities.
• Application data provides supplementary information.
• Further timing information matches the established sequence of events.

Only by correlating different data sources can a comprehensible technical reconstruction be created from isolated information.

Another boundary is crucial here:

A computer may be able to document user activity.

However, the unambiguous attribution of this activity to a specific natural person can be a separate issue.

That is another reason why a forensic assessment must clearly distinguish between:

• technically determined,
• technically plausible,
• possible,
• not clearly determinable
• and not detectable.

Deleted data: What IT forensics can really achieve

Data recovery is one of the most well-known topics in IT and mobile forensics.

At the same time, many false expectations exist in this area.

A deleted file is not necessarily permanently in a state from which it can be fully reconstructed.

Whether a recovery is possible depends on numerous technical factors.

This can include, among other things:

• Type of storage medium,
• file system,
• Operating system,
• Device model,
• Memory management,
• Encryption,
• TRIM or garbage collection processes,
• interim use of the device,
• Overwriting former data areas,
• App-specific data storage,
• Backups and
• Cloud synchronizations.

Therefore, there are three fundamentally different situations:

First: Deleted data can still be fully or partially recovered.

Secondly, the actual content is no longer available, but other digital artifacts still provide clues to earlier events.

Thirdly: There is no longer any technically reliable way to reconstruct the information sought.

The third option can also represent a technically correct examination result.

Reputable digital forensics therefore distinguishes between technical possibility and advertising promises.

Professional forensics must also be able to say: This cannot be proven.

Clients commission a forensic investigation because they need clarity.

However, this clarity must not be achieved by ignoring uncertainties.

Digital data does not always provide a clear answer.

Sometimes information is missing.

Sometimes there are several technically plausible explanations.

Sometimes an artifact is present, but it cannot be attributed to any specific person.

Sometimes a hypothesis can neither be confirmed nor ruled out.

In such cases, it is part of the professional responsibility to document exactly that.

A professional forensic expert must not only be able to explain what can be proven. They must also be able to clearly identify what cannot be proven based on the available data.

This reticence is not a weakness.

It is a prerequisite for ensuring that technical findings remain separate from assumptions.

Artificial intelligence is changing digital forensics in two ways simultaneously.

Artificial intelligence will significantly change IT forensics.

On the one hand, AI-supported methods can help professionals to structure large data sets, classify documents, recognize connections, or narrow down potentially relevant information more quickly.

In investigations involving millions of files or large communication archives, such methods could have significant practical benefits in the future.

At the same time, AI is also changing the digital content that needs to be examined.

Images can be artificially generated.

Voices can be synthesized.

Videos can be manipulated.

Documents can be created or modified automatically.

Communication can be generated by AI systems.

This further increases the importance of questions regarding the origin, integrity, context, and technical creation of digital information.

AI results must not be accepted as facts without verification.

An AI system can point out anomalies.

It can prioritize content.

It can recognize patterns.

It can assist with certain analysis tasks.

However, an algorithmic assessment is not automatically a forensic finding of fact.

Particularly in cases where evidence is potentially relevant, crucial results must be verified and professionally evaluated using suitable initial data.

For LB Forensics, one limit is therefore essential:

Artificial intelligence can support the work of a forensic scientist. It must not replace the responsibility for a professional assessment.

Why quality management is particularly relevant in IT forensics

Digital forensics does not consist of a single step.

From the initial contact to the final documentation, numerous processes are intertwined.

These include, among others:

• Clarifying the assignment,
• Definition of the research question,
• Examination of the scope of the investigation,
• Acquisition and labeling of objects under investigation,
• Selection of suitable security methods,
• forensic data backup,
• Analysis,
• Evaluation,
• Documentation,
• Quality control,
• Protection of confidential information
• and completion of the process.

LB Detektive GmbH operates with a structured quality management system. According to the company, the certification scope of the quality management system covers the areas of detective work, IT forensics, counter-surveillance, and expert witness services.

A technically correct distinction is important:

Certification of a quality management system according to DIN EN ISO 9001 does not mean that every single test result is automatically correct.

It does not guarantee a specific outcome of a forensic investigation.

The subject of such a system is rather organizational structures and processes, defined responsibilities, documented procedures, the handling of deviations and the continuous development of quality management.

This organizational level is precisely what is relevant for digital forensics.

Sensitive investigations should not depend on whether a single person happens to remember a particular step in the process.

Responsibilities and processes must be organized in a reproducible manner.

Organization alone does not replace expert competence.

Good quality management cannot replace professional expertise.

Therefore, two levels must be distinguished from each other:

the quality of the organization and the qualifications of the professionally responsible persons.

Managing Director Sven Lungershausen has qualifications in IT forensics and mobile systems, among other things, and is certified as an expert according to DIN EN ISO/IEC 17024 by LB Detektive GmbH.

The ISO/IEC 17024 standard concerns requirements for bodies that certify persons based on defined certification programs.

Such a personal certification is therefore to be distinguished from a management system certification according to ISO 9001.

Simplified:

• ISO 9001 concerns the quality management of an organization.
• A personal certification according to ISO/IEC 17024 concerns a regulated proof of competence within the respective certification program.

One does not replace the other.

A qualified expert needs reliable organizational structures.

A well-organized company needs people who can professionally assess technical results.

A forensic report must be understandable even to non-technical people.

Forensic investigations are often not conducted exclusively for IT specialists.

The intended recipients could be, for example:

• Management,
• Corporate lawyers,
• external lawyers,
• Compliance officers,
• Data Protection Officer,
• Human resources departments,
• Versicherungen,
• authorities or
• Private individuals.

A good investigation report must therefore fulfill two requirements simultaneously.

It must be technically precise.

And he must clearly explain the significance of the technical findings.

A client should be able to see from a report:

• which question was investigated
• which objects of investigation were available,
• which methods were used,
• which findings were made,
• what technical limitations existed,
• what conclusions can be drawn from this
• and where the limits of its validity lie.

Complexity can be explained.

It should not be hidden behind as many technical terms as possible.

Digital forensics requires controlled handling of sensitive data.

A device examined forensically often contains significantly more information than is relevant to the investigation.

For example, the following may be found on a computer or smartphone:

• business communication,
• private messages,
• Customer data,
• Personal information,
• Trade secrets,
• Documents,
• Access information
• and other confidential data.

The technical possibility of accessing information therefore does not automatically mean that every technically accessible piece of information should become part of an investigation.

The scope of the investigation should be based on the specific task and the relevant legal framework.

Particularly in internal company investigations, data protection law, labor law and, where applicable, works constitution law issues may be relevant.

LB Forensics does not replace individual legal advice. In legally complex cases, consultation with the client's legal advisors may be necessary before or during a technical investigation.

When IT forensics alone is not enough: Connection to counter-surveillance and investigations

Complex security incidents cannot always be clearly assigned to a single field of expertise.

A suspected information leak might initially provide clues on a computer, for example.

After that, a smartphone can become relevant.

The next step might be to investigate whether confidential information was accessed outside of the IT systems.

This can mean that different investigative disciplines are necessary for a single case.

Within the LB Group, therefore, various departments can collaborate – depending on the specific situation:

• LB Forensics for IT forensics, Computer forensics and mobile forensics,
• LB Eavesdropping Defense for technical counter-surveillance and investigations into possible technical surveillance,
• LB Detective Agency for classic business and private investigations as well as fact-related investigative measures.

The LB Group is a brand of LB Detektive GmbH . The individual departments do not become separate companies, but rather form specialized service areas under the organizational umbrella of LB Detektive GmbH.

For clients, this approach can be particularly helpful when a case combines digital, technical and traditional investigative issues.

How clients can recognize professional IT forensics

Anyone choosing a provider for digital forensics should not be impressed solely by software logos, technical superlatives, or promises of supposedly fully recoverable data.

Specific questions are more informative.

1. Who bears the professional responsibility?

It should be clear who is responsible for the investigation and evaluation and what professional qualifications this person possesses.

2. How are objects of investigation acquired?

A professional provider should be able to explain how digital devices and data carriers are documented, secured, and handled.

3. How is data integrity controlled?

Depending on the backup method, suitable measures should exist to detect changes and to make the handling of original and working data traceable.

4. Is every software release adopted without being checked?

Professional forensics requires a professional evaluation of automatically generated results.

5. Are technical limitations explicitly stated?

No one can seriously guarantee that all deleted data can be recovered or that every smartphone can be fully analyzed.

6. Is the investigation focused on a specific question?

A targeted investigation is something different from an unrestricted search of all available data.

7. Is the investigation process documented?

The client should later be able to understand how a technical finding was derived from the object of investigation.

8. Can the provider express uncertainty?

Turning every technical piece of information into a definitive statement does not automatically mean working with particular precision.

Often, the opposite is true.

The future of IT forensics is not determined by the number of programs.

Forensic systems are becoming more powerful.

Smartphones are being made more secure at the same time.

Encryption continues to evolve.

Cloud infrastructures are becoming more complex.

Artificial intelligence will be able to analyze larger amounts of data faster, while simultaneously creating new possibilities for manipulation.

Companies are generating more and more digital information.

This also changes the role of the forensic scientist.

Its value will increasingly lie less in simply reading data from a device.

The crucial task will be to identify from complex datasets the information that is technically relevant to a specific question, to verify it in a comprehensible manner, and to correctly limit its significance.

Technology creates access opportunities.

Methodology creates traceability.

Expertise creates evaluation.

Documentation creates verifiability.

LB Forensics' understanding of quality

LB Forensik therefore does not define professional digital forensics by a single tool or by making the most spectacular statements possible.

From our perspective, several interconnected levels are crucial:

• a clearly defined research question,
• a suitable forensic security strategy,
• the controlled handling of research objects,
• professional forensic tools,
• professional analysis instead of untested software output,
• a comprehensible documentation,
• the protection of sensitive data,
• a clear separation between finding and interpretation,
• openly communicated technical limitations,
• qualified professional responsibility
• and structured organizational processes.

LB Forensics is part of the LB Group. The LB Group is a brand of LB Detectives GmbH, headquartered in Esslingen am Neckar.

Under this organizational umbrella, specialized expertise from digital forensics, mobile forensics, expert assessments, investigative work and technical counter-surveillance is brought together.

This allows complex investigations to focus on the research question rather than being limited to a single tool or field of expertise.

A digital proof must be able to explain how it was created.

At the end of a digital investigation, a seemingly simple question often arises:

What was found?

However, this question is not sufficient for professional IT forensics.

Equally important is:

How was this finding obtained?

What object of investigation was present?

How was the data backed up?

What tools were used?

Which technical artifacts were evaluated?

What alternative explanations were considered?

Where are the limits of this statement?

Can a qualified third party understand the investigation process?

Only when such questions can be answered in a comprehensible manner does a data extraction result in a reliable forensic investigation.

The future of digital forensics therefore does not automatically belong to the company that extracts the most data or has the longest list of analysis programs.

It belongs to those who can explain where a finding comes from, how it was verified, and what statement it actually makes.

Because digital data can be copied within seconds.

Forensic quality is only achieved through controlled processes, technical competence, comprehensible methodology, and responsible professional evaluation.

Frequently asked questions about IT forensics, digital evidence, and loan forensics

What is digital forensics?

Digital forensics deals with the methodical securing, examination, analysis, and evaluation of digital information. Objects of investigation can include computers, smartphones, tablets, storage media, servers, and other digital systems. The goal is not merely to obtain as much data as possible, but to conduct a reproducible investigation into a specific question.

What is the difference between IT forensics and mobile forensics?

IT forensics is an umbrella term for the investigation of digital systems and data. Mobile forensics focuses specifically on smartphones, tablets, and mobile operating systems. Due to device cryptography, app structures, and varying security mechanisms, mobile forensics requires specialized methods and tools.

Can deleted data always be recovered?

No. Whether deleted data can be fully, partially, or not at all recovered depends on factors such as the device, storage medium, operating system, file system, encryption, and any intervening use. Therefore, a reliable statement is often only possible after a technical examination.

Can deleted WhatsApp or Messenger messages be recovered?

This may be possible in certain cases, but it cannot be guaranteed across the board. The specific smartphone, the operating system and app version, existing local data, backups, synchronization, encryption, and other technical factors are crucial.

What does forensic data backup mean?

Forensic data preservation involves using appropriate methods to secure relevant digital information in such a way that the original data remains as protected as possible and subsequent investigative steps can be documented in a traceable manner. The specific method depends on the particular object of investigation.

What is the significance of hash values ​​in IT forensics?

Hash values ​​can be used to verify the integrity of digital data. They can help check whether a specific dataset has changed between two points in time. However, they do not replace proper evidence preservation or a professional evaluation of an investigation.

What does Chain of Custody mean?

In a forensic context, chain of custody refers to the traceable documentation of the handling of an object of investigation or piece of evidence. This can include handover, access, securing, processing, and other relevant work steps.

What software does LB Forensics use?

Depending on the device, data type, and investigation question, different specialized systems can be used. LB Forensics' service pages list, among others, Cellebrite Premium, UFED, Physical Analyzer, MOBILedit Forensic, MEFF 3PRO, X-Ways, Belkasoft X, Magnet AXIOM, XRY, and other forensic tools. Which solution is appropriate in a specific case depends on the technical requirements.

Is the output of forensic software already considered evidence?

Not automatically. Software can extract and display digital artifacts. However, their meaning must be technically evaluated. Crucial factors include the artifact's origin, its reliability, alternative explanations, and which conclusions are actually valid.

Can artificial intelligence replace an IT forensic expert?

AI can assist in structuring and analyzing large datasets. However, in cases involving potentially evidentiary findings, results must be professionally reviewed and evaluated within their technical context. Responsibility for forensic conclusions should not be transferred to an automated system without scrutiny.

What does counter-surveillance have to do with IT forensics?

In complex cases of information leakage, digital systems as well as physical premises, smartphones, communication devices, or other technical components can be relevant. In such cases, IT forensics and technical counter-surveillance can investigate different aspects of the same security issue.

What is the LB Group?

The LB Group is a brand of LB Detektive GmbH. Specialized service areas such as LB Forensics, LB Private Investigation, and LB Counter-Eavesdropping are united under the LB Group. The contractual and organizational basis is LB Detektive GmbH.

What is LB Forensics?

LB Forensics is the specialized division of the LB Group for digital forensics, IT forensics, and mobile forensics. The LB Group is a brand of LB Detektive GmbH, headquartered in Esslingen am Neckar.

Who bears the professional responsibility?

Sven Lungershausen is one of the managing directors of LB Detektive GmbH. The company identifies him as a certified expert for IT forensics and mobile systems, as well as a certified expert according to DIN EN ISO/IEC 17024.

Does ISO 9001 certification prove that every expert opinion is correct?

No. Certification according to DIN EN ISO 9001 pertains to a quality management system and should not be confused with a guarantee of the accuracy of a single technical finding or expert opinion. For the professional quality of a specific process, qualification, methodology, investigation, evaluation, and documentation are also crucial.

Who does LB Forensics work for?

Digital forensic investigations can be relevant for companies, law firms, organizations, government agencies (within the scope of their mandates), and private individuals. Which type of investigation is appropriate and feasible must be determined based on the specific circumstances of each case.

Digital anomalies should be professionally assessed as early as possible.

In the event of a potential data breach, suspicious activity on a computer or smartphone, deleted information, a cyber incident, or other digital anomalies, even the continued handling of the affected system can have an impact on existing digital traces.

Therefore, before making any independent changes, new installations, resets, or extensive access, it can be useful to first clarify which security measures are suitable for the specific system.

LB Forensics – digital forensics within the LB Group, a brand of LB Detectives GmbH.

The focus is on verifiable data backup, technical analysis, expert evaluation and understandable documentation of digital matters.