Digital traces are created almost everywhere today: on computers and smartphones, in file systems, user accounts, messaging apps, browsers, external storage media, and synchronized data repositories. This information becomes relevant at the latest when it is necessary to clarify what actually happened on a digital system.

Our IT forensics services in Kassel support individuals, companies, lawyers, and organizations in the professional securing, investigation, and evaluation of digital data. This includes the examination of Windows systems, Macs, notebooks, smartphones, hard drives, SSDs, USB drives, memory cards, and other technically relevant data sources.

The tasks range from possible unauthorized access to a private smartphone, deleted files and messenger communication, to the reconstruction of complex business incidents, possible data theft or the investigation of an IT security incident.

However, the most important factor is not the sheer volume of data. Rather, the right data sources must be identified, digital traces must be methodically secured, connections must be recognized, and technical findings must be separated from assumptions.

IT forensics for Kassel – when digital traces must provide answers

A professional forensic investigation does not begin with an analysis program, but with a clear question.

Has a computer been accessed without authorization? Has an employee possibly copied confidential company data? Can deleted files still be recovered? Is there any technical evidence that a smartphone was monitored? Or can it be traced when a specific file was edited or an external storage device was used?

The more precisely the research question is formulated, the more effectively relevant devices, time periods, and data sets can be determined. This also reduces the risk of unnecessarily analyzing data without a concrete connection to the research question.

This is precisely where a crucial difference lies between a mere technical review and digital forensics. A single technical hit often has limited significance, whereas its context can transform an anomaly into a reliable finding.

Which digital systems can be examined?

Modern issues rarely extend to a single device class. Therefore, our IT forensics encompasses a variety of digital objects of investigation.

Depending on the specific task, the following may be relevant, among others:

• Windows PCs and workstations,
• Notebooks and mobile workstations,
• Apple Mac systems,
• iPhones and Android smartphones,
• Hard drives and SSDs,
• USB sticks and external storage media,
• Memory cards,
• existing backups and backups,
• Messenger and communication data,
• as well as other accessible digital data sets.

Which of these sources are actually needed depends on the research objective. A professional study therefore does not indiscriminately collect all available data, but prioritizes those data sources that can contribute to answering the specific research question.

Computer forensics for Kassel – reconstructing activities on Windows PCs and Macs

Computers generate a multitude of technical artifacts during their use. Files are created, opened, modified, moved, or deleted. Simultaneously, users log in, programs are executed, websites are accessed, and external devices are connected.

Our computer forensics examines such traces in a structured manner and places them, as far as technically possible, in a temporal and factual context.

Depending on the operating system and the objective of the investigation, the following areas, for example, may be relevant:

• File systems and file metadata
• deleted files and remaining data fragments,
• User and system activities,
• Event and system logs,
• Browser and download information,
• connected USB devices,
• external hard drives and other storage media,
• locally stored communication data,
• Cloud and synchronization artifacts,
• Software installations and program usage,
• as well as temporal relationships between different events.

We explain the basics of this area of ​​investigation in more detail under What is Computer Forensics?

What does a computer actually reveal about past activities?

The strength of computer forensics often lies not in a single artifact, but in the combination of different technical traces.

A typical example is a USB storage device. If it can be determined that a particular storage medium was connected to a computer, initially only this technical connection is established.

However, this does not prove that confidential files were copied to the data carrier.

For a more detailed evaluation, additional information may be required. This includes, for example, relevant file activity, time information, file system artifacts, or other technical events.

If several of these pieces of information fit together, the significance of the conclusion can increase considerably.

Deleted files – data recovery is not automatically forensics

The recovery of deleted files is often equated with computer forensics. In reality, the two fields pursue different goals.

Traditional data recovery focuses primarily on whether lost content can be recovered. A forensic investigation goes further, additionally investigating the file's origin, its technical context, and any other artifacts that might support its assessment.

The recoverability depends significantly on the specific storage medium.

With magnetic hard drives, deleted information can still be present under certain conditions. Modern SSDs, on the other hand, use TRIM and internal memory management processes, which is why deleted content can become unrecoverable much more quickly.

If a deleted file might be relevant as evidence, the computer in question should therefore not be used unnecessarily.

IT forensics for private individuals in Kassel

Digital forensics is not only needed in corporate incidents. A significant portion of investigations involve private situations in which smartphones, computers, or user accounts play a central role.

Typical questions include:

• Does anyone have access to my smartphone or my computer?
• Can my former partner still access personal information?
• Are there any indications of spyware or stalkerware?
• Are unknown devices or account connections relevant?
• Can deleted WhatsApp messages still be investigated?
• Can the authenticity of messenger communication be technically verified?
• Are there relevant digital traces left after phishing or online fraud?
• Can digital information be reliably secured for use in legal proceedings?

Discretion plays a particularly important role in private cases. At the same time, the scope of the investigation should be limited to the actual question at hand. Therefore, technically available data does not automatically need to be fully analyzed.

Smartphone forensics – the mobile phone as a digital data source

A modern smartphone combines communication, user accounts, photos, videos, messenger, email, browser, apps and numerous other services in a single device.

As a result, smartphones have a particularly high information density in both private and business matters.

Our smartphone forensics examines the technically available data depending on the specific device and the particular question being asked.

The information that can be obtained depends, among other things, on the manufacturer, model, operating system, security level, encryption, and device condition.

Modern smartphones cannot therefore be treated in the same way as traditional hard drives. Depending on the technical specifications, different extraction methods and data volumes are available.

We explain further basics under What is Smartphone Forensics?.

Mobile phone hacked – when is a forensic investigation advisable?

Many affected individuals initially notice unusual symptoms. The battery drains faster, the smartphone gets warm, data usage increases, or unfamiliar logins appear.

Such observations may provide grounds for investigation, but do not in themselves prove a compromise.

Increased battery consumption, for example, can have numerous harmless causes. Similarly, an unknown login must first be assessed from a technical perspective.

Depending on the device, applications, permissions, user accounts, configurations and other technically available artifacts can be examined.

A professional assessment therefore distinguishes between a mere anomaly, a technically explainable condition, and a truly relevant finding.

Surveillance by an ex-partner – spyware is just one possibility

After a breakup, there is often a suspicion that a former partner can still see private messages, photos, or other information.

Hidden surveillance software is just one of several conceivable scenarios.

During a relationship, digital access is often consciously shared. Passwords are known, tablets are used jointly, family features are set up, or computers are connected with the same user accounts.

Such connections can persist even after a separation.

An open-ended investigation therefore considers not only possible spyware, but also known access data, authorized devices, account connections and other technically plausible access methods.

Spyware and stalkerware – technical limitations are part of the findings.

If there is a concrete suspicion of surveillance, an affected smartphone should not be hastily reset or cleaned independently. Such changes can affect relevant information.

Depending on the available data, conspicuous applications, permissions, configurations and other technical artifacts can be examined.

However, a serious investigation does not promise to reliably detect every conceivable or previously existing compromise.

If nothing unusual is found within the available data, this initially only means that no corresponding reliable evidence was found in this database.

However, this does not automatically mean that access could not have occurred at an earlier time.

WhatsApp and Messenger – visible chat and technical data are not the same

Messenger communication can play an important role in breakups, threats, fraud cases, business conflicts, and legal disputes.

A screenshot initially shows a visible representation. The original data source, however, often contains additional technical information.

Depending on the available extraction capabilities, messages, time information, participants, media, documents, and other technical structures can be examined.

This can be particularly relevant when the context, completeness, or authenticity of a communication is questioned.

Further information can be found under Forensic analysis of WhatsApp messages.

Deleted WhatsApp messages – what might still be there?

Whether deleted messenger content can be recovered or otherwise reconstructed cannot be reliably answered without knowledge of the specific device.

Crucial factors include the operating system, app version, database status, encryption, existing backups, and continued use after deletion.

Additional devices can also be relevant. For example, communication on a smartphone may already be deleted, while a different data set still exists on another system involved.

A blanket guarantee of restoration would therefore be irresponsible.

Viewing smartphone and computer together

Digital processes today often take place across multiple devices.

A messenger app is used on a smartphone and also on a computer. Photos synchronize with other devices, while emails are accessed on multiple systems. Documents also move between laptops, smartphones, and cloud services.

An investigation that focuses solely on a single device may therefore overlook a relevant part of the facts.

If the research question requires it, multiple data sources can be compared chronologically and thematically. This can reveal correlations that would not be apparent on a single device.

Data storage forensics – examining hard drives, SSDs and USB storage devices

Hard drives, SSDs, USB sticks and memory cards can be independent pieces of evidence or become part of a larger investigation.

Depending on the storage medium, existing files, file system structures, partitions, deleted information and other technical characteristics can be examined.

Furthermore, write protection methods can be used on suitable data carriers to prevent unintentional write access during the backup process.

However, the subsequent validity of the findings does not depend solely on the write-blocker or forensic software used. Crucially, the entire documentation process is essential, from the investigation itself through data preservation to analysis.

Digital evidence preservation – integrity is only one part of the evidence question

Digital data can be easily copied and altered. Therefore, its traceable backup is of particular importance in legally relevant matters.

Cryptographic hash values ​​can be used with suitable datasets. This allows for mathematical verification of whether a defined dataset has changed since a documented point in time.

However, an identical hash value does not answer every proof question.

For example, it does not prove the truth of the content, nor who actually wrote a message, or which natural person used a user account at a particular time.

Integrity, authenticity, origin and personal attribution are therefore different issues that must be assessed separately.

Our knowledge article on the integrity of digital evidence explains this in more detail.

IT forensics for companies in Kassel and Northern Hesse

Kassel combines industrial manufacturing with technology-oriented development, mobility, energy, logistics, IT, and research. For companies in these sectors, digital data has long been a central component of their value creation.

Development documents, design data, calculations, project documentation, technical drawings, trade secrets and internal communication are therefore processed on a variety of digital systems.

If there is suspicion of unauthorized use or data leakage, this can have significant economic and legal consequences.

Typical reasons for examination include:

• Suspected data theft or leakage of know-how,
• conspicuous file activity prior to an employee change,
• Use of external storage media,
• Deletion or modification of business data,
• unauthorized use of cloud or transfer services,
• compromised user accounts,
• Cyberattacks and security incidents,
• internal investigations,
• as well as the safeguarding of digital data for legal or court proceedings.

Mobility and industrial manufacturing – of particular relevance for Kassel

Mobility and industrial manufacturing are among the characteristic areas of expertise of the Kassel economic region. Highly specialized digital information, the economic value of which can be considerable, is generated within such structures.

In case of suspected data leakage, workstations, notebooks, external storage devices and, if applicable, mobile devices may document different parts of the same process.

The forensic challenge, therefore, lies in developing a technically comprehensible sequence of events from many individual incidents.

When was a relevant file last modified? Which systems were involved? Was an external storage medium used during the relevant period? And are there any other traces that correspond to this process?

Only when such information is considered together can its actual significance be assessed.

Energy, IT and research – when know-how itself becomes a digital asset

Research and development information differs from ordinary business documents. Its value often arises precisely from the fact that it has not yet been published or is only accessible to a limited group of people.

Project status, technical concepts, calculations, research results, development documents or source and configuration data can therefore become the subject of a forensic investigation.

Precise delimitation is essential here. A professional investigation should not analyze all available company data, but rather identify the systems and time periods that are actually relevant to the specific suspicion.

Data theft by employees – the USB stick alone proves little

A classic case of suspected data theft arises shortly before an employee leaves the company. An external storage device has been connected, large amounts of data have been processed, or confidential files suddenly appear to be available outside the company.

Such circumstances may justify an investigation, but do not automatically constitute proof of data theft.

Depending on the system, a forensic analysis can combine different pieces of evidence. These include file system information, USB artifacts, user activity, browser data, cloud traces, and other relevant events.

The quality of the investigation is demonstrated precisely by not drawing a hasty conclusion from a suspicion.

Cyber ​​forensics – what happened before, during and after a security incident?

After an IT security incident, it is often necessary to reconstruct which systems were affected, what activities took place, and what digital traces are still present.

At the same time, forensic evidence collection must not block necessary measures to limit damage.

The correct course of action therefore depends on the individual case. A running system may contain volatile information that is lost when it is shut down. Conversely, a compromised computer that remains active can pose additional risks.

In encrypted systems, an already unlocked state can also be relevant for security purposes.

Therefore, there is no reliable universal rule to immediately switch off every affected device or to always leave it running. System status, risk, and investigation objective must be considered together.

Forensic data backup – protecting the original as much as possible

The security strategy depends on the specific object being investigated.

Forensic images can be created and write-protection methods can be used on suitable traditional storage media. However, running or encrypted systems may require different approaches.

Smartphones, on the other hand, have their own technical requirements. Modern iPhones and Android devices often cannot be copied completely sector by sector like traditional hard drives.

Instead of simply referring to a "1:1 copy", it should therefore be documented which extraction method was used and what data volume it actually provided.

Forensic software – powerful tools do not replace expert assessment

Digital forensics requires specialized software. However, different devices, operating systems, and data structures necessitate different tools.

Cellebrite Inseyets

Cellebrite Inseyets is used primarily for the acquisition and analysis of mobile digital data. The actual amount of data available depends on the specific smartphone, operating system, security status, and the technically feasible extraction capabilities.

Cellebrite Digital Collector

Cellebrite Digital Collector supports suitable acquisition methods for computers and digital storage media. The operating system, hardware, encryption, and system state determine the specific procedure.

Cellebrite Inspector

Cellebrite Inspector supports the structured investigation of computer forensic data sets and enables the analysis of relevant file, user, and system artifacts.

X-Ways Forensics

X-Ways Forensics enables in-depth investigations of data carriers, partitions, file systems and other computer forensic structures.

MOBILedit Forensic and MEFF 3 Pro

MOBILedit Forensic and MEFF 3 Pro complement the tool base for mobile investigations and can open up additional analysis paths depending on the device and the task.

However, the number of programs used is not the decisive factor.

Forensic software extracts, structures, correlates, and visualizes data. However, the significance of an artifact in a specific case still requires expert evaluation. Therefore, an automated software report is not equivalent to an expert assessment or report.

Quality begins with the research methodology.

LB Detektive GmbH has a quality management system certified by TÜV NORD CERT according to DIN EN ISO 9001:2015. The certified scope includes, among other things, IT forensics.

A structured quality management system ensures that essential processes, responsibilities, and quality-relevant work steps are defined organizationally.

In addition, expert competence is available with personal certification according to DIN EN ISO/IEC 17024.

Quality management and personal expert qualifications fulfill different functions. Likewise, certification does not automatically guarantee the outcome of a single assignment.

Crucial factors remain a suitable investigation method, professional technical execution, comprehensible documentation and critical evaluation of the information obtained.

Three typical situations from IT forensics

Private information is known to another person

After a breakup, a person discovers that a former partner has access to content that should no longer be accessible. Instead of immediately assuming a spy app is the cause, possible technical means of access are considered. Smartphones, user accounts, and potentially other shared devices can explain different aspects of the situation.

Important files were deleted from a computer

Documents needed for legal proceedings are no longer accessible. Before committing to data recovery, the storage medium type, file system, deletion process, and subsequent usage are assessed. Only then can it be determined what forensic options realistically remain.

Confidential company data may have been leaked.

Shortly before an employee leaves, unusual file activity and the use of an external storage device are observed. Instead of immediately concluding that this is a data theft, relevant artifacts within the defined timeframe are correlated and their actual significance is assessed.

How does an IT forensic investigation for Kassel proceed?

1. Define the facts and the objective of the investigation

What observation has been made? What technical question needs to be answered? What time period is relevant?

2. Identify relevant data sources

It will be determined whether computers, smartphones, data storage devices, backups, or other systems are needed to answer the question.

3. Assess the technical condition

Operating system, encryption, device condition, storage technology and potential data loss influence the further course of action.

4. Secure data methodically

The security method is adapted to the respective object of investigation and documented in a traceable manner.

5. Analyze relevant artifacts

The evaluation focuses on the data that can contribute to the defined research question.

6. Reconstruct the connections

Time information and technical events can be compared if multiple data sources are available.

7. Evaluate findings professionally

Individual hits are not considered in isolation. Instead, alternative technical explanations and limitations of the findings are taken into account.

8. Document results in a comprehensible manner

Depending on the assignment, the relevant findings are recorded in a technical document, an investigation report, or a more detailed expert report.

What should be avoided before a forensic examination?

• Do not hastily reset affected smartphones to factory settings.
• Do not attempt to remove suspected spyware on your own.
• Do not install any unknown cleanup or analysis programs.
• WhatsApp Do not unnecessarily reinstall for relevant deleted messages.
• Do not overwrite existing backups.
• Minimize the continued use of computers with important deleted data.
• Do not unnecessarily alter the original data carrier.
• Do not restart a switched-off examination computer solely for the purpose of reviewing it.
• Do not reflexively shut down a running encrypted computer in the event of a relevant incident.
• Document error messages, anomalies, and relevant timestamps.

IT forensics for Kassel and the North Hesse region

Our IT forensic services are available to clients in Kassel and throughout the North Hessian economic region. This includes, among others, Baunatal, Vellmar, Lohfelden, Niestetal, Kaufungen, Fuldatal, Hofgeismar, Wolfhagen, Melsungen, Fritzlar, and other locations in the region.

Clients from Göttingen, Korbach, Bad Wildungen, and surrounding regions can also commission such investigations. Furthermore, complex corporate and expert cases can be coordinated nationwide.

This allows both sensitive private investigations and complex cases involving multiple devices, data carriers, or company systems to be processed.

Frequently asked questions about IT forensics in Kassel

What does IT forensics investigate?

IT forensics examines digital data and technical traces on computers, smartphones, storage media, and other relevant systems. The goal is to reconstruct digital processes as far as technically possible, secure relevant information, and professionally assess its significance.

Which devices can be examined?

Depending on the task, devices such as Windows PCs, notebooks, Macs, smartphones, hard drives, SSDs, USB storage devices and memory cards can be examined.

Is it possible to determine if my computer has been hacked?

Depending on the system state and available data, indications of unusual activity, programs, user activity, and other relevant artifacts can be investigated. However, not every previous attack will necessarily be fully detectable in retrospect.

Can a smartphone be examined for surveillance?

Yes. Depending on the device and the available database, applications, permissions, account connections and other technical anomalies can be investigated.

Can all spyware be detected?

No. A guarantee to detect every conceivable or previously existing compromise would be technically irresponsible. The reliability and limitations depend on the specific device and available data.

Can deleted files be recovered?

This may be possible under certain conditions. Data carrier type, file system, deletion process, overwriting, and subsequent use significantly influence recoverability.

Can deleted WhatsApp messages be examined?

Depending on the smartphone, database status, backups, and further usage, relevant information or artifacts may still be present. A general recovery guarantee is not provided.

Is it possible to determine if a USB stick has been connected?

On suitable systems, technical information about connected USB devices may be available. However, the connection alone does not prove that specific files are being transferred.

Can data theft by employees be proven?

Depending on the available data, file activity, external storage devices, user activity, and other traces can be correlated. Whether this results in conclusive evidence depends on the specific case.

Can computers and smartphones be examined together?

Yes. For cross-device communication, cloud synchronization, account access, or other related processes, considering multiple data sources together can be useful.

Are hash values ​​proof of the authenticity of a file?

A hash value can be used to check the integrity of a defined dataset. However, it does not automatically prove the truth of the content, the origin, or the authorship of a file.

Is a report from forensic software already considered an expert opinion?

No. Software delivers and structures technical data. An expert evaluation additionally requires a defined question, technical review, a comprehensible methodology, and a reasoned interpretation.

How much does an IT forensic investigation cost in Kassel?

The required effort depends on the research question, the type of equipment, the number of data sources, technical accessibility, the amount of data, and the desired documentation. Therefore, in more complex cases, it is first determined which investigations are actually necessary to answer the research question.

Secure digital traces before they change

In digital incidents, it is not only crucial what data is available, but also the condition in which it is backed up.

Further use, reinstallation, resetting, or independent cleanup measures can alter data and complicate later reconstruction. At the same time, ongoing cyber incidents may require immediate damage control measures.

Therefore, the procedure should not be based on a general checklist, but rather decided on the basis of the specific device and circumstances.

For an initial assessment, the affected devices, the observed anomalies, the relevant time period, and any changes already made are particularly important. From this, it can be determined which security and investigation method is professionally appropriate for the specific case.

Further in-depth information on computer forensics, smartphone forensics, digital evidence and investigation methods can be found in our knowledge database.