Do you suspect someone has access to your smartphone? Does a former partner know private information they shouldn't? Have WhatsApp messages been deleted, are unknown devices appearing in your user account, or do you want to secure digital data for a legal dispute?

Such situations are among the most common reasons why private individuals contact IT forensics experts . However, anomalies alone do not constitute technical proof. The goal of a professional investigation is therefore not to confirm an existing suspicion, but to determine which digital traces are actually present and which conclusions can be drawn from them in a professional manner.

LB Forensik supports private individuals, companies, lawyers, and other clients in Switzerland with the securing and examination of digital evidence. In particular, smartphones, computers, laptops, data storage devices, and other relevant digital data sources can be examined.

Especially in private cases, discretion is crucial. Personal communication, photos, messenger data, and other sensitive information are not routinely analyzed. The scope of the investigation is determined based on the specific questions being asked.

IT forensics for private individuals in Switzerland

Digital forensics is no longer solely a topic for companies or law enforcement agencies. A significant portion of our investigations concerns private matters.

The smartphone plays a central role in this. It combines communication, photos, messaging, email, social networks, cloud services, user accounts, and numerous personal information on a single device.

Typical questions from private customers are:

• Has someone secretly accessed my smartphone?
• Has my iPhone or Android smartphone possibly been compromised?
• Are there any indications of spyware or stalkerware?
• Can my former partner still access personal data?
• Which unfamiliar or unknown devices are linked to my accounts?
• Can deleted WhatsApp messages be examined?
• Is it possible to recover deleted photos or other files?
• Can a specific chat be technically audited?
• How can digital evidence be secured for a legal dispute?

The available investigative options depend on the specific device and the available data. We explain the fundamentals in detail in our knowledge base on smartphone forensics.

Is it possible to determine if a mobile phone has been hacked or monitored?

Anyone who suspects their smartphone is being monitored understandably often looks for spyware first. However, unwanted data sharing can actually have many more causes.

Possible access routes could include, for example:

• known or compromised passwords,
• still authorized smartphones, tablets or computers,
• Apple or Google accounts,
• Cloud synchronizations,
• linked messenger devices,
• continued active sessions,
• unusual app permissions
• or actually installed unwanted software.

Therefore, an investigation should not be limited to searching for a single monitoring app. Depending on the device, applications, permissions, user accounts, system information, and other technical artifacts can be analyzed.

What is important here is the open-endedness of the outcome: High battery consumption, a warm smartphone or unusual data usage are not in themselves proof of surveillance.

My ex-partner may have access to my smartphone

Suspicions arise particularly often after a breakup. A former partner appears to possess information about conversations, whereabouts, contacts, or private communication.

In such situations, one should not automatically assume the presence of professional spyware. Those who have previously set up devices together, shared passwords, or used family and cloud features may have unintentionally created long-term digital access points.

Depending on the specific question, not only the smartphone itself may be relevant. Connected user accounts, synchronized devices, or messenger links can also be included in the technical assessment.

The aim is to systematically examine possible access routes and to separate technical findings from mere assumptions.

Spyware and stalkerware on smartphones

Suspected spyware is among the most sensitive private investigation cases. A thorough forensic assessment should neither prematurely give the all-clear nor infer surveillance from everyday smartphone anomalies.

Whether suspicious software, unusual configurations, or other relevant artifacts can be detected depends, among other things, on the operating system, device model, software version, possible extraction method, and the time of the suspected access.

Equally important is the scope of the investigation: A negative finding initially means that no corresponding usable evidence was found within the examined database. It is not automatically proof that unauthorized access never occurred.

WhatsApp messages as digital evidence

WhatsApp often plays an important role in private disputes, breakups, threats, fraud cases and other conflicts.

A professional WhatsApp analysis is not limited to simply reading a chat on the screen. Depending on the available extraction tools, messages, timestamps, participant information, media, documents, group information, and other technical artifacts can be examined.

The difference to a simple visual inspection is significant. A screenshot only documents a visible representation. A forensic data source can contain additional technical information that is important for chronological and factual classification.

We discuss this in detail in the article "Forensic analysis of WhatsApp messages".

Can deleted WhatsApp messages be recovered?

Under certain circumstances, deleted messages or remaining artifacts may still exist. However, a blanket guarantee of recovery would be technically irresponsible.

The chances of success depend, among other things, on the smartphone, operating system, state of the WhatsApp database, existing backups, encryption, and further use after deletion.

For example, an older backup may contain a data state in which messages were still present that are no longer visible on the current smartphone.

That's precisely why you shouldn't experiment with important deleted data. Reinstalling WhatsApp, resetting your smartphone, or unnecessary continued use can change the situation.

Deleted photos, videos and other personal data

Besides messenger messages, photos, videos, documents or other files are often the subject of an investigation.

Whether deleted content can be recovered depends heavily on the specific storage architecture. Modern smartphones use flash memory, encryption, and complex data erasure mechanisms. Therefore, traditional notions of easily recovering deleted files cannot be readily applied to current mobile devices.

However, additional data sources can be relevant. These include, for example, backups, cloud synchronizations, messenger media, or other connected devices.

iPhone forensics for private customers from Switzerland

On an iPhone, factors such as device model, iOS version, security configuration, encryption, and device condition determine which data is technically accessible.

Modern iPhones cannot be treated like a traditional hard drive. Depending on the specific situation, different extraction and backup methods are available.

An investigation may be useful, for example, in cases of suspected unauthorized access, compromised accounts, messenger-related issues, deleted communication, or to secure relevant data.

Further technical information can be found under What is iPhone forensics?

Android forensics – different manufacturers, different possibilities

The technical landscape for Android smartphones is particularly diverse. Samsung, Google, Xiaomi, Honor, and other manufacturers combine different hardware and security architectures with various Android versions.

Therefore, it is not possible to predict in general which extraction method is available for every Android device. Model, chipset, operating system, patch level, encryption, and security status must be considered individually.

The basics are explained in our article "What is Android forensics?".

Computer forensics for private cases

Not every private digital incident involves only a smartphone. A MacBook, Windows PC, or notebook may contain additional information.

Examples of relevant information include browser activity, user accounts, file system information, connected devices, programs, or other system artifacts.

The combination of different devices can also be crucial. For example, if WhatsApp or other services were also used on a computer, further local traces may be present there.

You can find more information under What is Computer Forensics?.

Phishing, online fraud and compromised accounts

Even after phishing, smishing, or other forms of online fraud, a technical investigation can be useful. The first step should be to clarify what question needs to be answered.

Examples of relevant data include SMS messages, emails, browser data, visited websites, downloads, communication histories, and other technical traces.

However, a smartphone analysis does not automatically identify the perpetrators behind a fraud case. Rather, technical traces can help to document the sequence of events in a comprehensible way and to secure existing digital leads.

Securing digital evidence for lawyers, criminal charges, or legal disputes

Private clients often contact an IT forensics expert not just because of a technical problem. The information obtained may later be used with a lawyer, an insurance company, a government agency, or in court proceedings.

In these cases, the method of data backup becomes particularly important. It should be traceable which device was examined, which database was used, when the backup was performed, and which investigative steps were carried out.

A screenshot can be a relevant document, but it has a different technical significance than a verifiably secured original data source.

Further background information is explained under Integrity of digital evidence.

Forensic software for various investigation tasks

Digital forensics requires different tools because smartphones, computers, and data storage devices represent technically completely different objects of investigation.

Depending on the task, we work with specialized solutions from Cellebrite as well as X-Ways Forensics, MOBILedit Forensic and MEFF 3 Pro, among others.

Cellebrite Inseyets

Cellebrite Inseyets particularly supports investigation and analysis processes in the field of mobile digital data. Depending on the device and available extraction capabilities, large amounts of smartphone data can be structured and processed, and relevant artifacts can be specifically examined.

Cellebrite Digital Collector

Cellebrite Digital Collector can be used for the controlled acquisition of relevant data sets for computer and data storage device investigations. The most suitable acquisition method depends on the hardware, operating system, encryption, and device condition.

Cellebrite Inspector

Cellebrite Inspector is used for the further examination and processing of digital data from computers and other data sources. This allows relevant artifacts within large datasets to be analyzed in a structured manner.

X-Ways Forensics

X-Ways Forensics enables detailed examinations of data carriers, file systems, partitions, and other computer forensic structures. This can be a particularly important addition for in-depth file system analyses.

MOBILedit Forensic and MEFF 3 Pro

MOBILedit Forensic and MEFF 3 Pro are also used for suitable mobile investigations. Several specialized systems make it possible to tailor the investigation method more closely to the specific device and the particular question being addressed.

However, the number of programs used is not the decisive factor. Forensic software provides data and technical artifacts. Only their expert examination, correlation, and interpretation result in a reliable finding.

Why multiple forensic programs can be useful

No single forensic program is equally suitable for every smartphone, every operating system, and every question.

Different tools can process the same data source differently or display certain artifacts differently. Therefore, for important findings, an additional technical review with another tool may be advisable.

Software does not replace expert assessment. An automatically generated report is not a professional expert opinion.

Forensic data backup instead of simple data copying

Before data can be analyzed, a decision must be made on how the respective object of investigation can be meaningfully secured.

With traditional storage media, sector-by-sector or block-by-block backup is possible under suitable conditions. Modern smartphones, however, require different extraction methods. Cloud data, in turn, is backed up via other technical access methods.

Therefore, forensic data backup does not necessarily mean that an identical bit-for-bit copy can be created from every device.

Hash values ​​and integrity

For suitable datasets, cryptographic hash values ​​can be used to verify the continued integrity of a backup.

An identical hash value can show that two defined data sets are bit-identical. However, it proves neither the truth of the content nor the identity of the person who performed a particular action.

Professional digital forensics therefore separates integrity, authenticity, authorship, and content evaluation.

IT forensics for Swiss companies and law firms

In addition to private individuals, we support companies, lawyers and other professional clients from Switzerland with digital forensic issues.

This could include, for example:

• Suspected data theft,
• potential leakage of confidential company data,
• Investigations following employee changes,
• USB and data carrier analysis,
• deleted or manipulated files,
• compromised computers or user accounts,
• Cyber ​​incidents,
• Smartphone studies
• and the securing of digital evidence.

Especially in corporate cases, a clearly defined investigative question is crucial. The technical investigation should focus on the truly relevant devices, data sources, and time periods.

Can data theft by an employee be proven?

Under suitable conditions, digital traces can provide clues to a potential data breach. Relevant examples include file access, external storage devices, cloud applications, browser activity, or other system artifacts.

However, the significance of individual pieces of evidence should not be overestimated. Proof that a USB stick was connected does not necessarily prove that specific company data was copied onto it.

Only the combination of different technical artifacts can potentially make it possible to reconstruct a more concrete sequence of events.

Certified processes and expert competence

LB Detektive GmbH has a quality management system certified by TÜV NORD according to DIN EN ISO 9001, the scope of which includes IT forensics. In addition, the expert is certified according to DIN EN ISO/IEC 17024.

These two levels must be distinguished. DIN EN ISO 9001 concerns defined quality management processes. Personnel certification according to DIN EN ISO/IEC 17024 refers to the proven competence of the certified person.

For clients, structured investigation procedures, comprehensible documentation and a professionally justified evaluation of the technical findings are particularly important.

Three typical cases from IT forensics for private individuals

Suspicion of surveillance after a breakup

A former partner may still have access to information from one's private life. The investigation is not limited to suspected spyware. Depending on the circumstances, bank account details, linked devices, and other technically plausible access points are also considered.

Deleted WhatsApp communication becomes a point of contention

Certain messages are no longer visible on the smartphone but could be relevant to a legal dispute. First, the available data sources and extraction methods are examined. Then, existing WhatsApp databases, media, or accessible backups can be analyzed.

Unknown account activity following a phishing incident

Unusual activity occurs after a link is opened. Instead of automatically assuming that the entire smartphone has been compromised, the timeline and available technical traces are examined. This allows a distinction to be made between verifiable findings and assumptions.

How does an IT forensic investigation proceed for Swiss clients?

1. Confidential initial assessment

First, it is clarified what happened, which device is affected, and which specific question needs to be answered.

2. Technical starting point

Device model, operating system, device status, encryption, and other relevant factors are recorded. This determines which security options are technically appropriate.

3. Takeover and documentation

In cases involving evidence, equipment and relevant handovers are documented in a traceable manner. For cross-border shipments or deployments in Switzerland, the necessary organizational and legal frameworks are clarified in advance.

4. Forensic Securing

The data is backed up using a method appropriate for the respective device. The procedure for backing up a smartphone can differ significantly from backing up a computer or traditional storage medium.

5. Analysis

The generated data sets are evaluated based on the specific research question. Relevant artifacts are classified chronologically and technically and, if necessary, correlated with other traces.

6. Documentation of the results

Depending on the assignment, the results can be presented in an investigation report or in more detailed expert documentation.

What should you not do before a smartphone examination?

Understandably, private individuals often try to find out for themselves what happened to their smartphone. However, in a potential case involving the preservation of evidence, well-intentioned measures can alter existing evidence.

• Do not reset your smartphone to factory settings prematurely.
• Do not delete suspicious apps yourself.
• Do not install any unknown anti-spyware programs.
• Do not reinstall WhatsApp if relevant messages have been deleted.
• Do not overwrite existing backups without prior verification.
• Use the device as little as possible after data has been deleted.
• Document any anomalies and security alerts whenever possible.

Further use can alter databases, logs, and other artifacts. Therefore, the original device state can be important, especially with deleted or older data.

IT forensics for the whole of Switzerland

Our services are aimed at private individuals, companies and lawyers throughout Switzerland. This includes, in particular, clients from Zurich, Basel, Bern, Lucerne, St. Gallen, Winterthur, Zug, Schaffhausen, Aarau, Solothurn, Lausanne, Geneva and other regions.

Whether an investigation is organized by sending the evidence, a coordinated takeover, or, in more complex cases, by an operation, depends on the specific task and the devices involved.

Especially in cross-border investigations, it is clarified in advance how equipment and data can be properly transferred and what organizational framework conditions must be taken into account.

Frequently asked questions about IT forensics in Switzerland

Can I, as a private individual from Switzerland, commission a mobile phone forensics analysis?

Yes. Private smartphone investigations are a core area of ​​our IT forensics. Typical questions concern unauthorized access, suspected spyware, ex-partners, deleted communications, compromised accounts, or securing digital evidence.

Is it possible to determine if someone has access to my phone?

Depending on the device and available data, technically relevant clues to possible access routes can be investigated. However, a thorough investigation cannot guarantee the detection of every instance of previous unauthorized access.

Can spyware be detected on an iPhone?

Existing technical information can be examined. Its significance depends, among other things, on the iPhone model, the iOS version, the potential attack scenario, and the available data.

Can my ex-partner monitor my smartphone without installing spyware?

This is fundamentally possible. Shared or known login credentials, linked devices, cloud accounts, and other authorizations can represent alternative access routes. Therefore, an investigation should not be limited solely to spyware.

Can deleted WhatsApp messages be recovered?

Under certain circumstances, messages or residual artifacts may still be present. However, a complete recovery cannot be guaranteed.

Can a WhatsApp screenshot be technically verified?

A screenshot itself contains only limited technical information. If the original smartphone or a suitable database is available, it can be checked whether corresponding communication artifacts are present.

Can deleted photos be recovered?

This depends on the device, storage system, deletion time, further use, and possible additional data sources. Modern smartphones differ significantly from traditional hard drives in this respect.

Do I need to be able to unlock my smartphone for the examination?

A known device code or available access credentials can significantly improve investigation capabilities. What data is accessible without this information depends on the specific device and its security status.

Can I send my device from Switzerland for examination?

The specific handover or shipment will be agreed upon in advance. For cross-border transactions, transport, documentation, and any applicable customs and data protection regulations must be taken into account.

Can the investigation be used in court proceedings?

Digital investigation results can be relevant for legal proceedings. Crucial factors include the origin of the data, the method of data storage, integrity, documentation, and the scientific validity of the findings. The competent legal authority ultimately decides on the specific legal admissibility of the results.

Will my entire smartphone be searched?

Not necessarily. A professional investigation should be guided by the specific question at hand. Especially with personal devices, this can prevent the unnecessary evaluation of personal data without any objective relevance.

How long does an examination take?

The duration depends on the device, data volume, extraction capabilities, and scope of the investigation. A single, clearly defined smartphone-related question differs significantly from a complex investigation involving multiple devices and data sources.

How much does IT forensics cost for private individuals?

The costs depend on the equipment, the specific question being asked, technical accessibility, data volume, and desired documentation. Therefore, before undertaking a comprehensive analysis, it should first be clarified what scope of investigation is actually necessary for the specific question.

Request confidential IT forensics services in Switzerland

If you suspect that your smartphone has been compromised, that another person still has access to personal information, or that digital data needs to be secured for a dispute, the technical situation should first be clarified.

For an initial assessment, the device model, operating system, specific anomalies, relevant time period, and any changes already made are particularly important. Based on this information, it can be determined which backup and investigation method is appropriate for the specific case.

Further easily understandable information on smartphone forensics, WhatsApp, computer forensics and digital evidence preservation can be found in our knowledge database on digital forensics.