Unknown access to a smartphone, missing messages, suspicious account activity, or personal information suddenly revealed to third parties: Digital incidents often begin with suspicion. However, this alone is insufficient for a reliable investigation. What matters is identifying the actual technical traces present on smartphones, computers, storage devices, or linked accounts.

Our IT forensics services in Hanover support individuals, companies, lawyers, and other clients with the professional securing, analysis, and evaluation of digital evidence. For private clients, the most common issues involve smartphone forensics , deleted communications, potential unauthorized access, compromised accounts, or digital disputes following a separation. Companies require forensic support in cases such as data leaks, employee-related incidents, cyberattacks, or suspicious activity within their IT systems.

The focus is not on extracting the largest possible amount of data, but on a clearly defined research question. Digital traces are secured, technically classified, and documented in such a way that it remains comprehensible how a result was obtained.

IT forensics in Hanover: Systematically examining digital traces

A conspicuous smartphone does not, in itself, prove surveillance. A connected USB storage device does not, by itself, prove data theft. And an unknown login does not automatically reveal which person actually accessed a user account.

Professional IT forensics therefore distinguishes between suspicion, technical findings, and expert assessment. Depending on the circumstances, system artifacts, apps, user accounts, file system information, communication data, external storage devices, email systems, or cloud services may contain relevant traces.

This approach is particularly important if the results need to be presented in a comprehensible manner to lawyers, companies, insurance companies or courts later on.

Mobile phone forensics for private individuals in Hanover

Today, the smartphone is one of the most important personal data storage devices. Messages, photos, contacts, emails, location information, cloud connections, and numerous user accounts all converge on a single device. Consequently, the digital footprint can be extensive.

A forensic investigation can be useful, for example, in the following cases:

• Suspected unauthorized access to the smartphone
• possible spyware or other manipulation
• unknown devices or account connections
• deleted WhatsApp messages or other messenger data
• deleted photos, videos, or contacts
• digital conflicts after separation or divorce
• suspicious access to personal accounts
• Securing digital information for legal disputes

The specific data that can actually be obtained depends on the device, operating system, security status, and available extraction methods. Further information can be found on our Mobile Forensics page.

Is it possible to determine if a smartphone has been hacked?

A forensic examination can analyze existing technical traces of possible unauthorized access. Depending on the device, system artifacts, apps, permissions, account connections, and other relevant data are examined.

High battery consumption, device overheating, or unusual data traffic do not, in themselves, prove surveillance. Such symptoms can have numerous normal technical causes. What matters are objectively verifiable traces and their expert evaluation.

A negative result is also possible: If no reliable technical evidence can be found to support a suspected unauthorized access claim, this must be documented just as clearly.

Digital access after separation or divorce

Especially after a breakup, spyware is often the first thing people suspect. However, access can actually occur through much simpler means. Previously shared Apple or Google accounts, known passwords, family sharing, synchronized devices, email accounts, or cloud storage can still provide access points.

Therefore, we don't focus solely on the smartphone. First, we determine which devices, accounts, and services might be relevant to the specific suspicion. This allows us to narrow down the investigation and avoid unnecessary analysis of personal data.

Deleted WhatsApp messages, photos and other data

Deleted data cannot be automatically recovered. Modern smartphones use encryption, flash memory, and automated storage processes that can significantly impact recovery.

For messenger data, existing app databases, media, or backups may be relevant, depending on the device. Whether a complete or partial reconstruction is possible can only be assessed based on the specific device.

If important data has been deleted and a later investigation is planned, the device should not be used unnecessarily or reset to factory settings.

iPhone, Android and tablet forensics

The technical capabilities vary considerably between individual mobile devices. For an iPhone, factors such as the model, iOS version, encryption, and device condition are relevant. For Android devices, additional factors include different manufacturers, chipsets, Android versions, and security configurations.

Therefore, before a comprehensive analysis, the technical specifications of the respective device are first assessed. Depending on the system, tools such as Cellebrite UFED, MOBILedit Forensic, MEFF 3 PRO, and other specialized tools can be used for extracting and examining mobile data.

Besides smartphones, tablets can also contain relevant digital evidence . You can find more information in the Tablet Forensics section.

Computer forensics for individuals and companies

Windows PCs, laptops, and Macs can contain far more information than the files that are immediately visible. Depending on the operating system and the specific question being investigated, file system information, user activity, browser data, connected storage devices, and other system artifacts can be relevant.

For private individuals, this might involve suspected unauthorized access, deleted files, or the backup of relevant information. Companies often require computer forensics in cases of internal suspicion, data leaks, or cyber incidents.

For such investigations, tools such as Cellebrite Collector, Cellebrite Inspector and X-Ways Forensics, as well as other specialized tools, are available.

Hanover as a business location: Protecting digital information and investigating incidents

Hanover connects industry, services, trade, the insurance sector, technology, and a diverse range of medium-sized businesses. Companies of all sizes today operate with networked IT systems, mobile workplaces, and cloud services. As a result, relevant digital traces in the event of a security incident are often distributed across multiple systems.

Customer and contract data, personnel information, technical documents, internal communication, calculations and business know-how can be affected, as well as access data or user accounts.

A forensic investigation must therefore first clarify which information is relevant to the specific incident and on which devices or systems corresponding traces may be present.

IT forensics for companies in Hanover

An internal security incident is not just a technical problem. It can raise issues related to labor law, data protection, economics, and liability. Therefore, a verifiable and reliable method of documenting evidence should be considered as early as possible.

Typical research questions include:

• Was confidential company data copied?
• What external storage devices were used with a computer?
• Were there any unusual file activities prior to changing employers?
• Has a user account been accessed without authorization?
• Were any files deleted or modified?
• Which systems were affected by a cyber incident?

If you have a concrete suspicion of the leakage of confidential information, you can find further information in our section on data theft.

Employee incidents and potential data leaks

Cases can be particularly time-critical immediately before or after an employee's departure. If there is concrete suspicion that confidential files have been copied, deleted, or transferred to external systems, it is crucial to investigate early on which devices and data sources need to be preserved.

Depending on the circumstances, workplace computers, notebooks, company mobile phones, USB storage devices, user accounts, email systems or cloud services may be relevant.

A single artifact should not be overinterpreted. For example, the connection of a USB storage device does not prove that specific files were copied. A reconstruction becomes more conclusive when several technical traces fit together chronologically and thematically.

Cyberattacks and compromised IT systems

Following a cyberattack, damage control and evidence preservation must be coordinated. A premature reinstallation can alter relevant evidence. At the same time, a compromised system should not be unnecessarily continued to operate solely for the purpose of preserving evidence.

Depending on the incident, end devices, user accounts, system logs, email data, or cloud information may be examined. The goal is to reconstruct the technical sequence of events as far as possible based on the available data.

Forensic evidence preservation: Integrity before analysis

The quality of a digital investigation begins with data backup. The method must be appropriate for the specific object being investigated. Traditional storage media require different procedures than smartphones, SSDs, encrypted Macs, or cloud systems.

With appropriate security measures, cryptographic hash values ​​can be used to verify the integrity of a data set. Similarly, a documented chain of custody can be relevant to ensure traceability of when an object of investigation was received, secured, and processed.

We discuss these principles in more detail in our article "Digital Forensics and Verifiable Quality".

Specialized tools for different types of evidence

No single forensic program covers smartphones, computers, storage media, and different operating systems equally well. Therefore, depending on the object being examined, tools such as Cellebrite UFED, Cellebrite Collector, Cellebrite Inspector, X-Ways Forensics, MOBILedit Forensic, and MEFF 3 PRO, as well as other specialized tools, are used.

However, software alone does not determine the quality of a study. A tool can extract and structure data. The professional task lies in identifying relevant artifacts, examining correlations, and correctly assessing the limitations of a finding.

Certified quality and expert competence

LB Detektive GmbH has a quality management system certified by TÜV NORD according to DIN EN ISO 9001, the scope of which includes IT forensics. In addition, the expert is certified according to DIN EN ISO/IEC 17024.

This combines two distinct levels of quality: defined organizational processes and demonstrably qualified expert competence. Especially when dealing with sensitive digital evidence, transparent procedures, controlled handling of evidence, and expert evaluation are essential components of the investigation.

Typical cases examined in Hanover

Private: Suspicion of access by a former partner

After a breakup, it appears the former partner still possesses personal information. Instead of automatically assuming spyware, potential access points via smartphones, user accounts, synchronized devices, and known login credentials are examined first. The technical investigation is then narrowed down to the relevant systems.

Private: Deleted communication is required

For legal proceedings, messages that are no longer visible need to be examined. Crucial factors are the device used, the messaging app, the time of deletion, and available data sources. Only with this information can it be assessed whether reconstruction is technically feasible.

Company: Suspected data theft

Shortly before a change of employer, unusual file activity was detected. Depending on the specific system, file system information, user activity, and external storage devices can be examined and compared over time.

How does an IT forensic investigation proceed?

1. Define the research question

First, it is clarified what technical data is to be determined and which time period is relevant.

2. Determine devices and data sources

Only smartphones, computers, data storage devices or accounts relevant to the question at hand will be included in the investigation.

3. Secure data forensically

The backup method depends on the object under investigation, the operating system, and the technical condition.

4. Analyze digital traces

Relevant artifacts are evaluated and, if necessary, compared with other data sources in terms of timing and content.

5. Document results

Depending on the assignment, the findings are compiled in a structured investigation report or expert opinion.

What should be avoided before an examination

• Do not hastily reset a suspicious smartphone.
• Do not delete suspicious apps yourself.
• Do not install any unknown spyware scanners.
• Do not unnecessarily modify computers and data storage devices.
• If data has been deleted, use the device as little as possible.
• Document unknown logins and security alerts.

IT forensics in Hanover and our areas of operation

Our service area includes Hanover, the surrounding region, and other parts of Lower Saxony. This includes, among others, Garbsen, Langenhagen, Laatzen, Lehrte, Burgdorf, Neustadt am Rübenberge, Wunstorf, Celle, Hildesheim, Peine, Braunschweig, and Wolfsburg.

Private individuals, companies and lawyers from these fields of application can have both individual smartphones, computers or data carriers as well as more complex digital issues examined.

Frequently asked questions about IT forensics in Hanover

Can I, as a private individual, commission a mobile phone forensics analysis?

Yes. Private investigations can include smartphones, deleted communications, potential unauthorized access, user accounts, and digital evidence in personal disputes.

Is it possible to determine if my smartphone has been hacked?

A smartphone can be examined for existing technical traces of possible unauthorized access. Whether such access can actually be proven depends on the device, operating system, attack scenario, and the data still present.

Is it possible to check if my ex-partner still has access to my data?

Depending on the circumstances, relevant devices and account connections may be examined. In addition to potential malware, authorized devices, known login credentials, and synchronized accounts should also be considered.

Can deleted WhatsApp messages be recovered?

Under certain technical conditions, a complete or partial reconstruction may be possible. However, a successful restoration cannot be guaranteed.

Can an iPhone or Android smartphone be scanned for spyware?

Yes. However, the specific investigation options depend on the model, operating system, security status, and any existing technical traces.

Is it possible to determine if company data has been copied to a USB stick?

Traces of connected USB devices and relevant file activity may be present. Whether a specific copying operation of particular files can be proven must be assessed based on the overall evidence.

Can cyberattacks be investigated retrospectively?

This may be possible if suitable data sources are still available. Depending on the incident, end devices, user accounts, logs, email systems, or cloud data may be relevant.

Are expert reports also prepared?

Yes. Depending on the task at hand, an IT forensic expert report can be prepared in addition to an investigation report.

How much does an IT forensic investigation cost?

The costs depend primarily on the number and type of equipment, the amount of data, technical accessibility, the specific questions being investigated, and the required documentation. Therefore, in complex cases, the necessary scope is initially defined.

Request IT forensics services in Hanover

Whether it's a suspicious smartphone, possible unauthorized access, deleted communication, data leakage or cyberattack: For an initial assessment, the affected device, the specific abnormality, the relevant time period and possible changes since the incident are particularly important.

Based on this, it can be determined which data sources are actually needed and which backup and analysis method is suitable for the specific case. Further in-depth information can be found in our knowledge base on digital forensics.