Potential unauthorized access to a smartphone, missing messages, unknown account activity, or confidential data suddenly appearing outside the intended circle of people: Digital incidents often begin with isolated anomalies. However, whether these actually involve manipulation, unauthorized access, or data leakage can only be assessed by examining the available technical evidence.

For clients in Aachen, we examine smartphones, computers, data storage devices, and other digital evidence . For private individuals, the focus is often on mobile phone forensics, deleted communications, potential unauthorized access, and digital disputes following a separation. Companies require support in cases such as data theft, cyber incidents, internal suspicions, or the potential leakage of research, development, and business data.

Aachen possesses a unique local context for this. Science, universities, research, high-tech companies, and technology-oriented start-ups shape the location. Where software, research data, technical developments, project documents, and sensitive know-how are processed digitally, individual file system traces, user activities, or account accesses can have significant investigative value.

IT forensics in Aachen – technically reconstructing digital processes

Professional IT forensics begins with a specific question. Was a smartphone actually compromised? Can deleted messages still be technically recovered? Was development data transferred to an external medium? Which systems were affected by a cyber incident?

Only then is it determined which devices and data sources are actually relevant. This avoids evaluating large datasets without a clear research purpose.

It is important to distinguish between technical findings and interpretation. A connected USB stick does not prove data theft. An unknown login does not automatically identify the person behind the access. Unusual smartphone behavior alone is also not proof of spyware.

Mobile phone forensics for private individuals in Aachen

Smartphones are among the most important personal data storage devices today. Messengers, photos, emails, contacts, user accounts, app data, and cloud connections can contain relevant digital traces in cases of private conflicts or security concerns.

Typical private investigation questions include:

• Could another person possibly have access to my smartphone?
• Are there any indications of spyware or manipulation?
• What unknown devices or account connections exist?
• Can deleted WhatsApp messages be examined?
• Can deleted photos or other data still be recovered?
• Are digital access channels still available after a separation?
• What data can be secured for legal proceedings?

The information that is technically available depends on the model, operating system, encryption, security status, and device configuration. Our section on smartphone forensics provides a more in-depth overview.

Phone hacked or monitored – what can really be determined?

If surveillance is suspected, the search should not automatically focus solely on classic spyware. Especially in private settings, much simpler access methods are also possible: known passwords, still-authorized devices, shared Apple or Google accounts, cloud synchronizations, or previous permissions.

Depending on the device, a forensic investigation can include applications, permissions, system artifacts, user accounts, and other technically relevant information.

The decisive factor remains an open-ended assessment. If no reliable evidence of unauthorized access can be found, this result is also part of a proper investigation.

Forensic analysis of WhatsApp and Messenger

Messenger communication can be just as important in private disputes as in business investigations. A forensic analysis goes beyond simply examining a visible chat.

Depending on the data set, messages, timestamps, participant information, media, documents, and other technical artifacts may be relevant. The origin of the data is particularly important: a screenshot has a different technical significance than data from a verifiably secured original source.

Our knowledge article "Forensic analysis of WhatsApp messages" explains this in more detail.

Can deleted messages or photos be recovered?

Data recovery may be possible under certain conditions, but it cannot be guaranteed. Modern smartphones use encryption, flash memory, and complex data structures. The crucial factor is whether any usable information, older databases, or backups remain after deletion.

If an examination is planned, the device should ideally not be reset or used unnecessarily. Reinstalling apps can also alter existing data structures.

iPhone, Android and mobile forensics

iPhones and Android devices have different technical requirements. For Apple devices, the model, iOS version, encryption, and device condition particularly influence the investigation. For Android devices, differences between manufacturers, chipsets, operating system versions, and security mechanisms also come into play.

Depending on the device, mobile investigations can be carried out using, among others, Cellebrite UFED, MOBILedit Forensic, MEFF 3 PRO and other specialized systems.

Computer forensics – more than just a file search

With computers, it's often not just interesting whether a file exists. Crucial factors can include when it was created, opened, modified, or deleted, what user activities took place during the same period, and which external devices were connected to the system.

Depending on the operating system, file system information, event logs, browser data, user profiles and other technical artifacts can be combined.

For more in-depth information, see the article "What is Computer Forensics?".

Aachen as a science and high-tech location

Aachen boasts an exceptionally strong science and technology sector. Research, artificial intelligence, production engineering, mobility, energy, medical technology, and digitalization shape the city's character. Simultaneously, numerous technology-oriented companies and startups emerge from universities and research environments.

For digital forensics, this means that particularly valuable information is often intangible. Source code, research findings, technical specifications, development data, algorithms, project documentation, or internal test data can have considerable economic value.

Such information is often not stored on a single device. Notebooks, desktop computers, smartphones, servers, cloud platforms, and other enterprise systems can each document different parts of a process.

Research and development data as digital evidence

Research data is often generated over extended periods and through numerous processing steps. Files are modified, versioned, synchronized, and exchanged between different systems.

In cases of suspected data leakage, it is therefore not only relevant whether a specific file existed. Timestamps, user activity, external storage devices, and other system traces can also be crucial for reconstruction.

A technical process should not automatically be interpreted as proof of a specific intention. For example, the fact that a research document was opened does not prove that it was subsequently passed on to third parties.

IT forensics for companies, research institutions and start-ups in Aachen

Typical questions for investigation might include:

• Was any confidential development data copied or deleted?
• Which external storage devices were used?
• Were there any unusual file activities prior to the employee change?
• Has a business user account been compromised?
• Which systems contain relevant traces of a cyber incident?
• Was project data processed via external services or cloud systems?

In research- and technology-oriented companies, the investigation should be limited as precisely as possible. This allows relevant systems to be secured in a targeted manner without evaluating unnecessarily large amounts of research or personnel data.

Data theft and loss of know-how

The potential loss of development knowledge can have a significantly greater economic impact than the loss of a single file. Research findings, source code, technical documentation, or internal project data can represent years of development work.

If there are concrete indications of a possible data breach, depending on the circumstances, workplace computers, notebooks, company mobile phones, external data storage devices, user accounts and other digital sources may be relevant.

However, the assessment must always be based on the entire body of evidence. The mere connection of an external storage device does not prove that specific data was copied.

Cyber ​​forensics in complex IT security incidents

Following a cyberattack, damage control and evidence preservation must be effectively combined. A premature reinstallation can alter relevant traces; at the same time, a compromised system should not be unnecessarily operated for purely forensic reasons.

Depending on the incident, end devices, user accounts, system logs, email data, or cloud information can document different parts of the attack.

Which data sources are actually needed depends on the specific attack scenario and the investigation objective.

Digital evidence preservation and integrity

A reliable analysis requires a verifiable data foundation. The backup method must be appropriate for the specific object under investigation. Smartphones, SSDs, traditional storage media, and cloud data do not necessarily require the same approach.

With appropriate backups, hash values ​​can be used to verify the subsequent integrity of a defined dataset. However, integrity does not automatically imply authenticity or authorship.

Our knowledge base article on the integrity of digital evidence explains this distinction in more detail.

Chain of Custody – the path of the evidence must remain traceable.

In investigations relevant to evidence, it is not enough to simply consider the subsequent analysis report. It can be equally important to be able to trace which device was examined, when the data was backed up, and how the resulting data was subsequently processed.

Technical integrity checks and the chain of custody fulfill different functions. A hash value verifies a data set; the chain of custody documents how the evidence is handled.

Specialized forensic tools

Depending on the device and the question at hand, tools such as Cellebrite UFED, Cellebrite Collector, Cellebrite Inspector, X-Ways Forensics, MOBILedit Forensic and MEFF 3 PRO, as well as other specialized tools, can be used.

The software is merely a tool. An automatically generated hit is not a complete expert assessment. What matters is the origin of an artifact, how it was created, and what conclusions can actually be drawn from it technically.

Certified quality and expert competence

LB Detektive GmbH has a quality management system certified by TÜV NORD according to DIN EN ISO 9001, the scope of which includes IT forensics. In addition, the expert is certified according to DIN EN ISO/IEC 17024.

This combines organizationally defined quality processes with demonstrably proven expert competence. For clients, transparent investigation procedures, controlled handling of evidence, and an understandable professional assessment are particularly relevant.

Typical examination situations in Aachen

Private individual: Suspicion of unauthorized access after a separation

Another person appears to still have access to personal information. Instead of automatically assuming spyware, the smartphone, user accounts, connected devices, and other technically plausible access points are examined.

Start-up: Development data may have leaked

Shortly before an employee leaves, unusual file activity is noticed. The relevant time period is narrowed down, and then it is examined which systems, files, and external storage devices are actually relevant to the issue at hand.

Research environment: Project data appears outside the intended circle

Instead of examining all research data, the project, time period, and potentially relevant systems are defined first. Existing technical traces can then be specifically evaluated.

How does an IT forensic investigation proceed?

1. Define the question

First, it is defined which specific digital process is to be examined.

2. Identify relevant systems

Only devices, data carriers and accounts with a direct connection to the investigation question will be included.

3. Secure data properly

The backup procedure is adapted to the device, operating system, and initial technical situation.

4. Analyze digital traces

Relevant artifacts are examined and, if necessary, compared with other data sources in terms of timing and content.

5. Document results

Depending on the assignment, the findings can be compiled into a structured investigation report or expert opinion.

What should be avoided before an examination?

• Do not hastily reset a potentially compromised smartphone.
• Do not remove suspicious applications yourself.
• Do not install any unknown cleanup or spyware programs.
• Use devices with deleted data as little as possible.
• Do not unnecessarily modify company computers if there is a concrete suspicion of data leakage.
• Document security alerts and relevant anomalies.

IT forensics in Aachen and our areas of operation in the region

Our service area includes Aachen, Würselen, Herzogenrath, Alsdorf, Eschweiler, Stolberg, Roetgen, Simmerath, and other locations in the Aachen city region. Due to our location in the Rhineland, we also have close ties to Düren, Mönchengladbach, Cologne , and Düsseldorf.

Private individuals, companies, law firms and research institutions from the region can have both individual smartphones and computers as well as more complex cases with multiple digital pieces of evidence examined.

Frequently asked questions about IT forensics in Aachen

Can I, as a private individual, commission a mobile phone forensics analysis?

Yes. Typical private questions concern possible unauthorized access, deleted communications, smartphones, user accounts, and digital evidence in personal or legal disputes.

Is it possible to determine if my smartphone has been hacked?

Existing technical indications of possible unauthorized access can be investigated. Whether a compromise can actually be proven depends on the device, operating system, possible access method, and the remaining data.

Can deleted WhatsApp messages be recovered?

Under certain circumstances, usable data remnants or older backups may still exist. However, a complete recovery cannot be guaranteed.

Can a company have it checked whether development data has been copied?

Depending on the system, file activity, external storage devices, and other technical artifacts can be examined. Whether a specific copying operation can be proven depends on the total amount of available evidence.

Can research data be forensically examined?

Yes. Crucially, the question must be precisely defined so that only truly relevant data sources and systems are examined.

Can the connection of a USB stick be proven?

Under certain conditions, computer systems can contain traces of connected USB devices. However, proof of the connection is not automatically proof of the transfer of specific files.

Can cyberattacks be investigated retrospectively?

This may be possible if suitable data sources are still available. Which systems and information are relevant depends on the specific incident.

What does integrity of digital evidence mean?

Integrity describes the verifiable unalteration of a defined dataset compared to a documented reference state. However, it alone says nothing about whether the data had already been manipulated before it was backed up.

Can an expert report be prepared?

Yes. Depending on the task, an IT forensic expert report can be prepared in addition to a technical investigation report.

How much does an IT forensic investigation cost in Aachen?

The effort required depends on the specific question, the number of devices, the amount of data, technical accessibility, and the desired documentation. Therefore, in more complex cases, the actual scope of the investigation is first defined.

Request IT forensics services in Aachen

Whether it's a compromised smartphone, deleted communication, possible unauthorized access, data leakage or a cyber incident: For an initial assessment, the affected device or system, the specific anomaly, the relevant time period and possible changes since the event are particularly important.

Based on this, it can be determined which digital evidence is actually needed and which preservation and analysis method is appropriate for the specific case. Further in-depth technical information can be found in our knowledge database on digital forensics.