A smartphone, laptop, or computer can contain crucial information, even if at first glance little is recognizable. Deleted communications, file accesses, user activity, app data, external storage media, and system artifacts can reveal technical connections. LB Forensik conducts professional IT forensic investigations of smartphones, computers, and other digital data sources for private individuals, companies, and lawyers in Bielefeld.

The focus is not on extracting the largest possible amount of data, but on the specific evidentiary question. Is the goal to determine whether WhatsApp messages still exist? Is there suspicion of unauthorized access? Have company files been deleted or possibly copied? Or does it need to reconstruct activity on a computer within a specific timeframe?

For data preservation and analysis, we use specialized forensic solutions depending on the data source and the investigation objective. These include, among others, Cellebrite, X-Ways Forensics, Belkasoft, and MOBILedit Forensics. Relevant results are not evaluated solely based on software displays, but rather on the underlying digital artifacts and their technical context.

IT forensics for Bielefeld: Services at a glance

• Mobile phone forensics and smartphone forensics for iPhone and Android
• Computer forensics for Windows PCs, notebooks and Apple Macs
• Analysis of WhatsApp and other digital communication
• Examination of deleted and not immediately visible data
• Check for technically detectable signs of unauthorized access
• Analysis of hard drives, SSDs, USB sticks and memory cards
• Examination of existing backups and accessible cloud data
• Reconstruction of relevant file, user, and system activities
• Investigation into possible data leaks and employee misconduct
• temporal correlation of different digital traces
• forensic data backup and integrity check
• Comprehensible documentation of the examination steps

We also cover technical basics and further questions in our knowledge database on digital forensics.

What digital traces can be examined?

Digital forensics examines data generated through the use of devices, operating systems, and applications. Some of this information is directly visible to the user, while other information resides in databases, file systems, system logs, or other technical structures.

Depending on the case, relevant data may include messages, files, photos, videos, browser data, app information, user logins, file accesses, connected storage devices and system events.

The crucial question is not simply whether an artifact exists. Equally important are its context of origin, the relevant time period, and what technical conclusions can actually be drawn from it.

Mobile phone forensics in Bielefeld for smartphones and mobile data

Mobile phone forensics at the Bielefeld site deals with securing and analyzing digital information on smartphones. Modern mobile devices store communication, photos, videos, app data, browser information, user accounts, and numerous system artifacts.

A professional smartphone examination therefore goes beyond simply manually inspecting the device. Depending on the technical specifications, app databases, messenger content, media, files, call information, timestamps, as well as certain location, connection, and system data can be examined.

Which data is actually accessible depends on the manufacturer, model, operating system, security status, encryption, and available extraction method.

iPhone forensics for Apple devices

Apple protects data on modern iPhones through a combination of hardware, iOS, encryption, and other security mechanisms. The achievable depth of investigation can therefore vary considerably between different iPhone models and iOS versions.

Depending on the device and data source, messages, app data, photos, videos, files, browser information, timestamps, and other system artifacts can be examined. Existing local backups or accessible iCloud data may contain additional information.

Reputable iPhone forensics does not promise a complete data recovery across the board. The crucial factor is which data was actually secured using the available method and what conclusions can be drawn from it technically.

We explain further technical basics in the article "What is iPhone forensics?".

Android forensics for Samsung, Google, Honor and other devices

Android is not a technically unified ecosystem. Samsung, Google, Honor, Xiaomi, and other manufacturers use different hardware and security configurations. Additionally, the Android version and security patch affect the available extraction methods.

Depending on the device, messenger data, app databases, files, media, browser information and various system artifacts may be relevant.

The wide variety of devices is also one reason why we do not work exclusively with a single mobile forensics solution.

WhatsApp forensics for deleted or disputed messages

WhatsApp data can become relevant in private disputes, fraud, stalking, employment law cases, and business conflicts. The underlying data is far more important than a mere screen display.

Depending on the available extraction capabilities, messages, participants, group information, timestamps, images, videos, documents, voice messages, and other app artifacts can be examined.

We explain further background information under "Forensic analysis of WhatsApp messages".

Is it possible to recover deleted WhatsApp messages?

Under certain conditions, deleted content or remaining artifacts may still be present. Whether reconstruction is possible depends, among other things, on the operating system, the state of the database, existing backups, and the continued use of the smartphone.

A complete recovery cannot be guaranteed. New messages, synchronizations, app updates, and other write operations can modify the existing data.

What is the technical evidentiary value of a WhatsApp screenshot?

A screenshot initially documents a visible screen display. It does not automatically include the underlying news database and other internal app information.

If the original smartphone or a suitable forensic extraction is available, additional artifacts can be used for technical comparison.

Computer forensics in Bielefeld for Windows and macOS

Computer forensics in Bielefeld examines digital traces on PCs, notebooks, Apple Macs, and their associated storage media. Operating systems generate numerous artifacts during use that can be relevant for later reconstruction.

This can include, among other things:

• Files and file system structures
• File metadata and timestamps
• Deleted files and remaining file artifacts
• User accounts and login activity
• Browser history and downloads
• connected USB devices
• external hard drives and other storage media
• Program and application traces
• Windows event logs
• further operating system information
• local traces of cloud and synchronization services

Which of these data are actually relevant depends on the research question. An analysis due to suspected data theft requires different priorities than the reconstruction of specific user activity.

You can find the basics of the methodology under What is Computer Forensics?.

Can the use of a USB stick be traced?

Computer systems can contain technical information about connected USB devices. Depending on the data available, device data and temporal relationships, for example, can be analyzed.

However, simply connecting a USB stick does not prove a file transfer. To determine whether specific company data was copied, additional artifacts must be considered.

How can file activity be categorized chronologically?

File systems and applications can store various timestamps. These can provide clues about the creation, modification, opening, or further processing of a file.

However, copying processes, synchronizations, programs, and system processes can affect timestamps. Therefore, a reliable assessment should consider as many corresponding traces as possible.

Deleted files and data recovery

Deleted data cannot be recovered equally well on every storage medium. Magnetic hard drives, SSDs, and flash memory in mobile devices differ significantly in their technical design.

Whether a file can be fully, partially, or not at all recovered depends, among other things, on the file system, storage type, encryption, deletion time, and further device usage.

Especially with SSDs, memory cleanup mechanisms can make it significantly more difficult or even impossible to recover deleted content.

IT forensics goes beyond mere data recovery. Besides data recovery, the origin, metadata, temporal relationships, and other corresponding system artifacts can be crucial for establishing evidence.

Digital investigations for private individuals from Bielefeld

Digital evidence is no longer just relevant for businesses. Private smartphones, in particular, contain extensive information about communication, user accounts, and personal activities.

Private individuals from Bielefeld, for example, contact LB Forensik for:

• Suspected unauthorized access to smartphone or computer
• possible spyware or digital surveillance
• deleted WhatsApp messages
• deleted photos, files, or other data
• Fraud and identity theft
• Stalking and digital harassment
• Separation or divorce
• disputed digital communication
• Securing existing digital evidence

Has my phone been hacked or monitored?

Unusual behavior of a smartphone alone is not proof of a compromise. High battery consumption, heat generation, unknown notifications, or increased data traffic can have various technical causes.

A forensic investigation should therefore be open-ended and search for any existing evidence. Depending on the device, apps, system information, configurations, profiles, communication data, and other artifacts may be relevant.

Even a negative result must be interpreted carefully. If no corresponding traces are found within the available data, this does not automatically prove that an attack did not occur at an earlier time.

Digital evidence in cases of separation, divorce, and personal conflicts

Private conflicts can make messages, photos, files, or other digital information relevant. At the same time, there is an important distinction between technical access and legal authorization.

LB Forensics only examines devices, user accounts, and data sets for which it has the appropriate authorization. Secretly accessing other people's smartphones, messaging apps, or cloud accounts is not a permissible forensic investigation.

Forensic investigations for companies in Bielefeld

Bielefeld is a major economic center in East Westphalia-Lippe. Industry, trade, services, the healthcare sector, and medium-sized businesses process extensive digital data sets. Therefore, in cases of internal suspicion or cyber incidents, multiple systems and data sources can become relevant simultaneously.

Typical reasons include a potential data leak, deleted company information, unauthorized data copies, compromised user accounts, employee misconduct, or the technical investigation of an IT security incident.

Data leaks and unauthorized data copies

In cases of suspected data theft, the first step should be to determine which transmission methods were technically possible. USB drives are just one possibility. Depending on the system, cloud services, email, browser applications, or other transmission methods may be relevant.

A forensic analysis can therefore compare file accesses, external storage devices, cloud applications, browser activities, email artifacts and other system traces.

Technical analysis following a cyberattack

Following a suspected cyberattack, system logs, user activity, suspicious files, persistence mechanisms, network clues, and other digital artifacts can be examined.

In an ongoing incident, containment and evidence preservation must be considered together. A powered-on and already decrypted computer presents a different forensic starting point than the same device after it has been powered off or restarted.

Cellebrite for mobile data analysis

We use Cellebrite primarily for securing and analyzing mobile and other digital data sources. The specific method available depends on the device, operating system, and security status.

However, a successful extraction does not yet constitute a final finding. Only the analysis of the recovered artifacts reveals which information is actually relevant to the respective research question.

X-Ways Forensics for Computers and Storage Media

X-Ways Forensics enables detailed investigations of file systems, computers, hard drives, SSDs and other data storage devices.

This allows for the targeted analysis of files, metadata, file system structures, deleted data and other technical information.

Belkasoft for the correlation of digital artifacts

Belkasoft supports the structured analysis of various digital data sources. In more complex cases, relevant information from different areas can be combined and compared over time.

MOBILedit Forensic as an additional smartphone method

MOBILedit Forensic expands the possibilities for extracting and examining data from mobile devices. An additional method can be particularly relevant given the technical diversity of various Android devices.

Why multiple forensic programs are used

No single tool supports all devices, operating systems, and data structures with the same level of detail. Furthermore, different forensic programs can recognize and display the same data set differently.

Therefore, in the case of important findings, a second technical method for plausibility checks may be useful. However, the underlying digital artifact remains decisive. An automated software hit does not replace expert evaluation.

Forensic data backup and integrity

Digital evidence preservation is not simply about copying individual files to another storage medium. In investigations relevant to evidence, it should be traceable what object of investigation was present, how the relevant data was secured, and on what basis the subsequent analysis was carried out.

Cryptographic hash values ​​can help verify the integrity of a defined dataset. A matching hash value can confirm that this specific dataset has not changed compared to the documented reference state.

However, it does not automatically prove completeness, authenticity, authorship, or the correctness of a later interpretation.

Further technical background information is explained under Integrity of Digital Evidence.

Chain of evidence and documented investigation process

In an evidence-oriented investigation, it should be comprehensibly documented which device was taken over, its condition, which security measures were taken, and on what data basis the analysis was carried out.

This chain of custody serves a different function than a hash value. A hash value is used for the technical integrity control of a defined dataset; the chain of custody, on the other hand, documents how the object of investigation was handled.

Further information can be found under Chain of Custody in digital forensics.

From investigation order to technical report

Define the research question

First, it is determined which technical issue needs to be clarified and what time period is relevant for this.

Select data sources

Smartphone, computer, data storage device, backup or cloud data are prioritized based on their relevance to the question at hand.

Capture initial state

The device model, operating system, encryption, security status and available access options influence the further course of action.

Secure data appropriately

The data backup method is adapted to the specific object under investigation. Where technically feasible, the analysis is then performed based on a defined, backed-up dataset.

Evaluate relevant artifacts

Files, databases, communication information and system traces are examined based on the previously defined question.

Compare multiple tracks with each other

Corresponding artifacts can be linked chronologically and thematically. This often allows a process to be classified more reliably than through a single technical find.

Separate finding and interpretation

The documentation should clearly differentiate which data were directly recorded, which professional conclusions are drawn from them, and what technical limitations exist.

IT forensics in the Bielefeld and East Westphalia-Lippe area

Bielefeld, together with its surrounding region, forms an important economic and living space in East Westphalia-Lippe. Digital issues can therefore quickly affect multiple residential, work, or business locations.

The regional area includes, among others, Gütersloh, Herford, Bad Salzuflen, Detmold, Halle (Westphalia), Rheda-Wiedenbrück, Minden, and Paderborn . These locations are mentioned here for geographical context and are not automatically presented as branches of LB Forensik.

The city limits are not decisive for the technical investigation itself. What matters are the available equipment and data sources, their condition, the relevant time period, and the specific question of proof.

What should be avoided before a forensic examination?

A smartphone that may be relevant as evidence should not be reset prematurely. Suspicious apps, messages, files, or user accounts should also not be deleted without a prior technical assessment.

Data recovery, cleanup, or anti-spyware programs can also create new files and system information, thereby altering existing digital traces.

A computer that has already been switched off should not be restarted normally just for the purpose of inspection. Even starting the operating system generates new activity and can modify existing information.

Conversely, immediately shutting down a running system is not always the right approach. With encrypted devices that are powered on, the current state can be relevant for backup options.

FAQ for clients from Bielefeld

Does LB Forensics examine smartphones belonging to private individuals?

Yes. Depending on the question, iPhones, Android smartphones, existing backups, and other authorized data sources can be examined.

Is it possible to determine if my phone has been hacked?

A forensic investigation can look for technically detectable evidence of unauthorized access or potential compromise. The findings depend on the device and the available data.

Can deleted files be recovered from a computer?

This may be possible depending on the storage medium, file system, encryption, and other usage. A complete recovery cannot be guaranteed.

Can the smartphone and computer from the same case be examined together?

Yes. If both devices are relevant to the same matter, corresponding data can be compared in terms of time and content.

Is it possible to determine who used a computer?

Digital artifacts can often be associated with a device, user account, or technical process. However, this does not automatically imply which natural person actually operated the system at that time.

What software does LB Forensics use?

Depending on the data source and investigation objective, we use tools such as Cellebrite, X-Ways Forensics, Belkasoft and MOBILedit Forensic.

Should I examine a suspicious device myself?

Unnecessary use of a device that may be relevant as evidence should be avoided. Attempting to delete, clean, or recover data independently can alter the existing data.