Digital processes are often not as straightforward as they first appear. A missing message, an unknown login, a modified file, or a suspicious computer can have various causes. LB Forensics in Bochum analyzes digital traces for private individuals, companies, and lawyers to reliably classify technical processes based on the available data.

Depending on the circumstances, smartphones, Windows and macOS systems, hard drives, SSDs, USB storage devices, existing backups, and accessible cloud data can represent relevant sources of information. The entire data set is not examined indiscriminately. The starting point is a specific question, for example, whether communication has been deleted, whether unauthorized access may have occurred, or whether certain user activities can be traced within a relevant timeframe.

For data preservation and analysis, LB Forensics uses tools such as Cellebrite, X-Ways Forensics, Belkasoft, and MOBILedit Forensic , depending on the device, operating system, and investigation objective . Automatically generated software results are not accepted without verification. The underlying digital artifacts and their expert interpretation are crucial.

IT forensics for Bochum at a glance

• Smartphone forensics for Apple iPhone and Android devices
• Computer forensics for Windows PCs, notebooks and Apple macOS
• Analysis of WhatsApp and other digital communication
• Examination of deleted and no longer immediately visible data
• Check for technically detectable signs of unauthorized access
• Analysis of hard drives, SSDs, USB sticks and other data storage devices
• Examination of existing backups and accessible cloud data
• Reconstruction of relevant user, file, and system activities
• temporal correlation of digital traces from multiple data sources
• comprehensible documentation of securing, analysis and findings

Further technical information can be found in our knowledge base on digital forensics . There, we discuss individual data sources and methods in much greater depth than is practically possible on a regional service page.

What can be technically determined using IT forensics?

A digital investigation can help verify a suspected process using existing technical data. It is important to distinguish between a suspicion and an actually observed artifact.

Unusually high battery consumption does not prove the presence of spyware. A connected USB stick does not prove data theft. Logging in under a specific user account does not automatically identify the individual who actually acted at that time.

Typical research questions include, for example:

• Were messages, files, or other data deleted?
• Are there any technical indications of unauthorized access?
• When was a file created, opened, modified, or deleted?
• What activities took place within a specific time period?
• Has an external storage device been connected to a computer?
• Are there any indications of a possible leak of business data?
• Is it technically possible to review a WhatsApp or Messenger chat history?
• Is it possible to compare data from smartphones, computers, backups, and the cloud?
• What technical conclusions can actually be drawn from a particular artifact?

Smartphone forensics for Bochum for iPhone and Android

Smartphones are now the primary storage devices for communication, photos, videos, apps, user accounts, and a wealth of personal and business information. At the same time, much forensically relevant data is not located in the immediately visible user interface.

Depending on the device and available data, it is possible to examine, for example, messages, app databases, contacts, call information, browser artifacts, photos, videos, files, timestamps, system information, and certain location and connection artifacts.

Which data is actually accessible depends, among other things, on the device model, operating system version, security status, encryption, and available extraction method.

iPhone forensics for clients from Bochum

With Apple iPhones, hardware, iOS, and security architecture are closely intertwined. Modern devices protect user data through hardware-based encryption, different protection classes, and the Secure Enclave. Therefore, the potential depth of investigation cannot be assessed solely based on the model name.

Depending on the technical setup, messages, app data, media, browser information, files, timestamps, and other system artifacts may be available. Existing local backups or accessible iCloud data can also represent additional data sources.

Professional iPhone forensics therefore does not mean promising a complete data recovery across the board. What matters is what data is actually obtained technically and what conclusions can be drawn from this information.

We explain further background information under What is iPhone forensics?

Android forensics for Samsung, Google, Honor and other manufacturers

Android devices differ significantly from one another technically. Manufacturer, chipset, Android version, security patch, and device configuration all influence which extraction options are available.

Depending on the smartphone, messenger data, app databases, files, images, videos, browser information, system artifacts and other usage data may be relevant.

Especially with Android, the use of various forensic tools can be beneficial. Different solutions support specific device combinations and data structures, sometimes in different ways.

WhatsApp forensics and deleted communication

Messenger data is regularly among the most important digital sources of information in both private and business investigations.

A forensic analysis of WhatsApp data is not limited to reading the visible chat on a smartphone. Depending on the available data, messages, timestamps, participants, group structures, images, videos, documents, voice messages, and other app artifacts can be examined.

Can deleted WhatsApp messages be recovered?

Under certain conditions, a full or partial reconstruction may be possible. However, a blanket guarantee of restoration is not reputable.

The crucial factor is which data remains available and technically accessible after deletion. Depending on the system, database information, backups, media holdings, or other data sources may be relevant.

If no corresponding artifacts are found within the available data, this initially only means that no corresponding reconstruction could be derived from this data set.

How informative is a WhatsApp screenshot?

A screenshot initially only documents the visible display on a screen. It does not automatically contain the original message database or other technical information about the device.

If the original device or a suitable forensic extraction is available, additional data structures and time information can be used for a technical comparison.

Computer forensics in Bochum for Windows and macOS

Computers leave numerous technical traces when used. Users log in, files are opened, programs are started, websites are accessed, storage devices are connected, and data is processed with local or cloud-based applications.

The following data sources, among others, may be relevant for an investigation:

• File system structures and files
• File metadata and timestamps
• deleted or modified files
• User accounts and login activity
• Browser history and downloads
• USB devices and external storage media
• Program and application traces
• System and event logs
• local cloud and synchronization data
• further operating system artifacts

The real value of the information often only emerges from combining different traces. For example, the fact that a USB stick was plugged in initially says nothing about which files were actually transferred.

Further technical information can be found under What is Computer Forensics?.

Deleted files: What data might still be present?

A deleted file is not handled the same way on every storage medium. Magnetic hard drives, modern SSDs, and the flash memory of mobile devices all operate differently.

Whether data can be fully, partially, or not at all reconstructed depends, among other things, on the file system, storage medium, encryption status, time of deletion, and further use of the device.

With SSDs, technical data erasure procedures can quickly render deleted content inaccessible. Therefore, a system that may be relevant as evidence should not be used unnecessarily or subjected to data recovery software.

IT forensics for private individuals in Bochum

Private digital disputes are among the most common reasons for a forensic investigation. Smartphones and computers contain communications, images, documents, user accounts, and personal data that can become relevant in cases of fraud, stalking, or other legal disputes.

Private individuals from Bochum commission IT forensic investigations, for example, in the following cases:

• deleted or disputed communication
• Suspected unauthorized access to smartphone or computer
• possible spyware or digital surveillance
• Fraud and identity theft
• Stalking and harassment
• Separation or divorce
• unexplained changes to user accounts or devices
• Securing relevant digital data before a legal dispute

Has my smartphone been hacked?

This question cannot be answered based on individual symptoms. High battery consumption, heat generation, poor connection, or unfamiliar error messages can have numerous causes.

A professional investigation therefore does not attempt to confirm an existing suspicion. Instead, the accessible data is examined objectively for technically suspicious traces.

Depending on the device, information such as apps, system information, configurations, profiles, communication artifacts and other technical data can be viewed.

Even a negative test result must be interpreted correctly. If no evidence is found, this does not necessarily mean that an attack did not occur at an earlier time.

IT forensics in cases of separation, divorce, and private conflicts

Especially in the private sphere, a clear distinction must be made between technical possibility and legal entitlement.

LB Forensics only examines devices, user accounts, and data sets for which it has the appropriate authorization. Secret access to other people's smartphones, messaging apps, or cloud accounts is not a permissible part of a forensic investigation.

Digital forensics for companies in Bochum

Bochum lies at the heart of a densely networked economic region in the Ruhr area. Companies, law firms, research institutions, service providers, and medium-sized businesses process sensitive digital information daily. Consequently, the causes of an internal or external security incident can vary widely.

A forensic investigation may be necessary, for example, if company data has disappeared, an employee may have made unauthorized copies, user accounts have been compromised, or a cyber incident needs to be technically reconstructed.

Suspected data leak by employees

In the event of a potential data breach, a single technical finding is usually insufficient for a reliable assessment.

A connected USB drive initially only indicates that a connection to the computer existed. Further questions might include: Which files were used during the relevant period? Was there any significant cloud activity? Was data sent via email? What other user activities are documented?

This allows file system information, external storage media, browser data, cloud applications, email artifacts and other system traces to be compared.

IT forensic investigation following a cyber incident

Following a cyberattack or suspected unauthorized access, system logs, user activity, suspicious files, persistence mechanisms, network clues, and other technical artifacts may be relevant.

In ongoing incidents, it must be considered that containment and evidence preservation can have different requirements. A powered-on encrypted computer can present a different forensic situation than the same system after a restart.

Therefore, there is no technically correct standard instruction to immediately switch off every suspicious device.

Cellebrite for mobile and digital examinations

We use Cellebrite particularly for extracting and analyzing mobile and other digital data sources. The available backup and analysis methods depend on the device, operating system, security status, and investigation objective.

Technical extraction only forms the basis. Only expert analysis determines the significance of individual artifacts for the specific case.

X-Ways Forensics for Data Carriers and Computer Systems

X-Ways Forensics enables detailed investigations of computers, hard drives, SSDs and other storage media.

File systems, files, metadata, deleted data, and other technical structures can be specifically examined. Especially in more complex computer cases, the direct analysis of file system and storage medium information allows for a very detailed examination.

Belkasoft for extensive digital artifacts

Belkasoft supports the analysis of different digital data sources and can help to bring together relevant information in a structured way during extensive investigations.

This is particularly interesting when communication, computer artifacts and other digital information need to be correlated with each other over time.

MOBILedit Forensic for smartphone analysis

MOBILedit Forensic expands the possibilities for extracting and examining data from mobile devices. Especially given the wide range of technical variations in the Android environment, an additional forensic method can be helpful.

Why multiple forensic solutions can be better than just one

No single analysis program supports all devices and data structures equally. Furthermore, different forensic solutions can recognize and display the same dataset differently.

Therefore, in the case of important findings, a second technical method for verifying the plausibility of a result may be useful.

However, a forensic program is not an expert. An automatically detected match must be technically classified and evaluated in the context of the respective data source.

Forensic data backup and integrity

Before analyzing data, it's essential to determine the appropriate backup method for each device. A powered-off storage device, a running encrypted computer, and a powered-on smartphone may require different procedures.

Where technically feasible, a suitable forensic backup will be created. This allows the subsequent investigation to be carried out on a defined dataset and avoids unnecessary work on the original evidence.

What information does a hash value provide?

Hash values ​​can be used to verify the integrity of a specific dataset. A subsequent comparison can reveal whether this exact dataset has changed since the backup.

However, a matching hash value does not automatically mean that an extraction was complete or that the subsequent interpretation is correct. Integrity, completeness, and expert evaluation are distinct concepts.

Why is the handling of a piece of evidence documented?

In investigations relevant to evidence, it should remain traceable which device was taken over, what condition it was in, what backup was carried out and on what data basis the analysis was performed.

Such documentation facilitates the subsequent assignment of technical findings to the original data source and the respective investigation step.

How does a digital suspicion become a technical finding?

Specify the question

First, a technically verifiable question is formulated based on a general suspicion. This often includes defining a relevant time period.

Determine relevant data sources

Not every existing device needs to be automatically examined. Smartphones, computers, storage media, backups, or cloud data are prioritized based on their relevance to the case.

Document the initial state and back up data

Device condition, operating system, security mechanisms and available access options influence the appropriate backup method.

Targeted evaluation of artifacts

The analysis focuses on the data that are actually relevant to the specific research question.

Comparing independent tracks

If several technical artifacts relate to the same process, they can be correlated with each other in terms of time and content.

Separate technical findings from conclusions.

A comprehensible finding describes what information was found, what professional conclusions can be drawn from it, and where the technical limits of the available data lie.

IT forensics in Bochum and the central Ruhr area

Bochum is centrally located within the Ruhr region. Digital and business matters therefore often extend beyond a single city boundary. The immediate regional area includes, among others, Herne, Essen , Gelsenkirchen, Witten, Hattingen, Dortmund , and Recklinghausen.

The cities mentioned here serve for geographical classification and are not automatically represented as branches or LB forensic locations.

For other areas of North Rhine-Westphalia, verified regional LB forensics pages already exist, including those for IT forensics in Duisburg and IT forensics in Düsseldorf.

For a digital investigation, the city in which a device was used is ultimately irrelevant. What matters are the available data sources, their technical condition, the relevant time period, and the specific research question.

What should be avoided when dealing with potential digital evidence?

A potentially sensitive smartphone should not be reset prematurely. Similarly, suspicious applications, user accounts, or files should not be deleted independently if they are to be examined later.

Data recovery, cleanup, or anti-spyware programs can create new files and logs, thereby altering the original data.

A computer that has already been switched off should not be restarted normally just for initial inspection. Even a regular operating system startup generates new system activity and can change time information.

Conversely, immediately shutting down the device is not always the right approach. With encrypted systems still active or during ongoing cyber incidents, the current state of the device can be forensically relevant. Therefore, the appropriate course of action depends on the specific circumstances.

FAQ about IT forensics in Bochum

Can private individuals from Bochum have their smartphones and computers examined?

Yes. LB Forensics also works for private individuals. Depending on the specific question, smartphones, computers, data storage devices, existing backups, and accessible cloud data can be examined.

Can it be investigated whether my smartphone has been hacked?

A forensic investigation can look for technically detectable evidence of a possible compromise or unauthorized access. What conclusions can be drawn depends on the device, its security status, and the available data.

Can deleted WhatsApp messages be recovered?

Under certain conditions, remaining database information, backups, media, or other artifacts may allow for reconstruction. However, a complete recovery cannot be guaranteed.

Is it possible to determine whether a USB stick was connected to a computer?

Yes, computer systems can contain technical traces of connected USB devices. However, proof of a connection does not automatically mean that files were actually copied.

Can a potential data theft by an employee be investigated?

Yes. Depending on the circumstances, file accesses, USB storage devices, cloud services, browser activities, email data and other system artifacts can be examined and compared.

Can computer usage be reconstructed within a specific time period?

System events, logins, file accesses, program usage, and other artifacts can provide clues about certain activities. However, a complete record of every user action is not automatically available.

Can a WhatsApp screenshot be examined for manipulation?

A screenshot can be technically analyzed, but on its own it has limited significance. If the original smartphone or another suitable data source is available, additional artifacts can be used for comparison.

Can multiple devices be evaluated together in one case?

Yes. Smartphones, computers, storage media, backups, and accessible cloud data can be considered together if they relate to the same issue. This allows different traces to be correlated chronologically.

Can IT forensics definitively determine which person acted?

Not automatically. Digital data can often be associated with a device, user account, or technical process. This does not necessarily imply which natural person was actually operating the device at the relevant moment.

Which forensic software does LB Forensik use?

Depending on the device, data source and investigation goal, tools such as Cellebrite, X-Ways Forensics, Belkasoft and MOBILedit Forensic are used.

Should a suspicious smartphone be reset before examination?

No. A reset can alter or completely remove relevant digital traces. If the smartphone contains potentially important evidence, the next steps should be technically assessed before a reset.

What information helps in preparing for an examination?

Particularly helpful information includes the manufacturer and model of the device, the operating system, the relevant time period, specific abnormalities, measures already taken, and the question that the investigation is intended to answer.