When private messages suddenly become known to another person, a smartphone exhibits unusual activity, or important files are missing from a computer, suspicions quickly arise. However, mere suspicion is not enough for a reliable investigation. What matters is which digital traces are actually present and what technically verifiable conclusions can be drawn from them.

Our IT forensics services in Bonn support individuals, companies, lawyers, and organizations with the professional examination of digital devices and data. Smartphones and computers are a particular focus. Depending on the specific circumstances, external storage media, existing backups, and other accessible data sources can also be included in the investigation.

For private individuals, the questions are often very specific: Has my phone been accessed? Can my former partner still see personal data? Is there possibly spyware on the smartphone? Can deleted WhatsApp messages still be analyzed? Can a computer provide clues as to how someone gained access to personal information?

Professional digital forensics does not seek a predetermined confirmation. It investigates, without prejudice, which technical findings are possible – and equally importantly: which conclusions cannot be reliably drawn from the available data.

IT forensics in Bonn – when a suspicion becomes a technical question

A good forensic investigation doesn't begin with software, but with a precise question. "My phone has been hacked" is initially just a suspicion. What becomes forensically relevant is, for example, whether there are indications of unauthorized access, suspicious applications, unusual account connections, or other technically relevant changes on the device.

With a computer, the questions can look completely different: Was an external storage device connected? Which files were opened or modified within a specific timeframe? Is there any evidence of deleted data? Which user activities can still be technically traced?

Only by answering this question can it be determined which devices need to be secured and which data actually needs to be examined.

Mobile phone forensics in Bonn – Have your smartphone professionally examined

Smartphones are often the most important source of digital data in private investigations. Messengers, emails, photos, videos, user accounts, contacts, apps, and cloud connections make modern mobile phones highly complex personal information systems.

A forensic smartphone examination can be particularly useful in the following cases:

• Suspected unauthorized access,
• possible spyware or stalkerware,
• digital surveillance after a separation
• unknown or suspicious account accesses,
• deleted WhatsApp messages,
• missing photos, videos or documents,
• Phishing, smishing, or online fraud,
• digital stalking or threats,
• disputed messenger communication,
• or the safeguarding of digital information for a legal dispute.

The data that can be technically obtained depends on factors such as the manufacturer, model, operating system, security level, encryption, and device condition. Therefore, modern smartphones cannot be treated the same as traditional hard drives.

We explain further basics in the knowledge article "What is Smartphone Forensics?".

Mobile phone hacked – can IT forensics prove an attack?

Many victims initially notice changes: The smartphone gets unusually warm, the battery drains faster, data usage increases, or unfamiliar logins appear. Sometimes, another person suddenly has access to content that should be private.

Such observations may warrant an investigation. However, they do not in themselves constitute proof of a compromise.

High battery consumption can be caused by apps, synchronization, poor mobile network reception, or an aging battery. An unknown login also needs to be technically assessed first.

Depending on the available data, applications, permissions, user accounts, system information, and other relevant artifacts can be examined. The overall picture is crucial, not a single, supposedly suspicious feature.

Spyware and stalkerware – what can actually be detected?

When there is a concrete suspicion of surveillance, the search often focuses solely on a classic spyware app. This is insufficient.

Unauthorized access can also occur if another person knows access data, another device is still authorized, or a user account is still linked to a previously shared system.

A forensic investigation should therefore consider several possible avenues of access.

Equally important is the technical limitation: it cannot be guaranteed that every conceivable or previously existing compromise will be detected. A negative result initially means that no corresponding reliable evidence was found within the examined dataset. It does not automatically prove that no access occurred at any earlier time.

Can my ex-partner still access my phone?

This question arises particularly frequently in private studies. During a relationship, digital access is often consciously shared. Passwords are known, tablets are used jointly, family features are set up, or multiple devices are connected to the same accounts.

Such connections can persist after a separation.

If a former partner appears to still have access to private information, one shouldn't immediately assume spyware is installed. First, it's necessary to investigate what technical means of access might exist.

Depending on the circumstances, smartphones, user accounts and possibly other devices may become relevant.

WhatsApp forensics in Bonn – more than just visible chat histories

WhatsApp communication can play an important role in breakups, threats, fraud cases, disputes, and business conflicts.

A forensic WhatsApp analysis is not limited to reading a visible chat. Depending on the extraction method, messages, timestamps, participant data, media, documents, group information, and other technical artifacts may be available.

This means that an original data source can be significantly more informative than a single screenshot.

A screenshot initially only shows what was displayed on a screen at a specific time. The underlying messenger structures are usually not included.

Our article "Forensic Analysis of WhatsApp Messages" explains this in more detail.

Can deleted WhatsApp messages be recovered?

Whether a deleted message can be recovered depends on the specific data situation. A blanket recovery guarantee would not be technically sound.

Relevant factors include the operating system, the WhatsApp version, the state of the database, existing backups, and the continued use of the smartphone after deletion.

Other data sources can also play a role. For example, an older backup might contain information that is no longer visible on the current smartphone. Similarly, different data sets might exist on another communication device.

If deleted messages are important, the device should be used as little as possible and WhatsApp should not be reinstalled prematurely.

Computer forensics in Bonn – examining PCs, notebooks and Macs

Not every digital issue can be resolved via a smartphone. Windows PCs, notebooks, and Macs can contain additional traces that are relevant for private and business investigations.

Depending on the system and the question being asked, computer forensics can investigate, among other things, the following areas:

• Files and file system information
• deleted data, insofar as it is still technically available,
• User activities,
• Browser and download information,
• System logs,
• connected USB devices,
• external storage devices,
• local email data,
• Cloud and synchronization traces,
• installed or used programs,
• and temporal relationships between different events.

We explain the basics and typical investigation methods under What is Computer Forensics?

Examine mobile phone and computer together

A particular strength of digital forensics lies in the correlation of different data sources.

Let's assume that private WhatsApp content appears to be known to a stranger. Initially, there's no clear explanation on the smartphone itself. However, if WhatsApp was also used on a computer, further traces may be present there.

The same applies to email, browser accounts, cloud services and synchronized files.

Smartphones and computers should therefore not be considered in isolation. If the research question concerns multiple systems, a cross-device analysis can be significantly more informative.

Deleted files on computer, SSD or hard drive

On computers, the recoverability of deleted files depends significantly on the storage medium used and its subsequent use.

Traditional magnetic hard drives may have different operating conditions than modern SSDs. SSDs use additional memory management mechanisms that can significantly affect the subsequent recovery of deleted data.

Therefore, a computer with important deleted data should ideally not be used unnecessarily. Any further use can alter the data.

Here too, it's important to remember that data recovery and forensic investigation are not the same thing. In an investigation relevant to evidence, it's not only important whether a file can be recovered, but also what data source it came from and its technical context.

Digital evidence in cases of separation, threats, and private disputes

Private cases are often particularly sensitive. It's not just about technology, but also about personal communication, relationships, and sometimes significant legal consequences.

That is precisely why an investigation should be limited to the specific question at hand.

For example, if the only purpose is to clarify whether a specific WhatsApp communication technically exists, there is no reason to evaluate all private content on a smartphone without reference to the task.

A targeted investigation reduces unnecessary intrusions into private data while simultaneously increasing the clarity of the analysis.

Investigate phishing, smishing and online fraud

After a phishing or smishing incident, questions often arise about the actual sequence of events. Was only a link opened? Were login credentials entered? Was a file downloaded? Are there any activities on the smartphone or computer that coincide with the incident?

Depending on the case, messages, emails, browser data, downloads and other artifacts can help with the reconstruction.

A technical investigation can document connections. However, it cannot automatically identify the natural person behind an attack based solely on an IP address, phone number, or domain.

Digital evidence preservation for lawyers and legal proceedings

As a federal city, a center of science and the seat of numerous organizations, Bonn has an environment in which digital information can regularly acquire legal significance.

For lawyers and their clients, it is not only the visible content of a file or message that is relevant. The origin, backup method, temporal context, and integrity of the examined data can be equally important.

Cryptographic hash values ​​can be used in suitable backups. This allows you to verify whether a defined data set has been modified after it was backed up.

However, a hash value is not a universal seal of authenticity. It does not automatically prove the truth of a piece of content, nor its authorship.

This important distinction is explained in our knowledge article on the integrity of digital evidence.

Bonn as a federal, scientific and organizational location

The demands placed on digital forensics in Bonn extend beyond traditional corporate cases. The city is characterized by public and institutional structures, science, research, services, and nationally and internationally operating organizations.

In such environments, digital investigations can involve particularly sensitive data. Internal communications, research information, project documentation, personal data, or confidential documents may be distributed across different end devices and storage systems.

A professional investigation must therefore not only be technically sound, but also clearly defined. It should be transparently defined which systems are being examined, which time period is relevant, and which questions are to be answered.

IT forensics for companies and organizations in Bonn

Businesses and organizations face different questions than private individuals with smartphones. Typical reasons for investigation include:

• Suspected data theft,
• conspicuous activities prior to an employee's departure,
• unauthorized use of confidential information,
• deleted or manipulated files,
• Use of external storage media,
• compromised user accounts,
• Cyber ​​incidents,
• or the safeguarding of digital data for internal and legal investigations.

The systems required depend on the specific circumstances. A blanket, comprehensive analysis of all company data is neither technically nor organizationally advisable.

Data theft by employees – what evidence might be relevant?

A common reason for an investigation arises before or after an employee leaves the company. Confidential files may have been copied, deleted, or passed on to external parties.

Depending on the system, file activity, external storage devices, browser and cloud artifacts, as well as other technical information may be relevant.

Here too, a cautious interpretation is crucial.

The fact that a USB stick has been connected only proves the connection of the storage medium. It does not automatically follow that specific files have been copied.

A stronger technical connection can arise if several independent traces match each other in terms of time and content.

Research and science – sensitive digital data sets

Universities, scientific institutions and research-related organizations work with data whose significance can extend far beyond classic office documents.

Research findings, project information, evaluations, technical documentation or unpublished results can have significant scientific or economic value.

If there is a concrete suspicion of unauthorized use or disclosure, it should first be clarified on which devices and systems the relevant information was actually processed.

Only then can a meaningful scope of investigation be determined.

Cyber ​​forensics following an IT security incident

In a cyber incident, damage control and evidence preservation are sometimes at odds. An affected system may need to be isolated. At the same time, uncoordinated deletion or reinstallation measures can alter important evidence.

With running systems, there is the added risk that volatile data can be lost as soon as a device is switched off. Furthermore, with encrypted computers, an already accessible state can be lost.

Therefore, there is no universal rule to immediately shut down an affected computer or to leave it switched on. The decision must depend on the specific situation and the objective of the investigation.

How are digital devices secured forensically?

The appropriate securing method depends on the object being examined.

For traditional data storage media, forensic imaging with controlled write-protection methods can be useful. For running or encrypted computers, other approaches may be necessary.

Smartphones constitute a separate device class. With modern iPhones and Android devices, a classic, complete sector-by-sector copy is often not possible. Instead, different extraction methods are available, depending on the device.

Therefore, what is crucial is not the blanket claim of a "1:1 copy", but the verifiable documentation of what was actually backed up and the method used.

Which forensic software do we use?

Different devices and data structures require different specialized tools. Therefore, a professional investigation is not based on a single software program.

Cellebrite Inseyets

Cellebrite Inseyets is used particularly for the acquisition and analysis of mobile digital data. The information that becomes available depends on the specific smartphone, its operating system, and the technically feasible extraction methods.

Cellebrite Digital Collector

Digital Collector supports suitable acquisition methods for computers and digital storage media. Hardware, operating system, encryption, and system state determine the specific procedure.

Cellebrite Inspector

Cellebrite Inspector is used for the structured examination of computer forensic data sets and supports the analysis of relevant artifacts.

X-Ways Forensics

X-Ways Forensics enables detailed investigations of data carriers, partitions, file systems and other computer forensic structures.

MOBILedit Forensic and MEFF 3 Pro

MOBILedit Forensic and MEFF 3 Pro complement our tool base for investigating mobile devices and can open up additional analysis avenues depending on the specific smartphone.

The decisive factor remains the expert assessment. Forensic software can extract, structure, and present data. However, an automatically generated report is not an expert opinion and does not replace a professional interpretation of the technical findings.

Quality management and expert assessment

LB Detektive GmbH (LB Group) has a quality management system certified by TÜV NORD according to DIN EN ISO 9001, the scope of which includes IT forensics. In addition, the expert is certified according to DIN EN ISO/IEC 17024.

For digital investigations, quality primarily means traceable processes: objects under investigation must be clearly assigned, security procedures documented, and technical findings separated from further interpretations.

This distinction is crucial, especially in legally relevant cases. Digital forensics establishes technical facts. The final legal assessment must be distinguished from this.

Three typical cases from IT forensics

Case 1: A former partner still knows private messages

After a breakup, it appears that another person has access to information from private communications. Instead of immediately assuming spyware, various possible avenues of access are examined. Depending on the circumstances, smartphones, bank accounts, and other devices used may be included in the investigation.

Case 2: A WhatsApp history is needed for a legal dispute.

Part of an important communication is no longer visible. First, an investigation is conducted to determine which data sources are still available. Only then can it be assessed whether older messages or technical artifacts can still be analyzed.

Case 3: Confidential files may have been copied before an employee change.

A company notices unusual activity on a work computer. The investigation focuses on a defined time period and correlates file activity, external storage devices, and other system traces. A single technical event is not prematurely interpreted as proof of data theft.

How does an IT forensic investigation for Bonn proceed?

1. Record the facts

First, it is clarified what was observed and which technical question needs to be answered.

2. Determine relevant data sources

Smartphones, computers, data storage devices, backups or other systems are only included if they may be relevant to the question at hand.

3. Assess the device's condition

Model, operating system, encryption, and current state influence the appropriate backup strategy.

4. Securely back up data

The backup method is tailored to the specific device and documented in a traceable manner.

5. Analyze relevant artifacts

The secured data will be specifically examined for those traces that can contribute to answering the defined question.

6. Findings correlate

When multiple data sources are available, time information and technical events can be compared.

7. Document results

Depending on the assignment, technical documentation or a more detailed expert analysis of the relevant findings will be carried out.

What should you avoid before an examination?

• Do not hastily reset a suspicious smartphone.
• Do not attempt to remove suspected spyware on your own.
• Do not install any unknown cleanup or “anti-spy” apps.
• Do not reinstall WhatsApp if important messages have been deleted.
• Do not unnecessarily overwrite existing backups.
• Minimize the continued use of computers with important deleted data.
• Do not restart a switched-off evidence computer solely for your own verification purposes.
• Do not reflexively switch off a running encrypted computer.
• Document conspicuous reports and relevant timestamps.
• Keep original devices and existing data carriers as unchanged as possible.

IT forensics in Bonn and the Rhein-Sieg district

Our service area covers Bonn and the entire surrounding region. This includes, among others, Bad Godesberg, Beuel and Hardtberg, as well as Königswinter, Bad Honnef, Sankt Augustin, Siegburg, Troisdorf, Bornheim, Alfter, Meckenheim, Rheinbach and other locations in the Rhein-Sieg district.

Investigations are also possible beyond the immediate region. In the Rhineland, there are short distances, especially towards Cologne , Leverkusen , and Düsseldorf.

In more extensive corporate cases, digital evidence can also be secured and examined across multiple locations.

Frequently asked questions about IT forensics in Bonn

Can I have my phone checked for unauthorized access?

Yes. Depending on the device and the available database, applications, account connections, configurations, and other technically relevant artifacts can be examined.

Is it possible to determine if my phone has been hacked?

It is possible to search for technically available indicators of a compromise. However, it is not realistically possible to guarantee that every conceivable or previous attack can be detected.

Can my ex-partner still have access to my data?

This is technically possible in several ways. Besides malware, known login credentials, linked accounts, or devices that are still authorized could be relevant.

Can spyware be found on a smartphone?

Depending on the device and available data, indications of suspicious applications or other anomalies may be detected. However, a negative result does not rule out every theoretically possible or previous compromise.

Can deleted WhatsApp messages be recovered?

Under certain circumstances, deleted messages or remaining artifacts may still be present. The possibilities depend, among other things, on the operating system, database state, backups, and other device usage.

Can the authenticity of a WhatsApp chat be verified?

If the original device or a suitable extraction is available, underlying data structures can be examined much more deeply than with an isolated screenshot.

Can a computer be examined after unauthorized access?

Yes. Depending on the system, user activity, system information, browser data, files, and other relevant artifacts can be analyzed.

Can deleted files be recovered from a computer?

That's possible. Storage medium type, file system, overwriting, and further use have a significant impact on recoverability.

Is it possible to determine if a USB stick has been connected?

On suitable systems, information about connected USB devices may be available. However, the connection alone does not prove that specific files have been transferred.

Is it possible to determine who used a computer?

Technical artifacts can associate activities with a user account or session. However, this does not always definitively prove which natural person was actually sitting in front of the device.

Can smartphones and computers be analyzed together?

Yes. If the question concerns multiple devices, the temporal and factual correlation of different data sources can be particularly valuable.

Is an automated forensic report already considered an expert opinion?

No. Software supports backup and analysis. An expert opinion, however, requires a defined question, a comprehensible methodology, professional review, and a reasoned evaluation.

How much does an IT forensic investigation cost in Bonn?

The effort required depends on the type of equipment, the number of data sources, technical accessibility, the amount of data, the objective of the investigation, and the desired documentation. Therefore, in complex cases, the necessary scope of the investigation is determined first.

Do not alter digital traces through hasty action.

If a smartphone is potentially being monitored, important messages have been deleted, or a suspicious activity has been detected on a computer, the current state of the device can be crucial for subsequent investigation.

Resetting, reinstalling, manual cleanups, and intensive continued use can alter relevant data. Therefore, it's essential to first determine which information needs to be backed up and which procedure is appropriate for the specific device.

For an initial expert assessment, the affected device, the observed anomaly, the relevant time period, and any modifications already made are particularly important. Based on this information, it can be determined which form of forensic preservation and analysis is appropriate for the specific case.

Further specialist information on smartphone forensics, computer forensics , messenger data, digital evidence preservation and technical investigation methods can be found in our knowledge database on digital forensics.