A compromised smartphone, deleted messages, unauthorized access to personal accounts, or the suspicion that a former partner still has access to private data: For those affected, digital incidents often begin with isolated anomalies and many unanswered questions. Companies face different, but technically comparable, challenges – such as data theft, cyberattacks, manipulated systems, or the suspicion that confidential information has been copied.

Professional IT forensics addresses precisely this point. Its aim is not to confirm suspicions, but to methodically secure, analyze, and expertly evaluate existing digital traces. The crucial question is what can be technically determined based on the available data.

For private individuals in Duisburg, this particularly affects smartphones, computers, messaging apps, cloud accounts, and other personal digital systems. Depending on the circumstances, investigations can be conducted to determine whether there are technically detectable signs of unauthorized access, what data is stored on a device, whether deleted content can be recovered, or what activities can be traced within a specific timeframe.

For companies, desktop computers, laptops, company mobile phones, data storage devices, user accounts, email systems, cloud services, and log data can all be relevant. Especially in an economic region like Duisburg, with its strong industrial, logistics, and service sector, digital information can have considerable economic value.

Specialized systems such as Cellebrite UFED, Cellebrite Collector, Cellebrite Inspector, X-Ways Forensics, MOBILedit Forensic, and MEFF 3 PRO, as well as other forensic tools, are available for securing and analyzing data. The specific technology used depends on the device, operating system, data source, and the specific question being investigated.

LB Detektive GmbH has a quality management system certified by TÜV NORD according to DIN EN ISO 9001, the scope of which includes IT forensics. In addition, expert expertise with personnel certification according to DIN EN ISO/IEC 17024 is available. This combines defined organizational quality processes with demonstrably proven expert competence.

Digital forensics in Duisburg – from suspicion to technical determination

A forensic investigation ideally begins with a precise question. "My phone was hacked" or "An employee stole data" initially describes a suspicion. For the technical investigation, this must be developed into a verifiable question.

For example, a smartphone could be examined for unusual applications, relevant system artifacts, unknown account connections, or other technically conspicuous traces. For a company computer, on the other hand, it might be relevant to determine whether external storage devices were connected, which files were processed during the relevant period, or what user activities are documented.

This distinction between suspicion and technical findings is essential. Unusually high battery consumption does not prove spyware. A connected USB stick does not prove data theft. And logging in via a specific IP address does not automatically identify the person who was actually using the device.

Only the analysis and correlation of multiple pieces of evidence can yield a more reliable overall picture. Our article " What is Digital Forensics?" provides a basic introduction to this topic.

IT forensics for private individuals in Duisburg

Today, personal devices contain a significant part of our personal lives: communication, photos, contacts, accounts, location information, documents, calendars, browser data, and access to cloud services. Therefore, suspected cases where another person may have access to this information are particularly sensitive.

Typical private investigation questions arise after separations, in cases of digital conflicts, after suspicious account access, in cases of lost or deleted data, and in cases of concrete suspicion of surveillance or manipulation of a device.

Especially in such situations, a neutral investigation is important. The goal is neither to reinforce suspicion nor to prematurely rule it out. What matters are technically verifiable traces.

Phone hacked? Smartphone forensics for victims in Duisburg

Suspected compromise of a smartphone is among the most frequent private inquiries. Affected individuals report, for example, unknown logins, unusual device behavior, altered settings, or that other people know information that should be confidential.

Depending on the device and available technical access, a smartphone investigation can include various data sources. These can include app data, system information, communication artifacts, browser information, account data, and other device-specific traces.

The possibilities differ considerably between iPhones and Android devices, and sometimes even between individual device models and operating system versions. Furthermore, encryption and security mechanisms of modern smartphones limit certain investigative possibilities.

We explain in detail how such an investigation basically works under What is Smartphone Forensics?.

Ex-partner, unauthorized access and shared accounts

After a breakup, the digital situation can be complicated. Apple ID, Google account, email, cloud storage, family sharing, jointly set up devices, or previously known passwords can initially lead to confusion about who still has access to which information.

A meaningful investigation therefore does not focus solely on the question of whether "spyware" has been installed. First, it should be clarified through which technical means potential access could even occur.

Depending on the case, relevant factors might include registered devices, account connections, existing synchronization information, or locally stored artifacts. Not every unauthorized access attempt requires malware. Sometimes the cause lies in a previously established account connection or still-valid login credentials.

Deleted WhatsApp messages, photos and other personal data

Deleted data is not necessarily completely gone immediately. Whether recovery is possible depends heavily on the specific device, application, storage medium, encryption, and subsequent use after the deletion process.

For example, local databases, media, backups, or other artifacts may still be relevant for messenger data. However, modern smartphones manage storage differently than traditional hard drives. Therefore, a blanket promise to completely recover deleted WhatsApp messages or photos would be technically unreasonable.

For WhatsApp , we have described the basic possibilities and limitations in more detail in our article " Forensic analysis of WhatsApp messages".

iPhone and Android forensics

Mobile investigations require a distinction between different device platforms. iPhones have a tightly integrated security architecture from Apple. Android devices, on the other hand, differ significantly in terms of manufacturer, chipset, operating system version, and security implementations.

Therefore, the examination method is not chosen generically. Before starting, it is checked which device is present, which operating system version is installed, what condition the device is in, and what question is to be answered.

Further information can be found under iPhone forensics and Android forensics.

Computer forensics in private disputes and digital anomalies

Not every suspected case of private data breaches involves a smartphone. PCs, laptops, and Macs can also contain relevant traces. These include, for example, user activity, browser information, files, connected storage devices, installed programs, and system events.

An investigation may be useful if files have been inexplicably altered or deleted, unauthorized access is suspected, or digital information needs to be secured for legal proceedings.

Computers store a wealth of information that isn't immediately visible in a standard file explorer. These technical artifacts can be crucial for reconstructing the timeline of an event. You can find more information on this topic under " What is Computer Forensics?".

Digital surveillance and stalking – when multiple systems can be affected

Digital stalking can take various technical forms. Examples include misused login credentials, shared accounts, location sharing, manipulated device settings, or other forms of unauthorized access.

Therefore, an investigation should not begin with the assumption that a specific surveillance software must necessarily be installed. Depending on the initial situation, smartphones, computers, user accounts, and cloud services can be considered together.

If there is additional concrete evidence that not only digital devices, but also rooms or vehicles could be under technical surveillance, the investigation can be expanded to include professional counter-surveillance and eavesdropping protection. Digital forensics and technical counter-surveillance employ different investigative approaches and are only combined if the circumstances justify it.

Duisburg as a business location: Why digital footprints are also relevant for companies

Duisburg is characterized by a unique combination of industry, logistics, port operations, and services. The Port of Duisburg forms an internationally networked logistics hub, while at the same time manufacturing companies, suppliers, service providers, and numerous medium-sized businesses operate in the region.

Such structures process sensitive information daily: customer and supplier data, calculations, contracts, technical documentation, access data, personnel information, and internal business data. A potential data breach can therefore extend far beyond a purely IT problem.

In a specific suspected case, it must first be determined where relevant traces could have originated. Workstations, company mobile phones, external storage devices, user accounts, email systems, and cloud services can each document different parts of the process.

Investigate data theft by employees

A common scenario in companies arises around the time an employee leaves. If an unusually large number of files are opened, external storage devices are used, or company information is transferred to private accounts shortly before a termination, a forensic investigation may be necessary.

Technically, depending on the system, it is possible to examine, for example, connected USB devices, file system information, user activities, recently used files, or existing communication and cloud artifacts.

However, the interpretation must be done carefully. A USB device connected to a computer does not, in itself, prove that trade secrets have been copied. Several matching traces, on the other hand, can allow for a much more conclusive reconstruction.

A more detailed explanation can be found in the published knowledge article "Proving data theft by employees".

Cyberattacks and compromised corporate systems

After a cyberattack, companies often face two tasks simultaneously: protecting or restoring ongoing operations while preserving potential digital traces.

Uncoordinated cleanup efforts can alter relevant information. Conversely, an active attack should not continue simply to secure evidence. Incident response and forensic investigations must therefore be coordinated according to the specific situation.

Depending on the incident, end devices, user accounts, system and event logs, email data, network data, or cloud information may be included in the investigation.

Forensic evidence preservation – why analysis is not the first step

Before data can be analyzed, a suitable basis for investigation must be established. The required data security method depends on the object of investigation.

For traditional data storage media, for example, a forensic image can be useful. Smartphones and modern computer systems have different requirements due to encryption, flash memory, and integrated security mechanisms.

The goal is not to mechanically apply the same method every time, but to choose a procedure that suits the data source and the specific question at hand.

Further technical background information is explained in our article "What is forensic data backup?".

Forensic tools: Why different systems are used

Digital forensics encompasses a wide variety of devices and data structures. Therefore, there is no single tool that can cover all investigations equally well.

Cellebrite UFED is used primarily for supported mobile devices. Cellebrite Collector and Cellebrite Inspector enhance the capabilities for computer and endpoint investigations. X-Ways Forensics enables detailed analysis of storage media, file systems, and raw data. MOBILedit Forensic and MEFF 3 PRO expand the toolkit, particularly in the area of ​​mobile systems.

However, the number of programs used is not the decisive factor. Forensic software can extract, structure, and present data. The professional skill lies in selecting the right data sources, technically classifying artifacts, and not drawing conclusions that go beyond what the available data actually allows.

Certified quality and expert competence

When it comes to digital evidence preservation, organizational quality and personal expertise should be considered separately. This is precisely why the two existing certification levels are relevant.

The quality management system certified by TÜV NORD according to DIN EN ISO 9001 includes, among other things, the area of ​​IT forensics. It concerns defined processes, responsibilities and quality mechanisms within the company.

This is distinct from personnel certification according to DIN EN ISO/IEC 17024. This relates to the competence of the correspondingly certified expert within the respective certification program.

For clients, this means that technical investigations can be carried out within defined quality processes and at the same time expertly evaluated and documented.

Typical cases examined in Duisburg

The following examples illustrate typical initial situations. They are deliberately formulated as exemplary scenarios and do not constitute a claim about specific mandates.

Private case: The former partner knows confidential information

After a breakup, a person discovers that their former partner has access to information that should only be accessible via smartphone, email, or cloud accounts. Instead of immediately assuming spyware, they first narrow down possible technical avenues of access. Relevant factors might include devices still registered, previous account connections, or locally stored artifacts.

Private case: Important WhatsApp communication was deleted

Following a private conflict, messages are needed to reconstruct the events. First, it is determined which smartphone and app version are involved and what other data sources are available. Only then can it be assessed whether a complete, partial, or no reconstruction is technically possible.

Private case: Suspicion of smartphone surveillance

A person notices unusual activity on their device and suspects unauthorized access. The investigation focuses on objectively verifiable technical traces. If no reliable evidence of a compromise is found, the initial suspicion must not be interpreted as a positive finding.

Business case study: Files before an employee leaves

At a company in Duisburg, it was noticed that extensive file activity took place immediately before a staff change. Depending on the available data, computer artifacts, external storage media, and other relevant sources can be examined and compared chronologically.

Business case study: Unclear data leakage in the logistics environment

Confidential information is leaking to recipients outside the intended group. Since the transmission route is initially unknown, potential data sources are prioritized based on the specific suspicion. Such an investigation can involve computers, mobile devices, accounts, or cloud systems, without requiring a specific cause to be identified beforehand.

This is how an IT forensic investigation is conducted for clients from Duisburg.

1. Define the research question

The first step is to clarify what exactly needs to be determined. The more precisely the question is formulated, the more effectively devices and data sources can be selected.

2. Determine the objects of investigation

Next, a decision is made as to which smartphones, computers, storage devices, or accounts might be relevant to the question. Not every existing device needs to be examined automatically.

3. Securely back up data

The backup method is adapted to the respective system. This aims to create a suitable basis for investigation and to document the handling of the source data in a traceable manner.

4. Analyze digital traces

In the forensic laboratory, the data relevant to the question being investigated is examined. Automatically generated results are not accepted without verification, but are technically classified.

5. Results correlate

Where necessary, multiple data sources are compared. This allows for a better assessment of temporal sequences or technical relationships.

6. Report or expert opinion

Depending on the scope of the assignment, relevant findings are documented in a structured manner. In addition to an investigation report, an expert opinion can also be prepared if required.

7. Explain the result clearly.

In conclusion, it should be clearly recognizable which facts were technically established, what conclusions can be drawn from them, and where the limits of the available data lie.

What should private individuals consider before undergoing an examination?

• Avoid hastily resetting a suspicious smartphone.
• Do not delete suspected spyware on your own if an investigation is planned.
• Do not further endanger deleted data through intensive continued use of the device.
• Document unknown logins and security alerts.
• For shared accounts, have it checked which devices and access methods might be relevant.
• Do not install any dubious surveillance or "spyware scanners" that can themselves cause changes.

What companies should avoid in the event of a suspected digital crime

A suspicious company computer should not be reinstalled or completely wiped without prior consideration. Similarly, deleting a user account, continued intensive use of a system, or uncoordinated changes can affect relevant traces.

In the event of an ongoing cyberattack, damage control is naturally a high priority. At the same time, it is crucial to decide as early as possible which volatile or only temporarily stored information needs to be secured for later reconstruction.

IT forensics in Duisburg and the Rhine-Ruhr region

Duisburg is located within a closely interconnected metropolitan area. Digital surveys are therefore not limited to the city limits. Clients from Essen , Oberhausen, Mülheim an der Ruhr, Krefeld , Düsseldorf, and other cities in the Rhine-Ruhr region can also be served.

Previously published regional information can be found, for example, on IT forensics in Essen and IT forensics in Cologne . Further regional location pages will only be linked internally once the respective target page has actually been published.

Further laboratory analysis is carried out centrally at the forensic laboratory in Esslingen am Neckar. On-site measures can also be carried out at the client's location, depending on the object being examined and the specific requirements.

Frequently asked questions about IT forensics in Duisburg

Can I, as a private individual, commission an IT forensic investigation?

Yes. Private investigations often involve smartphones, computers, deleted communications, possible unauthorized access, cloud accounts, or suspected digital surveillance.

Is it possible to determine if my phone has been hacked?

A smartphone can be examined for technically relevant anomalies and existing traces. Whether unauthorized access can actually be proven depends on the specific device, the incident, and the data still available.

Is it possible to check if my ex-partner still has access to my data?

Depending on the situation, devices, account connections, and available login information can be examined. The search should not focus solely on spyware, as access can also occur via known passwords, synchronized accounts, or devices that are still authorized.

Can deleted WhatsApp messages be recovered?

This may be possible under certain technical conditions, but it is not guaranteed. Device model, operating system, app version, existing databases, backups, and continued use after deletion all affect the possibilities.

Can deleted photos be recovered?

Whether deleted photos can be recovered depends primarily on the storage system and whether the underlying data is still present. Modern smartphones and SSDs can significantly complicate recovery due to their storage management.

Can an iPhone be scanned for spyware?

Yes, an iPhone can be examined for available technical clues and relevant artifacts. However, an examination cannot guarantee the detection of every conceivable form of past or present compromise.

Are Android smartphones also being examined?

Yes. The possibilities depend on factors such as manufacturer, model, Android version, security configuration, and device condition.

Is it possible to determine if someone has used my computer?

Computers can contain various user and system artifacts from which activities can be reconstructed. However, the technical assignment of an activity to a user account is not automatically equivalent to proving which natural person was actually sitting in front of the computer.

Can data leakage via USB be proven?

Traces of connected USB devices and other file activity may be present. Whether a specific copying operation of particular files can be proven depends on the overall data situation.

Can a cyberattack be investigated retrospectively?

Yes, provided suitable data sources are still available. System logs, end devices, user accounts, email data, or network and cloud information may be relevant depending on the incident.

Which devices can be examined?

Depending on the specific requirements, the examination can include smartphones, tablets, Windows PCs, Macs, hard drives, SSDs, USB storage devices, and other digital systems. Certain cloud and account data may also be part of the examination.

Can an expert opinion be prepared for court proceedings?

Depending on the specific questions, an IT forensic expert report can be prepared. The technical investigation and evaluation must be kept separate from the legal assessment. The competent court ultimately decides on the evaluation of the evidence.

How much does an IT forensic investigation cost in Duisburg?

The costs depend on the number and type of devices, data volume, technical accessibility, questions to be investigated, and desired documentation. In more complex cases, a reliable cost estimate is often only possible once the technical scope has been sufficiently defined.

How long does an examination take?

It depends heavily on the case. A single smartphone with a narrowly defined question requires a different level of effort than multiple computers, mobile devices, and cloud data from a company. Therefore, the processing time should be estimated individually.

When is additional counter-surveillance useful?

If, in addition to a suspicion of digital activity, there are concrete indications of technical surveillance of rooms, conversations, or vehicles, a further technical investigation of the surroundings may be advisable. The necessity should be assessed based on the actual circumstances.

Request IT forensics services in Duisburg

Whether it's a compromised smartphone, deleted communication, possible account access, digital conflict after a separation, cyberattack or suspicion of data theft: the crucial first step is a clear question to investigate.

For an initial technical assessment, four pieces of information are particularly helpful: Which device or system is affected? What specific observations were made? When did the anomaly first occur? And has the device been used, modified, or reset since then?

Based on this, it is possible to assess which data sources may be relevant and which approach is technically appropriate. The investigation can then range from controlled data preservation and forensic analysis to structured documentation or an expert opinion.

Further in-depth information on investigation methods, digital evidence and technical limitations can be found in our knowledge database on digital forensics.