A digital event often leaves more traces than are immediately visible on a smartphone or computer. Messages are stored in databases, files generate metadata, operating systems log activities, and applications leave their own technical artifacts. LB Forensics examines digital data on smartphones, computers, storage media, backups, and other authorized data sources for private individuals, companies, and lawyers in Gelsenkirchen.

A forensic investigation doesn't begin with simply gathering as much information as possible. The crucial question is the technical one: Was a message deleted? Is there evidence of unauthorized access? When was a file opened or modified? Was an external storage device used? Can the activity of different devices be linked to a common time period?

Depending on the object of investigation, we use specialized solutions such as Cellebrite, X-Ways Forensics, Belkasoft, and MOBILedit Forensic . However, the software used is only one part of the investigation process. Crucial factors are the underlying digital artifacts, their technical origin, and the question of what conclusions can actually be drawn from the available data.

IT forensics for Gelsenkirchen: Services and areas of investigation

• Mobile phone forensics for Apple iPhones and Android smartphones
• Computer forensics for Windows PCs, notebooks and Apple Macs
• forensic analysis of WhatsApp and other messenger data
• Investigation of deleted or not immediately visible information
• Check for technically detectable signs of unauthorized access
• Analysis of hard drives, SSDs, USB sticks and other storage media
• Evaluation of existing backups and authorized cloud data
• Reconstruction of relevant user, file, and system activities
• Investigation of potential data leaks and internal incidents
• temporal correlation of digital traces from multiple data sources
• Forensically verifiable data backup
• Documentation of the investigation steps and technical findings

Further technical information can be found in our knowledge base on digital forensics . There, we discuss individual data sources and methods in much greater depth, thereby avoiding unnecessary repetition on the regional service pages.

What questions can be investigated using digital traces?

IT forensics attempts to reconstruct technical processes based on available data. However, not every finding automatically constitutes proof of the suspected action.

A USB entry, for example, can indicate that a storage device was connected to a computer. This does not necessarily mean that files were copied. Similarly, activity performed under a user account does not automatically mean that the account holder was personally using the device.

Typical research questions include:

• Were messages or files deleted?
• Can a communication history be technically reconstructed?
• Are there any indications of possible unauthorized access?
• When was a specific file created, opened, or modified?
• What activities took place within a defined period?
• Was a USB stick or external hard drive connected?
• Are there any indications of data transmission?
• Can smartphone, computer, and cloud data be linked together over time?
• What statement can actually be made about a particular digital artifact?

Mobile phone forensics in Gelsenkirchen for iPhone and Android

Mobile phone forensics in Gelsenkirchen examines digital traces on smartphones and their associated data sources. Modern mobile devices contain communication data, photos, videos, apps, browser information, user accounts, and numerous technical system data.

A smartphone examination therefore goes far beyond simply manually inspecting the display. Depending on the device and the extraction method used, relevant data can include app databases, messenger data, files, media, call information, timestamps, and certain system, location, and connection artifacts.

The information that is technically accessible depends, among other things, on the manufacturer, model, operating system version, security status, encryption, and device condition.

iPhone forensics on Apple devices

Apple iPhones combine hardware, iOS, Secure Enclave, and cryptographic protection mechanisms. Therefore, the potential depth of investigation varies considerably between different devices and iOS versions.

Depending on the initial situation, messages, app data, photos, videos, files, browser information, timestamps, and other system artifacts can be examined. Existing local backups or authorized iCloud data can provide additional sources of information.

The current state of the device can also play a role. A switched-on iPhone that has already been unlocked since the last restart can offer a different forensic starting point than the same device immediately after a restart.

We explain the technical background in more detail under What is iPhone forensics?

Android forensics at Samsung, Google, Honor and other manufacturers

Android devices exhibit a particularly wide range of technical variations. Manufacturer, processor, Android version, security patch, and individual device configuration can all influence the available backup methods.

Depending on the smartphone, messenger data, app databases, images, videos, files, browser information, call data and other system artifacts can be examined.

This is precisely why using multiple forensic solutions can be beneficial. Different tools support individual manufacturers, device models, and data structures in different ways.

Examine WhatsApp messages and messenger data

WhatsApp is regularly among the relevant data sources in private disputes, stalking, suspected fraud, employment law matters and internal company investigations.

A forensic analysis of WhatsApp data is not limited to the visible chat view. Depending on the data available, messages, timestamps, participants, group structures, images, videos, documents, voice messages, call information, and other app artifacts can be examined.

A detailed technical description can be found in the previously published knowledge article "Forensic analysis of WhatsApp messages".

Can deleted WhatsApp messages be recovered?

Under certain technical conditions, deleted content or remaining artifacts may still exist. Possible data sources include app databases, backups, media archives, or other accessible backups.

However, a complete recovery cannot be guaranteed. Operating system, WhatsApp version, database state, time of deletion, and further device usage all affect the available data.

The absence of a message must also be interpreted correctly. If it is not found in the examined data source, this does not automatically prove that this communication never took place.

WhatsApp screenshot or original data?

A screenshot only documents the visible appearance of a chat. It typically does not contain the underlying message database, internal identifiers, or other app information.

If the original smartphone or a suitable data extraction tool is available, additional technical information can be examined. This allows for a significantly more in-depth evaluation than is possible based on a single screenshot.

Computer forensics services in Gelsenkirchen for Windows and macOS

Computer forensics in Gelsenkirchen examines technical traces on PCs, notebooks, Apple Macs, and their associated storage media. Operating systems generate numerous artifacts during use, which can later be relevant for reconstruction.

Depending on the research question, the following data, among others, can be examined:

• Files and file system structures
• File metadata and timestamps
• Deleted files and remaining file artifacts
• User accounts and login activity
• Browser history and downloads
• connected USB devices
• external hard drives and other storage media
• Program and application traces
• Windows event logs
• macOS system artifacts
• local cloud and synchronization information

Further technical background information is discussed in the article "What is Computer Forensics?".

Is it possible to determine if a USB stick was used?

Computer systems can contain information about which USB devices have been connected to them. Depending on the system, device identifiers and temporal correlations can be determined.

Simply plugging in a USB stick does not prove a file transfer. To investigate whether specific data was copied, further artifacts must be considered.

This can include file accesses, recently used files, file system information, application traces, and additional time information.

Reconstructing files and user activity chronologically

File systems, programs, and operating systems store different timestamps. These can provide clues as to when a file was created, modified, opened, or otherwise processed.

However, timestamps should not be interpreted in isolation. Copying operations, applications, synchronization services, or operating system processes can influence individual timestamps.

A more reliable assessment therefore combines as many independent artifacts as possible.

Deleted files and data recovery

A deleted file is not handled the same way on every storage medium. Magnetic hard drives, modern SSDs, and the flash memory of mobile devices differ considerably.

With SSDs, data cleanup mechanisms can cause deleted data to become inaccessible relatively quickly. Encryption, file system, time of deletion, and subsequent usage also affect recovery possibilities.

IT forensics differs from traditional data recovery. Data recovery focuses primarily on restoring lost content. A forensic investigation additionally considers the origin, metadata, time reference, integrity, and corresponding system traces.

Digital examinations for private individuals from Gelsenkirchen

Private smartphones and computers can contain relevant information in personal and legal disputes. Therefore, a significant portion of digital forensic investigations does not concern corporate networks, but rather individual private devices.

Typical questions include, for example:

• Suspected hacked or compromised smartphone
• possible spyware or unauthorized access
• deleted WhatsApp messages
• Fraud or identity theft
• Stalking and digital harassment
• Separation or divorce
• disputed digital communication
• Securing existing digital evidence

Has my phone been hacked or monitored?

High battery consumption, heat generation, unknown notifications or unusual data traffic do not, in themselves, prove a compromise.

A forensic investigation should therefore be open-ended and search for technically detectable anomalies. Depending on the device, applications, configurations, profiles, system information, communication artifacts, and other data can be examined.

Even a negative finding has its limits. If no evidence is found within the available data, this does not automatically mean that an attack did not occur at an earlier time.

Stalking, separation and private conflicts

In private disputes, messages, files, photos, or user accounts can play a significant role. At the same time, a distinction must be made between technical access and legal authorization.

LB Forensics only examines devices, user accounts, and data sets for which it has the appropriate authorization. Secretly accessing other people's smartphones or accounts is not a permissible forensic investigation.

Digital forensics for companies in Gelsenkirchen

Gelsenkirchen combines its industrial structure with the increasing digitalization of its business location. Companies, the healthcare sector, services, logistics, industry, and technology-oriented sectors process extensive digital data sets. At the same time, the city itself describes Gelsenkirchen as a networked location with a well-developed digital infrastructure.

In an internal suspected case, workplace computers, notebooks, smartphones, external storage media, user accounts, email systems and cloud applications can all be relevant simultaneously.

Suspected data breach

In the event of a potential data breach, the first step should be to determine which transmission methods were technically available. USB storage devices are just one possibility.

Depending on the circumstances, cloud services, email, browser applications, messaging apps, or other platforms may also be relevant. An investigation can therefore compare file accesses, external storage devices, browser information, cloud artifacts, and other system traces.

A single technical finding is often insufficient for a reliable conclusion. The aim is rather to connect several independent pieces of evidence in terms of both content and time.

IT forensic analysis following a cyber incident

Following a suspected attack, system logs, user activity, suspicious files, persistence mechanisms, network clues, and other digital artifacts may be relevant.

In an ongoing security incident, containment and evidence preservation must be considered together. A powered-on and already decrypted computer can present a different forensic starting point than the same device after a restart.

Therefore, it is not technically correct to immediately switch off every suspicious device as a matter of course.

Cellebrite for mobile data sources

We use Cellebrite particularly with mobile and other digital data sources. The extraction and analysis methods available depend on the specific device, operating system, and security status.

Extraction alone does not answer any evidentiary question. Only subsequent technical analysis reveals which artifacts are relevant to the specific case.

X-Ways Forensics for Computers and Storage Media

X-Ways Forensics enables detailed investigations of computers, hard drives, SSDs and other data storage devices.

File system structures, existing and deleted files, metadata, and other technical information can be specifically examined using this method. A detailed file system analysis can be particularly relevant when investigating questions about file usage, storage media, and deleted information.

Belkasoft for comprehensive artifact analyses

Belkasoft supports the structured analysis of various digital data sources. In more complex cases, communication, file, and system information can be correlated chronologically.

MOBILedit Forensic as an additional method of mobile phone forensics

MOBILedit Forensic expands the possibilities for extracting and analyzing data from mobile devices. Especially when dealing with devices from different Android manufacturers, an additional backup or analysis method can be useful.

Why multiple forensic tools are used

No single program supports all devices, operating systems, and data structures with the same level of detail. Furthermore, different solutions may recognize and display the same data in different ways.

In cases of important findings, a second method can therefore contribute to technical plausibility. However, the original artifact always remains decisive. An automatically generated software hit is not yet a conclusive forensic assessment.

Integrity of digital evidence

In an evidence-oriented investigation, it should remain traceable on which data set the analysis is based. Depending on the object of investigation, a suitable forensic backup may therefore be created first.

Cryptographic hash values ​​can be used to verify the integrity of a defined dataset. They allow a comparison to determine whether this specific dataset has changed compared to a documented reference state.

However, a hash value does not automatically prove the completeness of a backup, the authenticity of content, or the correctness of a subsequent interpretation.

We explain the technical details in more detail under Integrity of digital evidence.

Chain of Custody and Evidence Chain

The chain of custody documents the organizational handling of an object of investigation. This can include acquisition, identification, securing, storage, and relevant handovers.

It therefore fulfills a different function than a hash value. The hash value serves for the technical integrity check of a defined dataset. The chain of evidence, on the other hand, documents how the device and the backups generated from it were handled.

Further information can be found in the published article " Chain of Custody in Digital Forensics".

From digital object of investigation to verifiable findings

Narrow down the question

First, it is defined which technical issue is to be investigated and which time period is relevant.

Select data sources

Smartphones, computers, data storage devices, backups, or cloud data are prioritized based on their importance to the specific situation.

Capture the technical initial state

Device model, operating system, encryption, security status and available access options can influence the backup strategy.

Back up relevant data

The data backup method is adapted to the specific object under investigation. Where appropriate, subsequent analysis is performed on a defined backup set.

Targeted examination of artifacts

Files, databases, communication information and system traces are evaluated based on the previously defined question.

Several tracks correlate with each other

If different artifacts relate to the same process, they can be compared with each other in terms of time and content.

Present findings and interpretation separately.

A comprehensible documentation distinguishes between directly ascertained data, its professional interpretation, and the limitations of the available data.

Gelsenkirchen in the digital economic region of the Ruhr area

Gelsenkirchen lies in the heart of the Ruhr metropolitan region and is closely connected to the surrounding economic and residential areas. At the same time, the city has been pursuing digitalization and networking projects for years and boasts a well-developed digital infrastructure.

The immediate regional area includes, among others, Gladbeck, Bottrop, Essen , Bochum , Herne, Herten, Recklinghausen, and Dorsten . These locations are used here solely for geographical reference and are not presented as branches of LB Forensik.

Already published regional LB forensics pages exist, among others, for IT forensics in Essen and IT forensics in Dortmund.

Gelsenkirchen itself is already designated as a nationwide area of ​​operation for LB Forensik. However, for a digital investigation, the city limits are less important than the specific data source, the device's condition, the relevant time period, and the technical question at hand.

What should be avoided before a forensic examination?

A smartphone that may be relevant as evidence should not be hastily reset to factory settings. Suspicious apps, files, or messages should also not be deleted independently if their origin or usage is to be investigated later.

Data recovery, cleanup, or anti-spyware programs can create new files and system information, thereby altering existing traces.

A computer that has already been switched off should not be restarted normally, even for a preliminary inspection. The operating system startup process itself can generate new activities and affect existing artifacts.

Conversely, immediately shutting down a running system is not always the right approach. With encrypted devices, the current state can be important for later backup options.

FAQ for clients from Gelsenkirchen

Does LB Forensics also examine smartphones belonging to private individuals?

Yes. Depending on their specific question, private individuals can have iPhones, Android smartphones, computers, data storage devices, existing backups, and other authorized data sources examined.

Is it possible to determine if a mobile phone has been hacked?

A forensic investigation can look for technically detectable evidence of possible unauthorized access or compromise. The reliability of the findings depends on the specific device and the available data.

Can deleted WhatsApp messages be recovered?

Under certain conditions, databases, backups, media, or other artifacts may allow for a complete or partial reconstruction. However, a successful recovery cannot be guaranteed.

Is it possible to determine if files have been copied to a USB stick?

Connecting a USB device can leave technical traces. Whether a specific file transfer can be traced depends on other existing artifacts.

Can multiple devices from the same case be examined together?

Yes. If smartphone, computer, data storage device or cloud data relate to the same subject matter, relevant information can be jointly evaluated and correlated with each other over time.

Is it possible to determine if a file has been subsequently modified?

Depending on the file and data source, metadata, file system information, backups, and other technical artifacts can provide clues to changes. Not every manipulation can be definitively reconstructed afterward.

Can IT forensics determine which person carried out an action?

Not automatically. Digital traces can often be linked to a device, user account, or technical process. This does not necessarily imply which individual actually operated the device.

Which forensic software does LB Forensics use?

Depending on the device, data source and investigation objective, we use, among other things, Cellebrite, X-Ways Forensics, Belkasoft and MOBILedit Forensic.

Should a suspicious smartphone be reset before examination?

No. A reset can alter or remove relevant data and technical traces. If the device in question is potentially relevant as evidence, the next steps should be technically assessed before a reset.