Digital evidence is rarely stored in just one location. A message might be saved on a smartphone, a file might leave additional traces on a computer, and a backup might contain a previous version of the data. LB Forensics examines digital traces on smartphones, computers, storage media, backups, and authorized cloud data for private individuals, companies, and lawyers in Münster.

The focus is on a specific technical question. Were messages deleted? Is there evidence of unauthorized access? When was a file opened or modified? Was an external storage device used? Can activities from smartphones, computers, and other data sources be correlated chronologically? A forensic investigation aims to answer such questions based on actual artifacts and simultaneously clarify the limitations of the available data.

Depending on the device, operating system, and investigation objective, we use specialized forensic solutions such as Cellebrite, X-Ways Forensics, Belkasoft, and MOBILedit Forensic . Different tools can access different data structures or technically supplement the results. However, the underlying digital artifact and its expert interpretation remain paramount.

IT forensics in Münster: Services at a glance

• Mobile phone forensics for Apple iPhones and Android smartphones
• Computer forensics for Windows PCs, notebooks and Apple Macs
• Analysis of WhatsApp and other digital communication
• Examination of deleted or no longer immediately visible data
• Check for technically detectable evidence of unauthorized access
• Analysis of hard drives, SSDs, USB sticks and other data storage devices
• Evaluation of existing backups and authorized cloud data
• Reconstruction of relevant user, file, and system activities
• Investigation of potential data leaks and internal incidents
• temporal correlation of digital traces from multiple data sources
• Forensically verifiable backup of relevant data sets
• Documentation of the investigation method and technical findings

You can find more in-depth technical information in our knowledge database on digital forensics . There, we discuss individual methods and data sources in greater detail, without burdening the regional service page with the same content multiple times.

What digital traces can be examined?

Digital forensics is not limited to visible documents, photos, or messages. Operating systems, apps, and applications generate a wealth of additional information that can be relevant for reconstructing an event.

Depending on the system, this includes, among other things, app databases, file metadata, communication information, browser artifacts, user logins, system events, connected storage devices and synchronization traces.

The information that is actually relevant depends on the research question. For example, in the case of a suspected data breach, different artifacts are the focus than when investigating possible unauthorized access to a smartphone.

Therefore, a technical finding should never be interpreted further than its data source and the available context allow.

Mobile phone forensics in Münster for iPhone and Android

Mobile phone forensics in Münster examines digital traces on smartphones and associated data sources. Modern mobile devices contain communication data, photos, videos, apps, browser information, user accounts, and numerous technical system data.

A professional smartphone analysis goes beyond simply reviewing visible content. Depending on the device and the available data, relevant information may include messages, app databases, media, files, call information, timestamps, and certain system, location, and connection artifacts.

The information that is actually accessible depends on factors such as manufacturer, model, operating system version, security status, encryption, and available extraction method.

iPhone forensics on Apple devices

With Apple iPhones, hardware, iOS, and cryptographic protection mechanisms are closely intertwined. Therefore, the model alone cannot determine which data will be accessible during a forensic investigation.

Depending on the technical situation, messages, app data, photos, videos, files, browser information, timestamps, and other system artifacts can be examined. Existing local backups or authorized iCloud data can also provide additional sources of information.

The current state of the device can play a significant role. A switched-on iPhone that has already been unlocked since the last restart can offer a different forensic starting point than the same device immediately after a restart.

Further technical background information is explained in the published knowledge article "What is iPhone forensics?".

Android forensics for Samsung, Google, Honor and other manufacturers

Android smartphones differ significantly from one another technically. Manufacturer, model, chipset, Android version, security patch, and individual device configuration all influence the possible extraction methods.

Depending on the device, messenger data, app databases, files, images, videos, browser information, call data and other system artifacts can be examined.

The wide variety of devices is one reason why different tools are used in mobile forensics. One method can unlock data on a specific device that is not available, or available differently, with another method.

Analyze WhatsApp messages and messenger data

Messenger communication can be an important digital data source in private disputes, fraud, stalking, employment law matters and corporate cases.

A forensic WhatsApp analysis is not limited to the visible chat. Depending on the data available, messages, participant information, timestamps, group structures, images, videos, documents, voice messages, call information, and other app artifacts can be analyzed.

We explain the technical basics in detail under "Forensic analysis of WhatsApp messages".

Can deleted WhatsApp messages be recovered?

Under certain circumstances, deleted content or remaining artifacts may still exist. Relevant information may be found, for example, in app databases, existing backups, media libraries, or other accessible data sources.

However, a complete recovery cannot be guaranteed. The operating system, WhatsApp version, database state, time of deletion, and further use of the smartphone all affect the available data.

Even a negative finding must be professionally interpreted. If a message is not found within the examined data source, this does not automatically prove that the communication never existed.

Why a screenshot is not a complete forensic data source

A screenshot initially only documents the visible display on a screen. It does not automatically contain the underlying news database, internal identifiers, or other technical information.

If the original smartphone or a suitable forensic extraction is available, additional data structures and time information can be used for a technical comparison.

Computer forensics in Münster for Windows and macOS

Computer forensics in Münster examines technical traces on desktop PCs, notebooks, Apple Macs, and their associated storage media. Operating systems generate numerous artifacts during daily use, which can later contribute to the reconstruction of specific activities.

Depending on the question being asked, the following data areas, for example, may be relevant:

• Files and file system structures
• File metadata and timestamps
• Deleted files and remaining file artifacts
• User accounts and login activity
• Browser history and downloads
• USB devices and external storage media
• Program and application traces
• Windows event logs
• macOS system artifacts
• local cloud and synchronization information

We explain the methodology and typical data sources in more detail under What is Computer Forensics?

Can the use of a USB stick be proven?

Computer systems can store technical information about connected USB devices. Depending on the data available, device identifiers and temporal relationships, for example, can be analyzed.

However, proof of a connection does not automatically mean that files have been copied. Further evidence is needed to determine this.

This can include file accesses, recently used files, file system information, program traces, and additional time information.

Schedule files and user activities by time

File systems, applications, and operating systems generate different timestamps. These can provide clues as to when a file was created, opened, modified, or otherwise processed.

However, timestamps should not be interpreted in isolation. Copying processes, programs, cloud synchronizations, and system processes can influence individual values.

A more reliable reconstruction therefore takes into account as many independent digital traces as possible.

Deleted files, SSDs and data recovery

Whether deleted data can be recovered depends largely on the storage medium used. Magnetic hard drives, modern SSDs, and flash memory in mobile devices have different technical characteristics.

With SSDs, data cleanup mechanisms can cause deleted data to become inaccessible relatively quickly. Other factors include the file system used, encryption, the time of deletion, and subsequent usage.

Traditional data recovery focuses primarily on making lost information available again. IT forensics additionally considers the origin, time frame, metadata, integrity, and corresponding system traces.

A recovered file is therefore not automatically the complete forensic finding.

Digital forensics for private individuals from Münster

A large part of digital forensic issues concerns private smartphones, computers, and user accounts. Communication and personal data can play a crucial role in cases of fraud, stalking, separation, or other legal disputes.

Typical reasons for private investigations include:

• Suspected unauthorized access to smartphone or computer
• potential spyware or digital surveillance
• deleted WhatsApp or Messenger communication
• Fraud and identity theft
• Stalking and digital harassment
• separation and divorce
• disputed messages or files
• Securing existing digital evidence

Has my smartphone been hacked or monitored?

High battery consumption, heat generation, unfamiliar messages, or increased data traffic do not, in themselves, prove an attack. Such symptoms can have many technical causes.

A forensic investigation should therefore be conducted without prejudice. Depending on the device, applications, profiles, configurations, system information, communication artifacts, and other technical data can be examined for anomalies.

Even a negative finding has its limits. If no corresponding evidence is found within the available data, this does not automatically prove that no unauthorized access occurred at an earlier time.

Stalking, separation, and personal conflicts

In private disputes, messages, images, files, and user accounts can become relevant. At the same time, there is a clear difference between technical access and legal authorization.

LB Forensics only examines devices, accounts, and data sets for which it has the appropriate authorization. Secretly accessing other people's smartphones or user accounts is not a permissible forensic investigation.

Forensic investigations for companies and law firms in Münster

Münster combines a strong academic and scientific landscape with medium-sized businesses, the healthcare sector, research, services, and technology-oriented industries. Digital systems can therefore range from individual workstations to multiple interconnected data sources.

In a corporate scenario, for example, notebooks, smartphones, external storage devices, user accounts, email systems and cloud applications can all become relevant simultaneously.

Suspected data leakage or unauthorized data copying

In the event of a potential data breach, the first step should be to determine which transmission methods were technically available. USB storage devices are just one possibility.

Depending on the system, cloud services, email, browser applications, messaging apps, or other platforms may also be relevant. A forensic analysis can therefore compare file accesses, external storage devices, browser information, cloud artifacts, and other system traces.

A single finding should not be overinterpreted. For example, the presence of a connected storage medium does not automatically prove the transfer of confidential files.

Analysis following an IT security incident

Following a suspected cyberattack, system logs, user activity, suspicious files, persistence mechanisms, network clues, and other digital artifacts may be relevant.

In ongoing incidents, containment and evidence preservation must be considered together. A powered-on and decrypted computer can present a different forensic situation than the same device after a restart.

Therefore, the blanket recommendation to immediately switch off every suspicious system is not technically correct in every case.

Cellebrite for smartphone and mobile data analysis

We use Cellebrite particularly with mobile and other digital data sources. The extraction and analysis methods that are technically available depend on the device, operating system, security status, and specific research objective.

The extraction process only provides the foundation. Only the subsequent expert analysis reveals which artifacts are actually relevant to the matter under investigation.

X-Ways Forensics for Computers and Data Storage Devices

X-Ways Forensics enables detailed analysis of computers, hard drives, SSDs and other storage media.

File system structures, existing and deleted files, metadata, and other technical information can be specifically examined. Detailed file system analysis can be particularly relevant when dealing with questions about file usage and external storage media.

Belkasoft for complex digital artifacts

Belkasoft supports the structured analysis of various digital data sources. In more comprehensive investigations, communication, file, and system information can be correlated both temporally and thematically.

MOBILedit Forensic as an additional method of mobile phone forensics

MOBILedit Forensic expands the possibilities for extracting and analyzing data from mobile devices. An additional method can be particularly useful given the technical diversity of different Android manufacturers.

Why multiple forensic tools are used

No single program supports all devices, operating systems, and data structures with the same level of depth. Furthermore, different solutions may recognize and display the same data in different ways.

In cases where relevant findings exist, an additional method can therefore contribute to technical plausibility. However, the original artifact remains decisive. An automatically generated software hit is not a conclusive forensic assessment.

Integrity of digital evidence

In an evidence-based investigation, it should be transparent on which data basis the analysis is performed. Depending on the object of investigation, a defined data set can therefore be secured first.

Cryptographic hash values ​​can be used to verify the integrity of such a dataset. They allow for a technical comparison of whether this specific dataset has changed compared to a documented reference state.

However, a hash value does not automatically prove completeness, authenticity, authorship, or the correctness of a later interpretation.

Further information can be found under Integrity of Digital Evidence.

Chain of Custody and documented handling of evidence

The chain of custody describes the traceable handling of an object of investigation. This can include acquisition, identification, securing, storage, and relevant transfers.

It fulfills a different function than the technical integrity check. While a hash value can technically compare a defined data set, the chain of evidence documents the organizational handling of the device and the backups generated from it.

We explain the difference in detail in the knowledge article Chain of Custody in digital forensics.

From the initial question to a verifiable technical finding

Define the research objective

First, it is defined which technical issue is to be investigated and which time period is to be considered.

Determine relevant data sources

Smartphone, computer, data storage device, backup or cloud data are prioritized based on their relevance to the specific question.

Document the initial state

The device model, operating system, security status, encryption and available access options influence the further course of action.

Secure data in a technically suitable manner

The backup method depends on the object of investigation and the data source. Where appropriate, subsequent analysis is based on a defined backup.

Analyze relevant artifacts

Files, databases, communication information and system traces are specifically evaluated based on the research question.

Connecting independent tracks

When multiple data sources relate to the same process, they can be correlated in terms of time and content.

Present findings and interpretation separately.

A comprehensible documentation distinguishes between directly ascertained data, the professional interpretation, and the limitations of the available data.

IT forensics in the Münster area and the Münsterland region

Münster is the scientific, economic, and administrative center of the Münsterland region. The combination of universities, research institutions, the healthcare sector, medium-sized businesses, and technology-oriented structures leads to a wide range of potential digital challenges.

The regional area includes, among others, Greven, Telgte, Warendorf, Senden, Dülmen, Coesfeld, Steinfurt, and Emsdetten . Osnabrück and the surrounding regions can also be relevant in matters of supra-regional importance.

The cities mentioned are solely for geographical classification and are not presented here as branches of LB Forensik.

Further previously published regional information can be found, for example, on IT forensics for Dortmund and IT forensics for Essen.

What should be avoided before a forensic examination?

A smartphone that may be relevant as evidence should not be reset prematurely. Suspicious apps, messages, or files should also not be deleted independently if their origin or usage is to be investigated later.

Data recovery, cleanup, and anti-spyware programs can create new files and system information, thereby altering the original data.

A computer that has already been switched off should not be restarted normally just for a preliminary inspection. Even the operating system startup process can generate new activity and affect existing artifacts.

Conversely, immediately switching off a running device is not always the right approach. Especially with encrypted systems, the current device state can affect subsequent backup options.

FAQ on digital forensics in Münster

Does LB Forensics conduct investigations for private individuals from Münster?

Yes. Depending on the question being asked, smartphones, computers, data storage devices, existing backups and other authorized data sources can be examined.

Can it be investigated whether my phone has been hacked?

A forensic analysis can search for technically detectable indications of possible unauthorized access or compromise. Its reliability depends on the specific device and available data.

Can deleted WhatsApp messages be recovered?

Under certain conditions, database information, backups, media, or other artifacts may allow for a complete or partial reconstruction. However, a successful recovery cannot be guaranteed.

Is it possible to determine if a USB stick was used?

Computer systems can contain technical traces of connected USB devices. However, proof of the connection does not automatically prove a specific file transfer.

Can multiple devices from the same case be examined together?

Yes. If smartphone, computer, data storage device or cloud data relate to the same subject matter, relevant artifacts can be analyzed together and correlated with each other over time.

Is it possible to determine when a file was modified?

Depending on the file system and data type, metadata, application traces, and other system artifacts can provide clues about changes. However, a single timestamp should not be evaluated without its technical context.

Can IT forensics definitively determine which person acted?

Not automatically. Digital traces can often be linked to a device, user account, or technical process. This does not necessarily imply which individual actually operated the device.

Which forensic software does LB Forensics use?

Depending on the device, data source and investigation objective, we use, among other things, Cellebrite, X-Ways Forensics, Belkasoft and MOBILedit Forensic.

Should a potentially compromised smartphone be reset?

A reset of a device containing evidence should not be performed without a prior technical assessment. Doing so could alter or remove relevant data and technical traces.