When messages disappear, a smartphone exhibits unusual activity, or it's impossible to explain when files were opened, modified, or transferred on a computer, suspicions quickly arise. However, this isn't sufficient for a reliable technical assessment. LB Forensics examines digital traces on smartphones, computers, storage media, backups, and accessible cloud data for private individuals, companies, and lawyers in Wuppertal.

At the heart of an IT forensic investigation lies a clearly formulated question: What data actually exists? What activities can be traced chronologically? Are there any technical indications of unauthorized access, deletion, manipulation, or a possible data leak? Only when the relevant artifacts are correlated can a technically verifiable finding emerge from individual digital traces.

Depending on the device, operating system, and investigation objective, we use specialized tools such as Cellebrite, X-Ways Forensics, Belkasoft, and MOBILedit Forensic. This software is used for data preservation, processing, and analysis. The expert evaluation is based on the underlying data structures and not solely on an automatically generated program display.

IT forensics for Wuppertal: Services and areas of investigation

• Smartphone forensics for Apple iPhone and Android devices
• Computer forensics for Windows systems and Apple macOS
• Analysis of WhatsApp and other digital communication
• Examination of deleted or no longer immediately visible data
• Examination of technically detectable indications of unauthorized access and compromises
• Analysis of hard drives, SSDs, USB sticks and other data storage devices
• Examination of existing backups and accessible cloud data
• Reconstruction of relevant user, file, and system activities
• Analysis of potential data leaks and internal incidents
• temporal correlation of digital traces from multiple data sources
• Forensic preservation and integrity testing of digital data sets
• Comprehensible documentation of the examination steps and findings

We explain technical basics, individual investigation procedures and typical evidentiary questions in detail in our knowledge database on digital forensics.

What questions can a digital examination answer?

Digital forensics is not about collecting as much data as possible, but about investigating a specific technical question based on existing evidence. This allows the relevant data to be narrowed down and prevents individual artifacts from being overinterpreted without context.

In a private case, for example, it might be necessary to determine whether WhatsApp communication still exists or whether there is evidence of unauthorized access to a smartphone. In a company, on the other hand, the focus might be on whether data was copied to an external storage device or transferred via a cloud service.

Typical questions include: Were messages or files deleted? When was a specific file opened or modified? What user activity can be traced within a specific timeframe? Was a USB storage device connected? Is there evidence of unauthorized access? Can smartphone, computer, and cloud artifacts be correlated chronologically?

A single piece of technical evidence often doesn't provide a conclusive answer. For example, the presence of a connected USB stick only shows that the storage device was connected to a system. A specific copying process must be investigated using further evidence.

Smartphone forensics in Wuppertal

Smartphones are among the most information-rich digital evidence sources today. Communication, photos, videos, apps, user accounts, internet usage, and numerous system details can all converge on a single device.

A forensic smartphone examination is therefore not limited to the data directly visible on the screen. Depending on the device and extraction method, app databases, messages, media, browser information, call data, files, timestamps, system information, and certain location and connection artifacts can be relevant.

The information that is actually accessible depends significantly on the device model, operating system version, security status, encryption, and available backup method.

iPhone forensics for private and business cases

With an Apple iPhone, hardware, iOS, and cryptographic protection mechanisms are closely intertwined. Modern devices use hardware-based encryption and other security mechanisms, so the potential depth of investigation cannot be reliably deduced solely from the model name.

Depending on the technical setup, messages, app data, photos, videos, files, browser information, timestamps, and other system artifacts can be examined. Existing local backups or accessible iCloud data can provide additional sources of information.

A professional examination therefore does not guarantee a complete data retrieval across the board. The crucial factor is what data could actually be obtained and what conclusions this information allows in the specific case.

We explain the technical basics and limitations in detail in the published knowledge article "What is iPhone forensics?".

Android forensics at Samsung, Google, Honor and other manufacturers

Android smartphones differ significantly from one another technically. Manufacturer, chipset, Android version, security patch, and individual device configuration influence which backup and extraction methods are available.

Depending on the device, messenger data, app databases, files, photos, videos, browser information, system artifacts and other usage information can be examined.

Especially in the Android environment, the use of multiple forensic tools can be beneficial. Different systems support certain devices and data structures to varying degrees.

Forensic analysis of WhatsApp messages

WhatsApp is regularly among the relevant data sources in private disputes, fraud cases, stalking, employment law issues, and internal investigations. A forensic analysis differs significantly from simply reviewing a visible chat history.

Depending on the available data, messages, time information, participant data, group structures, images, videos, documents, voice messages and other app artifacts can be examined.

For a more detailed technical description, see Forensic analysis of WhatsApp messages.

What options are available for deleted WhatsApp messages?

Deleted messages may, under certain circumstances, still be fully or partially present in a database, backup, media collection, or other accessible data source. Recovery is not guaranteed.

Whether content can be reconstructed depends, among other things, on the operating system, WhatsApp version, database status, existing backups, and further use of the smartphone.

New messages, app updates, synchronizations, and other write operations continuously change the data. Therefore, a device that may be relevant as evidence should not be used unnecessarily.

Why a screenshot has only limited technical significance

A screenshot initially only captures the visible display on a screen. It does not automatically include the original news database, internal identifiers, additional time information, or other app artifacts.

If the original smartphone or a suitable forensic extraction is available, it can be checked whether additional data structures exist that technically support the visible content or place it in a different context.

Computer forensics for Windows and macOS

Computers generate numerous technical traces during use. Files are created and opened, programs are launched, users are logged in, websites are accessed, external storage devices are connected, and data is processed with local or cloud-based applications.

Depending on the research question, file system structures, file metadata, deleted files, user accounts, login activities, browser histories, downloads, USB devices, program traces, system logs and local cloud synchronization data may be relevant.

Especially with more complex issues, the real value of the insights often only arises from the combination of different artifacts. For example, a file can be examined using its metadata, the last used applications, existing system traces, and other time-related information.

Further basics of the methodology are explained in the knowledge article What is computer forensics ?.

USB storage devices and possible copying processes

Windows and other operating systems can contain information about which USB devices have been connected to a computer. Under certain conditions, this information can be used to identify which specific storage device was used.

However, simply connecting a storage device does not automatically prove that files have been transferred. For a more thorough evaluation, relevant information may include file accesses, recently used files, timestamps, file system information, and other system artifacts.

File usage and temporal reconstruction

Depending on the file system, application, and operating system, various timestamps may be present. These can provide clues as to when a file was created, modified, opened, or otherwise processed.

However, timestamps are not isolated pieces of evidence. Copying operations, synchronization services, applications, and system processes can alter time information. Therefore, their significance should be assessed within the technical context.

Deleted data: Recovery and forensic value

Data recovery and digital forensics pursue different goals. Traditional data recovery focuses on making lost files accessible again. A forensic investigation additionally investigates the origin, integrity, temporal context, and technical significance of the data.

Whether deleted data can be recovered depends heavily on the storage medium used. A magnetic hard drive, an SSD, and the flash memory of a smartphone behave differently after a deletion process.

Especially with modern SSDs, storage cleanup mechanisms can lead to deleted content becoming inaccessible relatively quickly. Different technical requirements apply to encrypted mobile devices.

Furthermore, a recovered file does not automatically constitute the complete forensic evidence. Metadata, file system information, timestamps, and corresponding system artifacts can also be crucial.

Digital investigations for private individuals from Wuppertal

A significant portion of digital forensic issues today arise in the private sphere. Smartphones, messaging apps, computers, and cloud accounts can contain relevant information in personal conflicts or legal disputes.

Typical reasons include possible unauthorized access to a smartphone, deleted communication, suspected fraud, stalking or harassment, separation and divorce, disputed messages, suspicious changes to user accounts, or securing digital data before legal proceedings.

Suspected hacked smartphone

Unusually high battery consumption, heat generation, unfamiliar messages, or conspicuous data traffic do not, in themselves, prove an attack. Such symptoms can have numerous technical causes.

A professional investigation should therefore be conducted without prejudice. Depending on the device, apps, system information, profiles, configurations, communication artifacts, and other technical data can be examined for anomalies.

Even a negative finding has its limits. If no evidence of a compromise is found within the available data, it cannot automatically be concluded that an attack did not occur at an earlier time.

Separation, divorce and private disputes

In private disputes, a distinction must be made between technical access and legal authorization. Not everything that is technically accessible may be automatically investigated.

LB Forensics only examines devices, accounts, and data sets for which it has the appropriate authorization. Secretly accessing other people's smartphones or user accounts is not a permissible forensic investigation.

Digital forensics for companies in the Bergisches Land region

Wuppertal is a major economic center in the Bergisches Land region. Industry, healthcare, trade, services, research, and medium-sized businesses process extensive amounts of business and personal data. Therefore, in the event of an internal incident or a cyberattack, multiple digital data sources can be relevant simultaneously.

Workstations, laptops, smartphones, external storage devices, user accounts, email systems, and cloud applications can all be interconnected. Therefore, the investigation should not automatically be limited to a single device.

Suspected data leakage or unauthorized data copying

In the event of a potential data breach, it is necessary to investigate which technical transmission paths are even possible. External storage devices are just one possibility. Depending on the circumstances, cloud services, email, browser activity, or other applications may also be relevant.

A reliable investigation attempts to connect several independent pieces of evidence. The goal is not to draw the broadest possible conclusions from a single find, but rather to technically narrow down a possible sequence of events.

Investigation following a cyber incident

Following a suspected cyberattack, system logs, user activity, suspicious files, persistence mechanisms, network clues, and other system artifacts can be examined.

In an ongoing incident, however, two objectives must be balanced: containing the attack and preserving relevant digital evidence. A powered-on and already decrypted computer can present a different forensic starting point than the same device after a restart.

Therefore, the blanket instruction to immediately switch off every suspicious device is not technically correct in every case.

Cellebrite on mobile data sources

We use Cellebrite primarily for securing and analyzing mobile and other digital data sources. The available extraction options depend on the specific device, operating system, and security status.

The technical extraction is only one step in the process. The crucial next step is the expert interpretation of the obtained data in relation to the specific research question.

X-Ways Forensics for Computers and Storage Media

X-Ways Forensics is used especially for detailed investigations of computers, hard drives, SSDs and other data storage devices.

File system structures, files, metadata, deleted data, and other technical information can be specifically analyzed. This is particularly relevant for questions concerning file usage, storage media, and reconstructed file system activity.

Belkasoft for complex artifact analyses

Belkasoft supports the evaluation of different digital data sources and the structured correlation of relevant artifacts.

In more complex cases, this allows, for example, communication data, system information and other digital traces to be correlated chronologically.

MOBILedit Forensic for smartphones

MOBILedit Forensic expands the technical possibilities for extracting and analyzing data from mobile devices. Especially given the wide variety of Android devices, an additional investigation method can be beneficial.

Why multiple forensic tools are used

No single analysis program supports all devices, operating systems, and data structures equally. Furthermore, different solutions may recognize and display the same data set in different ways.

In cases of relevant findings, an additional method for technical verification may therefore be useful. The underlying artifact remains crucial. An automatically generated software hit is not yet a conclusive forensic assessment.

Integrity of digital evidence

In an evidence-based investigation, it must remain transparent on which data basis the analysis is performed. Depending on the type of evidence, this includes appropriate securing and documentation of the relevant data.

Hash values ​​can be used to check the integrity of a defined dataset. They allow for a technical comparison to determine whether this specific data has changed compared to a documented reference state.

However, a hash value proves neither the truth of a piece of content nor automatically the authorship or completeness of an extraction. The various aspects must be evaluated separately.

A detailed explanation can be found under Integrity of digital evidence.

Chain of custody and traceable chain of evidence

The chain of custody documents the handling of digital evidence. In particular, it can record when a device was taken into custody, how it was identified and secured, and what relevant processing steps or transfers took place.

The chain of custody thus fulfills a different function than a hash value. While a hash value can technically compare a defined dataset, the chain of custody documents the organizational handling of the object of investigation.

We explain further background information in the article " Chain of Custody in Digital Forensics".

How does a forensic investigation proceed?

Define the question and time period

The process begins with a specific technical question. At the same time, the relevant time period for the investigation is determined.

Prioritize data sources

Not every existing device needs to be automatically examined. Smartphones, computers, storage media, backups, or cloud data are assessed based on their relevance to the case.

Document the initial technical state

Device model, operating system, security status, encryption and available access options can influence the appropriate backup method.

Back up relevant data

The technical security measures are adapted to the specific piece of evidence. Where appropriate, subsequent analysis is based on a defined, secured dataset.

Targeted analysis of artifacts

Files, databases, communication data and system information are evaluated based on the previously defined research question.

The traces correlate with each other

When several independent artifacts relate to the same process, they can be compared chronologically and in terms of content. This often allows for a more precise classification of a technical process.

Separate findings and interpretation

A comprehensible documentation distinguishes between directly observed data and the professional conclusions drawn from it. Likewise, technical limitations are identified when the available data does not allow for a clear statement.

Wuppertal and the surrounding region

Wuppertal is the largest urban center in the Bergisches Land region and closely connected to the economic and metropolitan areas along the Rhine and Ruhr rivers. Digital investigations can therefore involve both private devices and business-related systems, as well as data sources spanning multiple locations.

The immediate regional area includes Remscheid, Solingen, Velbert, Mettmann, Schwelm, Ennepetal, Hattingen, and Sprockhövel . Essen , Düsseldorf, and other cities in the Rhine-Ruhr region may also be relevant in matters of supra-regional importance.

The cities mentioned are solely for geographical reference. They are not presented here as branches of LB Forensik.

Previously published regional information can be found, for example, on IT forensics in Düsseldorf and IT forensics in Duisburg.

What should be avoided before an examination?

A smartphone that may be relevant as evidence should not be reset prematurely. Likewise, suspicious apps, files, or user accounts should not be deleted without a prior technical assessment.

Data recovery, cleanup, and so-called anti-spyware programs can create new files and system artifacts, thereby altering the original state.

A computer that has already been switched off should not be started up normally just for initial inspection. Even a regular operating system startup can alter logs, files, and time information.

Conversely, immediately switching off a powered-on device is not always the right approach. Especially with encrypted systems, the current state of the device can affect subsequent backup options.

FAQ on digital forensics in Wuppertal

Does LB Forensics also examine devices belonging to private individuals?

Yes. Private individuals are explicitly among our clients. Depending on the issue, we can examine smartphones, computers, data storage devices, existing backups, and accessible cloud data.

Can an iPhone be checked for potential spyware or unauthorized access?

A forensic investigation can look for technically detectable indications of a possible compromise. What conclusions can be drawn depends on the device, the iOS version, and the actual data available.

Can deleted WhatsApp communication still be recovered?

Under certain conditions, database information, backups, media, or other artifacts may enable partial or complete reconstruction. A full recovery cannot be guaranteed.

Is it possible to determine if an employee has copied company data?

Depending on the available data, USB devices, file access, cloud applications, browser activity, email data, and other system artifacts can be examined. A single technical finding is often insufficient for a reliable conclusion.

Is it possible to verify whether digital data has been altered?

Depending on the file type and data source, metadata, file system information, internal file structures, backups, and corresponding artifacts can provide clues to changes. Not every manipulation can be clearly reconstructed afterward.

Can a WhatsApp screenshot be verified for authenticity?

A screenshot can be technically analyzed, but its informational value on its own is limited. If the original device or a suitable extraction is available, additional app and communication artifacts can be used for comparison.

Can smartphone, computer and cloud data be analyzed together?

Yes. If multiple data sources relate to the same issue, relevant information can be compared and correlated over time.

Can it be clearly determined which person used a device?

Not automatically. Digital traces can often be linked to a device, user account, or technical process. This does not necessarily imply which natural person was actually operating the device in question at that time.

Which forensic software does LB Forensics use?

Depending on the device, data source and question being asked, tools such as Cellebrite, X-Ways Forensics, Belkasoft and MOBILedit Forensic are used.

What should be considered first when dealing with potential digital evidence?

The device should be modified as little as possible. Before resetting, reinstalling, deleting suspicious applications, or restarting, check whether any relevant traces could be lost.