When private messages suddenly become known to another person, a smartphone exhibits unusual activity, or important data is missing, concrete suspicions quickly arise. However, this observation alone is insufficient for a reliable investigation. What is crucial is identifying the actual digital traces present, how they might have originated, and what technical conclusions can be drawn from them.

Our IT forensics services in Mainz support individuals, companies, lawyers, and other clients with the professional investigation of digital devices and data. Smartphones, computers, storage media, and personal user accounts are particularly frequent focus areas. Depending on the specific circumstances, existing backups or other accessible data sources may also be relevant.

Mainz possesses a unique technological and economic context for this. Biotechnology, healthcare, media, digital technologies, research, and a diverse SME sector characterize the location. Therefore, in addition to personal data, research information, business communications, project documents, and confidential know-how can also be subject to forensic investigation.

IT forensics in Mainz – turning an anomaly into a technical finding

Digital forensics doesn't begin with a ready-made answer, but with a clear question. Are there indications of unauthorized access? Is deleted data still available? Can certain account activities be dated? Or has company data possibly been transferred to external systems?

Only once the specific question has been defined can it be determined which devices and data sources are actually relevant. This keeps the investigation focused and avoids unnecessary analysis of personal or business data.

Equally important is the technical boundary. An unknown login does not automatically identify the person behind the access. Similarly, a connected USB stick does not prove data theft. The same applies to unusually high battery consumption: it can indicate a problem, but it is not proof of spyware.

IT forensics for private individuals in Mainz

A significant portion of digital forensic investigations concerns private matters. Smartphones, messaging apps, user accounts, cloud services, and personal computers are often the focus.

Typical questions include:

• Could another person possibly have access to my smartphone?
• Are there any technical indications of spyware or manipulation?
• Are any unknown devices connected to my user accounts?
• Can my former partner still access my personal data?
• Can deleted WhatsApp messages still be investigated?
• Are photos, videos, or documents still recoverable?
• Are there any relevant digital traces left after a phishing or fraud incident?
• How can digital information be secured for legal proceedings?

Which data is actually accessible depends on the specific device, operating system, security status, encryption, and the technically feasible extraction method. Therefore, each investigation must be planned individually.

Mobile phone hacked or monitored – which clues are truly reliable?

Many affected users initially observe symptoms such as increased battery consumption, unusual heat generation, crashes, or unexplained data usage. Such anomalies may warrant an investigation, but are not sufficient on their own to prove a compromise.

A forensic analysis therefore considers objectively verifiable technical information. Depending on the device, applications, permissions, account connections, system artifacts, and other data may be relevant.

The investigation should not focus solely on classic spyware. Previous login credentials, still-authorized devices, linked accounts, or active cloud synchronizations can also explain why another person's personal information remains accessible.

The interplay of several clues is therefore crucial. Only when different pieces of evidence technically fit together does a reliable picture emerge.

Digital access after a separation

Especially after a breakup, digital connections that were deliberately established during the relationship can persist. These include, for example, shared Apple or Google accounts, registered tablets, saved passwords, family sharing, or messenger connections.

Therefore, a suspected case should not be hastily reduced to the question of whether spyware is present on the smartphone. First, it is necessary to clarify which technical access points are actually realistic.

Based on this information, it can then be determined whether only the smartphone itself or also other accounts and devices should be examined. This keeps the analysis focused and avoids unnecessary intrusions into private data.

Forensic analysis of WhatsApp and Messenger

WhatsApp communication can be of considerable importance in private conflicts, threats, fraud cases, or legal disputes.

A forensic analysis goes beyond simply reading visible chat histories. Depending on the data set, messages, timestamps, participant information, media, documents, group information, and other technical artifacts may be relevant.

A screenshot therefore has a different technical significance than data from a verifiably secured original source. While a screenshot merely documents a visible representation, the original data may contain additional technical information.

We explain the possibilities and limitations in detail in the knowledge article "Forensic analysis of WhatsApp messages".

Can deleted WhatsApp messages be recovered?

Under certain technical conditions, deleted messages or remaining artifacts may still be present. However, a complete recovery cannot be reliably guaranteed.

Crucial factors include the device model, the operating system, the WhatsApp version, the state of the database, existing backups, and further use after deletion.

Additional data sources may also be relevant. An older backup might contain messages that are no longer visible on the current smartphone. Similarly, another device involved might contain a different communication status.

If deleted communication is important, the smartphone should therefore not be reset if possible, and WhatsApp should not be reinstalled prematurely.

Deleted photos, videos, and other files

Photos, videos, and documents can also be the subject of a forensic investigation. However, whether deleted content can be recovered depends heavily on the storage technology used.

Modern smartphones use encrypted flash memory and complex memory management mechanisms. This significantly differs their capabilities from those of traditional hard drives.

That's precisely why additional data sources should be considered. Backups, cloud synchronizations, or other connected devices can contain important information, even if the original smartphone no longer provides it completely.

iPhone and Android forensics

iPhones and Android smartphones require different investigation strategies. For Apple devices, factors such as model, iOS version, device condition, and security configuration play a role. For Android devices, there are also significant differences between manufacturers, chipsets, operating system versions, and patch levels.

Therefore, it is not possible to predict in general terms which data is available on every device. The appropriate backup and extraction method must be determined individually for each specific smartphone.

Furthermore, the actual amount of data provided by each method is crucial. This technical scope must be taken into account in the subsequent evaluation.

Computer forensics for private and business matters

A Windows PC, Mac, or notebook can contain additional traces that are not present on a smartphone. Depending on the system, user activity, file system information, browser data, connected devices, and other technical artifacts can be relevant.

Chronological reconstruction is often particularly revealing. When was a file opened? What user activity occurred during the same period? Was an external storage device connected? What other events correspond to the process under investigation?

When several such pieces of information correspond with each other, a clearly reliable overall picture can emerge.

Viewing smartphone and computer together

Many digital processes are now spread across multiple devices. Messenger apps are used on smartphones and also on computers. Photos and documents are synchronized with cloud services. Emails are accessed on multiple devices.

Therefore, a purely device-focused approach can overlook a relevant part of the issue. If the question under investigation concerns multiple systems, a joint analysis can be significantly more informative.

However, here too, the following applies: not every technically accessible data source needs to be automatically fully evaluated. The scope of the investigation should be based on the specific circumstances.

Phishing, smishing and online fraud

After a phishing or smishing incident, there is often concern that the entire smartphone or computer has been compromised. Technically, this is not necessarily the case.

For a meaningful investigation, the sequence of events should therefore first be reconstructed. Which message was received? Which link was opened? Were login credentials entered? Were there any downloads or other unusual activities?

Depending on the circumstances, SMS messages, emails, browser information, downloads and other technical traces can help to document the process in a traceable manner.

A forensic investigation can reveal technical connections. However, it does not automatically identify the natural person behind a phone number, domain, or technical infrastructure.

Digital evidence for lawyers and court proceedings

When digital information becomes relevant to a legal dispute, it is often insufficient to simply consider the visible content of a file or message. The origin, storage method, and technical context can be equally important.

For suitable datasets, cryptographic hash values ​​can be used to verify the continued integrity of a defined dataset.

However, a hash value does not answer every question of proof. It proves neither the truth of a piece of content nor automatically its authorship.

Integrity, authenticity, origin and personal attribution are therefore different issues that must be assessed separately.

Mainz as a location for biotechnology, research and digital economy

Mainz has an economic structure that differs significantly from traditional industrial centers. Biotechnology, healthcare, media, digital technologies and research characterize the city, as does a broadly diversified medium-sized business sector.

This results in very different digital assets. Research data, personal health information, technical documentation, media content, project information, and business know-how can all become forensically relevant, depending on the circumstances.

If there is a concrete suspicion of manipulation or data leakage, it should therefore first be clarified which type of data could be affected and on which systems corresponding traces are to be expected.

Research and development data as digital evidence

Especially in the fields of biotechnology and research, digital information can have considerable scientific and economic value.

Research findings, evaluations, project documentation, and development documents are often created over extended periods. Simultaneously, they are edited, versioned, and exchanged on different systems.

In the event of a potential data breach, the mere existence of a specific file is therefore not the only relevant factor. Timestamps, user activity, file system information, and external storage media can also contribute to the reconstruction.

Nevertheless, a technical finding should not be interpreted more strongly than the data allows. For example, the fact that a file was opened does not automatically prove that it was subsequently shared.

IT forensics for companies and law firms in Mainz

Business investigations often begin with a specific anomaly. This includes unusual file activity, suspicious user accounts, external storage devices, or indications of a possible data breach.

Typical questions include:

• Were any confidential files copied or deleted?
• Which external storage devices were used?
• Were there any unusual activities prior to changing employers?
• Has a user account been compromised?
• Could sensitive research or project data have been leaked?
• Which systems were affected by a cyber incident?

Especially when dealing with sensitive research, media, or corporate data, the scope of the investigation should be precisely limited to the actual research question. This keeps the analysis focused and simultaneously reduces unnecessary intrusions into irrelevant datasets.

Data theft and internal suspicions

If there is a concrete suspicion of the leakage of confidential company data, depending on the circumstances, workplace computers, notebooks, company mobile phones, external data storage devices and other data sources may be relevant.

The presence of a connected USB device is only one piece of evidence. For a reliable assessment, additional file and user activity may need to be considered.

Only when several technical traces match can a stronger connection emerge.

Cyber ​​incidents – securing evidence and limiting damage

After a cyberattack, companies must combine two goals: preventing further damage and simultaneously preserving relevant evidence for later reconstruction.

A hasty reinstallation can alter important information. On the other hand, a compromised system should not be unnecessarily continued to operate solely for the purpose of preserving evidence.

Therefore, decisions should be made as early as possible regarding which systems need to be isolated, which data needs to be backed up, and which measures need to be documented.

The most appropriate approach always depends on the specific attack scenario.

Forensic data backup – quality begins before analysis

The quality of a study is not determined solely by the subsequent evaluation. Even the securing of the object of study can influence its validity.

Smartphones, SSDs, traditional hard drives, and modern computers have different technical requirements. Therefore, there is no universal backup method for all devices.

For suitable data storage media, forensic images and write-protection methods can be useful. Modern smartphones, however, require different extraction methods.

It is therefore crucial to document in a comprehensible manner which device was examined, which method was used, and what scope of data this method actually provided.

Our forensic software

Different devices and data structures require specialized tools. Therefore, depending on the object of investigation and the specific question being asked, we use several forensic solutions.

Cellebrite Inseyets

Cellebrite Inseyets particularly supports the structured analysis of mobile digital data. Depending on the device and available extraction capabilities, relevant smartphone artifacts can be specifically examined and correlated.

Cellebrite Digital Collector

Cellebrite Digital Collector supports suitable backup procedures for computers and digital storage media. The specific procedure depends on the hardware, operating system, encryption, and investigation objective.

Cellebrite Inspector

Cellebrite Inspector serves for the further analysis of computer forensic data sets and supports the structured evaluation of relevant artifacts within large data sets.

X-Ways Forensics

X-Ways Forensics enables detailed investigations of file systems, data carriers, partitions and other computer forensic structures.

MOBILedit Forensic and MEFF 3 Pro

MOBILedit Forensic and MEFF 3 Pro complement mobile forensics and, depending on the device, can open up additional technical analysis avenues.

The software used, however, only provides technical data and structures. Only a professional evaluation determines the significance of an artifact for the specific research question. Therefore, an automated software report does not replace expert interpretation.

Certified processes and expert competence

LB Detektive GmbH has a quality management system certified by TÜV NORD according to DIN EN ISO 9001, the scope of which includes IT forensics.

In addition, the expert has personal certification according to DIN EN ISO/IEC 17024.

Both levels fulfill different functions. While DIN EN ISO 9001 concerns defined organizational quality processes, personnel certification refers to the proven competence of a certified person.

For clients, transparent investigation procedures, controlled handling of evidence, and technically understandable documentation are particularly relevant.

Three typical examination situations in Mainz

Private information remains known after a separation

After a separation, suspicions arise regarding continued digital access. Instead of automatically assuming spyware, possible access routes via smartphones, accounts, connected devices, and other technically plausible connections are considered.

Deleted messenger communications should be backed up.

After a dispute, relevant messages are no longer fully visible. First, it is examined which data sources are still available and which technical extraction methods are feasible. Only then can a reliable assessment be made as to whether further reconstruction has any prospect of success.

Confidential project data may have been leaked.

Unusual file activity occurs within a clearly defined timeframe. Instead of immediately concluding that this indicates a data breach, relevant devices, user activity, and external storage media are examined in context.

This is how an IT forensic investigation works

1. Clarify the question

First, it is defined which technical issue is to be investigated and which time period is relevant.

2. Determine relevant data sources

Then, it will be examined which smartphones, computers, data storage devices or accounts can actually contribute to clarifying the situation.

3. Assess the technical starting point

Operating system, encryption, device condition and available data influence the appropriate backup strategy.

4. Back up data professionally

The backup method is then adapted to the specific device and the particular research question.

5. Analyze digital traces

Relevant artifacts are classified technically and chronologically and, if necessary, compared with other data sources.

6. Evaluate relationships

Individual technical hits are not considered in isolation. Instead, alternative explanations and possible connections are taken into account.

7. Document results

Depending on the assignment, the findings are compiled in an investigation report or further expert documentation.

What should you avoid as much as possible before an examination?

• Do not hastily reset a potentially compromised smartphone.
• Do not delete suspicious applications yourself.
• Do not install any unknown anti-spyware or cleaning programs.
• Do not reinstall WhatsApp if relevant messages have been deleted.
• Do not unnecessarily overwrite existing backups.
• Use devices with deleted data as little as possible.
• Do not unnecessarily modify computers if there is a concrete suspicion of data leakage.
• Document security alerts and unusual timestamps.

IT forensics in Mainz and the Rhine-Main region

Our service area includes Mainz , Wiesbaden , Ingelheim am Rhein, Bingen, Rüsselsheim am Main, Bad Kreuznach and other locations in the surrounding region.

Due to its close integration into the Rhine-Main region, there are also direct connections towards Frankfurt and other existing areas of operation.

This allows both sensitive private investigations and more complex corporate cases with multiple digital pieces of evidence to be processed regionally and nationally.

Frequently asked questions about IT forensics in Mainz

Can I, as a private individual, have my smartphone examined?

Yes. Typical private investigations involve unauthorized access, suspected spyware, deleted communications, user accounts, or digital evidence for personal and legal disputes.

Is it possible to determine if someone has access to my phone?

Depending on the device, existing technical clues regarding possible access routes can be examined. However, complete proof of every conceivable previous access cannot be guaranteed.

Can my former partner access my data without spyware?

Yes. Other authorized devices, known login credentials, cloud accounts, or existing synchronizations can provide alternative access methods.

Can deleted WhatsApp messages be recovered?

Under certain circumstances, messages or technical artifacts may still be present. However, a complete recovery cannot be guaranteed in general.

Can deleted photos be recovered?

This depends on the device, storage system, deletion time, further use, and available additional data sources.

Can a company mobile phone also be examined?

Yes. Company mobile phones can represent relevant digital evidence in internal cases of suspected data breaches, compromised user accounts, or other security incidents.

Is it possible to investigate whether research or project data has been copied?

Depending on the available data, file activity, external storage devices, and other technical artifacts can be examined. Whether a specific copying operation can be proven depends on the overall evidence.

Can a cyberattack be investigated retrospectively?

This may be possible if suitable data sources are still available. Which systems and information are relevant depends on the specific incident.

Is a software report already considered an expert opinion?

No. Software provides technical data and artifacts. An expert opinion, however, requires a defined question, a professional evaluation, and a comprehensible derivation of the findings.

How much does an IT forensic investigation cost in Mainz?

The effort required depends on the equipment, the research question, the amount of data, technical accessibility, and the desired documentation. Therefore, in more complex cases, the actual scope of the investigation is first defined.

Secure digital traces before they change

In cases of suspected unauthorized access, deleted messages, or suspicious activity on a computer, the current state of the device can be crucial for subsequent investigation.

Resetting, reinstalling, or performing manual cleanups can alter relevant data. Furthermore, continued use can overwrite or otherwise affect older information.

Therefore, it should first be clarified which devices and data sources need to be backed up and which approach is technically appropriate for the specific case.

Further in-depth technical information on smartphone, computer and messenger forensics as well as digital evidence preservation can be found in our knowledge database.