Digital traces are created with virtually every use of a smartphone or computer. Messages are saved and deleted, files are opened, user accounts are used, external storage devices are connected, and data is synchronized with cloud services. If such processes later become relevant to a private, business, or legal matter, the visible user interface is often insufficient. LB Forensics examines smartphones, computers, storage devices, backups, and other authorized digital data sources for private individuals, companies, and lawyers in Magdeburg.

The starting point for an investigation is a specific technical question. Were messages deleted? Is there evidence of unauthorized access? When was a particular file used or modified? Was confidential company data possibly copied? What activities can be reconstructed within a relevant timeframe? The task of digital forensics is to secure existing artifacts, classify them technically, and clearly demonstrate their limitations.

For securing and analyzing evidence, we use specialized forensic solutions depending on the specific object of investigation. These include, among others, Cellebrite, X-Ways Forensics, Belkasoft, and MOBILedit Forensic . Different tools can access different data structures. However, the crucial factor remains the expert evaluation of the original digital artifact, not just its representation within a software program.

IT forensics for Magdeburg: Areas of investigation at a glance

• Mobile phone forensics for Apple iPhones and Android smartphones
• Computer forensics for Windows PCs, notebooks and Apple Macs
• forensic analysis of WhatsApp and other digital communication
• Examination of deleted or no longer immediately visible data
• Examination of technically detectable indications of possible unauthorized access
• Analysis of hard drives, SSDs, USB sticks and other data storage devices
• Evaluation of existing backups and authorized cloud data
• Reconstruction of relevant file, user, and system activities
• Investigation of potential data leaks and internal incidents
• temporal correlation of digital traces from multiple data sources
• Forensically verifiable backup of relevant data sets
• Documentation of the object under investigation, securing of evidence and technical findings

Further technical information can be found in our knowledge database on digital forensics . There, individual methods, data sources, and typical evidentiary questions are discussed in more detail.

What digital information can be relevant forensic purposes?

Digital forensics doesn't just examine files, photos, or visible messages. Operating systems, applications, and services generate a wealth of additional information in the background.

Depending on the device, relevant data may include, for example, app databases, communication data, file metadata, browser information, user logins, system logs, connected storage devices, synchronization data and various time information.

Which artifacts should actually be examined depends on the specific circumstances. For example, different traces are relevant in the case of a possible data leak than when determining whether a particular message existed or whether a smartphone shows signs of unauthorized access.

Therefore, a key principle is: A single digital artifact should not be interpreted further than the technical data allows.

Mobile phone forensics in Magdeburg for iPhone and Android

Mobile phone forensics in Magdeburg examines digital information on smartphones and their associated data sources. Mobile devices today store communication data, images, videos, apps, browser data, user accounts, and numerous technical system details.

A forensic smartphone examination goes beyond simply inspecting the display. Depending on the device and the technically available data, messages, app databases, media, files, call information, browser artifacts, timestamps, and certain system, location, and connection information can be relevant.

The depth of the investigation depends, among other things, on the manufacturer, model, operating system version, security status, encryption and available extraction method.

iPhone forensics on Apple devices

Apple iPhones use a tightly integrated combination of hardware, iOS, and cryptographic protection mechanisms. Therefore, it cannot be reliably guaranteed before an examination that all data from a device can be extracted.

Depending on the technical setup, messages, app data, images, videos, files, browser information, timestamps, and other system artifacts can be examined. Local backups and authorized iCloud data can also represent additional data sources.

The current state of the device can be relevant. An already unlocked and switched-on iPhone can offer a different forensic starting point than the same device immediately after a restart.

Further background information on possibilities and limitations can be found in the published knowledge article "What is iPhone forensics?".

Android forensics at Samsung, Google, Honor and other manufacturers

Android smartphones differ significantly in terms of hardware, chipset, operating system version, and security configuration. Consequently, the possible extraction methods can vary considerably.

Depending on the device, messenger data, app databases, files, photos, videos, browser information and other system artifacts can be examined.

Especially with Android devices, it can be useful to employ different forensic tools. One method might be able to access data on a particular device that is inaccessible or only partially accessible with another tool.

Technical analysis of WhatsApp and other messengers

Messenger communication is often a central source of data in private conflicts, stalking, fraud, employment law cases and internal company investigations.

A forensic analysis of WhatsApp data is not limited to reading visible messages. Depending on the available data, messages, participant information, timestamps, group structures, images, videos, documents, voice messages, and other app artifacts can be analyzed.

We explain the technical possibilities in detail in the knowledge article "Forensic analysis of WhatsApp messages".

Deleted WhatsApp messages

Deleted messages may, under certain conditions, still be fully or partially present in databases, backups, media collections, or other accessible data sources.

However, a successful recovery cannot be guaranteed. The operating system, app version, database status, existing backups, and continued use of the smartphone significantly influence the chances of success.

Further use can alter the data. New communication, app updates, and synchronization processes can affect existing artifacts. Therefore, unnecessary use should be avoided on a potentially relevant smartphone.

Why a screenshot doesn't offer the same data basis

A screenshot initially only documents the visible screen display. It does not automatically contain the underlying news database, internal app identifiers, or other technical information.

If the original device or a suitable extraction is available, additional artifacts can be used for technical comparison. This allows for a significantly more in-depth examination of a communication process than is possible with a single image.

Computer forensics in Magdeburg for Windows and macOS

Computer forensics in Magdeburg examines digital traces on desktop computers, notebooks, Apple Macs, and connected storage media. Operating systems generate numerous artifacts during their use, which can later be used to reconstruct specific activities.

Depending on the research question, the following data sources, among others, can be examined:

• Files and file system structures
• File metadata and time information
• Deleted files and remaining file artifacts
• User accounts and login activity
• Browser history and downloads
• USB devices and external storage media
• Program and application traces
• Windows event logs
• macOS system artifacts
• local cloud and synchronization information

Further basic information on the investigation of computer systems can be found under What is Computer Forensics?.

USB devices and external storage media

Computer systems can contain information about which USB devices or external storage media have been connected to them. Depending on the available data, device identifiers and certain temporal correlations can be analyzed.

A USB entry alone does not prove a file transfer. To determine whether specific data was copied, additional artifacts must be considered.

This can include file accesses, recently used files, file system information, timestamps, and other user or system activities.

Organize files chronologically

Files and applications can contain various timestamps. These can provide clues as to when data was created, modified, opened, or otherwise processed.

However, timestamps should not be interpreted in isolation. Copying processes, applications, cloud synchronizations, and system processes can alter time information.

A more technically sound assessment therefore takes into account as many independent artifacts as possible.

Deleted files, SSDs and data recovery

Deleted data cannot be recovered in the same way on every storage medium. Traditional hard drives, modern SSDs, and the flash memory of mobile devices behave differently from a technical standpoint.

With SSDs, data cleanup mechanisms can cause deleted data to become inaccessible relatively quickly. Additional factors include the file system, encryption, the time of deletion, and subsequent device usage.

Pure data recovery primarily aims to make lost information available again. A forensic investigation additionally considers the origin, metadata, temporal context, and other technical traces.

A recovered file is therefore not automatically the complete forensic finding.

Digital examinations for private individuals from Magdeburg

Digital forensics is no longer needed exclusively by companies. Smartphones and personal computers, in particular, contain extensive information that can be relevant in personal conflicts or legal disputes.

Typical private inquiries concern, for example, possible unauthorized access to a smartphone, deleted communication, stalking and digital harassment, suspected fraud, identity theft, separation or divorce, as well as disputed messages or other digital content.

Has my phone been hacked or monitored?

Unusually high battery consumption, heat generation, or unfamiliar error messages do not prove an attack. Such symptoms can have numerous technical causes.

A forensic investigation should therefore be conducted without prejudice. Depending on the smartphone, apps, system information, profiles, configurations, communication artifacts, and other technical data can be examined.

Even a negative finding has its limits. If no evidence of a compromise is found within the available data, this does not automatically mean that an attack could not have occurred at an earlier time.

Stalking, separation, and personal conflicts

In private conflicts, messaging apps, photos, files, user accounts, or other digital information can be relevant. At the same time, a clear distinction must be made between technical access and legal authorization.

LB Forensics only examines devices, accounts, and data sets for which it has the appropriate authorization. Secretly accessing other people's smartphones or user accounts is not a permissible forensic investigation.

IT forensic investigations for companies in Magdeburg

Magdeburg is a business, science, logistics and technology hub. Companies, particularly in IT and communications, mechanical engineering, industry, medical technology, e-mobility and services, process extensive business and personal data.

In addition, there are universities, colleges, and non-university research institutions. This means that digital investigations in Magdeburg can range from individual workstations to more complex projects involving multiple devices and user accounts.

In an internal incident, for example, notebooks, smartphones, external storage devices, email data, user accounts and cloud applications may all be relevant simultaneously.

Suspected data leakage or unauthorized data copying

In the event of a potential data breach, it should first be clarified which transmission paths were technically available.

USB storage devices are just one option. Depending on the system, cloud services, email, web applications, messengers, or other platforms may also be relevant for data transfer.

A forensic investigation can therefore compare file accesses, external storage devices, browser activities, cloud artifacts and other system traces.

A single technical finding should not be overinterpreted. For example, the presence of a connected storage medium does not automatically prove that confidential files were transferred to it.

Analysis following a cyber incident

Following a suspected cyberattack, user activity, system logs, suspicious files, persistence mechanisms, network clues, and other technical artifacts may become relevant.

In ongoing incidents, evidence preservation and containment must be considered together. A powered-on and decrypted computer can present a different forensic situation than the same system after a restart.

Therefore, the blanket recommendation to immediately switch off every suspicious system is not technically correct in every case.

Cellebrite for mobile data sources

We use Cellebrite particularly for mobile and other digital data sources. The available extraction method depends on factors such as the device, operating system, and security status.

However, the extraction process merely provides the technical basis. Only the subsequent analysis reveals which data are actually relevant to the specific research question.

X-Ways Forensics for Computers and Data Storage Devices

X-Ways Forensics enables detailed analysis of computers, hard drives, SSDs and other storage media.

File system structures, files, metadata, deleted data, and other technical information can be specifically examined using this method. A detailed file system analysis can be particularly relevant when dealing with questions about file usage or external storage media.

Belkasoft on the correlation of different artifacts

Belkasoft supports the structured analysis of various digital data sources. In more extensive investigations, relevant communication, file, and system information can thus be linked together both chronologically and thematically.

MOBILedit Forensic as another method of mobile phone forensics

MOBILedit Forensic complements our capabilities for extracting and analyzing data from mobile devices. Especially given the wide variety of Android devices, an additional method can be beneficial.

Why multiple forensic programs are used

No single forensic tool supports all devices, operating systems, and data structures with the same level of depth. Furthermore, different systems may recognize or process the same data differently.

In relevant cases, a second method can therefore contribute to plausibility checks. The underlying digital artifact remains decisive. An automatically generated software hit does not constitute a conclusive expert assessment.

Integrity of digital data sets

In an evidence-oriented investigation, it should remain traceable which data source was examined and on which data set the subsequent analysis is based.

Cryptographic hash values ​​can be used to verify the integrity of a defined backup. If the reference and control values ​​match, this strongly suggests that this specific data set has not changed since the original calculation.

However, a hash value does not automatically prove the completeness of a backup, nor authenticity, authorship, or the correctness of a later interpretation.

Further background information can be found in the published article "Integrity of digital evidence".

Chain of Custody and Evidence Documentation

The chain of custody documents the handling of an object under investigation. For example, in the case of a smartphone or computer, it can record when the device was taken into custody, its condition, how it was identified, and what security measures were taken.

A chain of custody serves a different function than a hash value. While a hash value can technically verify the integrity of a specific dataset, the chain of custody documents the organizational handling of the object of investigation.

Detailed information can be found under Chain of Custody in digital forensics.

From object of investigation to technical findings

Define the question and time period

First, it is determined which technical issue is to be investigated and which time period is relevant.

Select relevant data sources

Not every existing device needs to be automatically examined. Smartphones, computers, storage media, backups, or cloud data are prioritized based on their relevance to the case.

Document the initial state

Device model, operating system, encryption, security status and available access options can influence the appropriate backup strategy.

Secure data in a technically suitable manner

The data preservation method depends on the object of investigation and the research question. Where technically feasible, subsequent analysis is based on a defined data set.

Analyze relevant artifacts

Files, databases, communication information and system traces are specifically evaluated based on the research question.

Comparing traces from different sources

If several digital artifacts relate to the same process, they can be correlated with each other in terms of time and content.

Separate finding from interpretation

A comprehensible documentation distinguishes between directly ascertained data, its professional interpretation, and the technical limitations of the available data.

IT forensics in the Magdeburg and Saxony-Anhalt area

Magdeburg is the state capital and one of the central economic and scientific centers of Saxony-Anhalt. The combination of industry, logistics, information technology, research, and services means that digital issues can affect both private and more complex business data sources.

The regional area includes, among others, Schönebeck (Elbe), Burg, Haldensleben, Wolmirstedt, Oschersleben, Stendal, Dessau-Roßlau, and Halle (Saale) . Wolfsburg and Braunschweig can also play a role in supra-regional matters.

The cities mentioned are used here solely for geographical reference. They are not automatically presented as branches of LB Forensik.

Magdeburg is already within LB Forensik's nationwide service area. There is also a published regional page for IT forensics in Leipzig, covering Central Germany.

What should be avoided as much as possible before an examination?

A potentially sensitive smartphone should not be reset prematurely. Suspicious apps, messages, or files should also not be deleted independently if their origin or usage is to be investigated later.

Data recovery, cleanup, and anti-spyware programs can create new files and logs, thereby altering the original system state.

A computer that has already been switched off should not be restarted normally just for initial inspection. Even a regular operating system startup generates new activity and can affect existing artifacts.

Conversely, immediately switching off a running device is not always the right thing to do. With encrypted systems that are still running, the current state can be relevant for later data backup.

FAQ about IT forensics in Magdeburg

Can private individuals from Magdeburg have their smartphones examined?

Yes. Depending on the question at hand, private individuals can have iPhones, Android smartphones, computers, data storage devices, existing backups and other authorized data sources examined.

Is it possible to check if a mobile phone has been hacked?

A forensic investigation can look for technically detectable evidence of unauthorized access or potential compromise. The reliability of the findings depends on the device and the available data.

Can deleted WhatsApp messages be recovered?

This may be possible under certain conditions. Databases, backups, media, and other artifacts may be relevant. A complete recovery cannot be guaranteed.

Is it possible to determine if files have been copied to a USB stick?

Connecting a USB storage device can leave technical traces. Whether a specific file transfer can be traced depends on other existing artifacts.

Can a smartphone and computer be examined together?

Yes. If multiple devices relate to the same issue, relevant information can be compared and correlated over time.

Can changes to a file be technically investigated?

Depending on the file type and system, metadata, file system information, backups, and other artifacts can provide clues to changes. Not every manipulation can be clearly reconstructed afterward.

Can it be clearly determined who used a computer?

Not automatically. Digital traces can often be linked to a device, user account, or technical process. This does not necessarily reveal which individual actually operated the system.

Which forensic software does LB Forensik use?

Depending on the device, data source and investigation objective, we use, among other things, Cellebrite, X-Ways Forensics, Belkasoft and MOBILedit Forensic.

Should a suspicious device be reset or restarted?

This should not be done with a device that may be relevant as evidence without a prior technical assessment. A reset or restart can alter relevant data and, in the case of modern devices, also affect the forensic condition of the device.