When a smartphone is potentially being monitored, messages have disappeared, or someone else appears to have access to personal information, the need for a clear answer quickly arises. Companies face similar questions when confidential data is leaked, user accounts are compromised, or digital processes need to be reconstructed after a security incident.

Our IT forensics services in Leipzig support individuals, companies, lawyers, and other clients with the professional securing and analysis of digital evidence. In the private sector, the focus is often on smartphones, messenger data, user accounts, deleted content, and potential unauthorized access. For companies, the issues range from internal suspicions and data theft to the investigation of compromised IT systems.

The crucial point is not to extract as much data as possible. A professional investigation focuses on a specific question, suitable digital evidence , and technically sound findings.

IT forensics in Leipzig: What digital traces can actually prove

Digital anomalies are initially indicators, not proof. Unusually high battery consumption does not automatically mean that a smartphone is being monitored. An unknown login does not prove who actually accessed an account. And a USB stick connected to a company computer does not, in itself, prove data theft.

Forensic analysis therefore distinguishes between observation, technical findings, and expert evaluation. Depending on the circumstances, smartphones, computers, data storage devices, user accounts, communication data, or cloud services may contain relevant information.

Mobile phone forensics for private individuals in Leipzig

Smartphones now comprise a significant part of personal life. WhatsApp and other messaging apps, photos, contacts, emails, location information, cloud connections, and numerous user accounts can be relevant for reconstructing digital processes.

A forensic smartphone examination can be useful, for example, in the following situations:

• Suspected unauthorized access to the smartphone
• possible spyware or technical manipulation
• unknown devices or account connections
• deleted WhatsApp messages
• deleted photos, videos, or contacts
• digital conflicts after separation or divorce
• suspicious activity within personal user accounts
• Securing digital information for legal disputes

Which data can actually be secured and evaluated depends on the specific device, operating system, security status and any remaining technical traces.

Mobile phone hacked or monitored: How is this investigated?

A forensic investigation can analyze existing technical evidence of potential unauthorized access. Depending on the device, system artifacts, applications, permissions, account connections, and other relevant data can be included.

An unbiased investigation is particularly important. Technical anomalies can have harmless causes. Conversely, unauthorized access does not necessarily have to occur via classic spyware.

Especially after a separation, possible access methods include, for example, still authorized devices, known passwords, Apple or Google accounts, email access or synchronized cloud services.

The absence of reliable evidence of a compromise is also a relevant forensic finding.

Deleted WhatsApp messages and other data

Whether deleted messages, photos, or other information can be recovered cannot be answered definitively. Modern smartphones use encryption, flash memory, and complex storage management.

During messenger investigations, existing databases, media, or backups may be relevant, depending on the device. The technical possibilities depend on the specific case; therefore, data recovery cannot be reliably guaranteed.

If important data has been deleted, the affected device should not be reset or used unnecessarily. Continued use can alter existing data.

iPhone, Android and mobile forensics

iPhones and Android devices differ significantly in terms of security architecture and forensic access possibilities. For Apple devices, factors such as model, iOS version, encryption, and device condition play a role. For Android devices, different manufacturers, chipsets, operating system versions, and security configurations also come into play.

Depending on the device, mobile investigations can be carried out using tools such as Cellebrite UFED, MOBILedit Forensic and MEFF 3 PRO, as well as other specialized tools.

Further information on extraction, analysis and possible data types can be found in our Mobile Forensics section.

Computer forensics for private and business matters

Windows PCs, notebooks, Macs, and external storage devices can contain numerous technical traces. Depending on the specific question being asked, it is possible to examine, for example, file system information, user activity, browser data, connected storage media, and other system artifacts.

Private individuals may require such an analysis, for example, in cases of suspected unauthorized access or unexplained data changes. For companies, data leaks, employee-related incidents, and cyber incidents are more frequently the focus.

For such investigations, tools such as Cellebrite Collector, Cellebrite Inspector and X-Ways Forensics, as well as other specialized tools, are available.

Digital conflicts after separation or divorce

Private conflicts today can have a significant digital component. Shared accounts, previously known passwords, family sharing, cloud storage, and synchronized devices can still provide access after a separation.

Therefore, one should not hastily search solely for a hidden surveillance app. A structured investigation first considers the entire relevant digital environment and then narrows down the technically plausible access routes.

If there are also concrete indications of technical surveillance of a home, office or vehicle, professional counter-surveillance measures may be necessary in addition to digital forensics.

Leipzig as a business location: Digital evidence in networked companies

Leipzig has developed into a significant economic center in Central Germany. Industry and automotive sectors meet logistics, IT, services, healthcare, research, and a growing digital business landscape here. At the same time, Leipzig is closely linked to Halle and the wider Central German economic region.

For companies, this interconnectedness means that sensitive information is rarely stored on a single workstation today. Business communications, customer data, technical documents, project information, and access credentials can be distributed across laptops, smartphones, servers, user accounts, and cloud services.

In the event of a security incident, it is therefore necessary to first clarify which data could be affected and on which systems relevant traces are to be expected.

IT forensics for companies and law firms in Leipzig

Digital investigations in companies often begin with a specific anomaly: an employee switches to a competitor, confidential files are missing, a user account shows unusual activity, or after a cyberattack it is unclear which systems are actually affected.

Typical questions include:

• Were confidential files copied or shared?
• Which external storage devices were used?
• Were there any unusual file activities prior to a change of employer.
• Has a user account been used without authorization?
• Was data deleted or manipulated?
• Which systems and accounts were affected by a cyber incident?

If there is a concrete suspicion of the leakage of confidential information, you can find further information in our section on data theft.

Data leaks and employee incidents

Investigations related to termination, suspension, or changes of employer are particularly sensitive. If there is a concrete suspicion that company information has been misappropriated, it should be clarified as early as possible which digital evidence must be preserved.

Workplace computers, notebooks, company mobile phones, external data storage devices, email systems, user accounts and cloud services can each document different parts of a process.

A single artifact should not be overinterpreted. For example, a connected USB stick only proves that a storage medium was connected to the system. Whether specific files were copied to it is a question for further investigation.

Cyberattacks and compromised systems

In the event of a cyber incident, threat prevention and evidence preservation must be effectively combined. A premature reinstallation can alter relevant traces. Conversely, a compromised system should not be operated unnecessarily if doing so could cause further damage.

Depending on the attack, endpoints, user accounts, system logs, email data, and cloud information may be relevant for reconstruction. The specific data required depends on the individual incident.

Forensic evidence preservation and data integrity

A thorough investigation begins before the actual analysis. First, a decision must be made on how the object under investigation can be technically secured in a meaningful way. Smartphones, SSDs, computers, and cloud accounts do not necessarily require the same approach.

With appropriate security measures, cryptographic hash values ​​can be used to verify data integrity. A documented chain of custody can further demonstrate when an object of investigation was received, secured, and processed.

Further basic information on digital evidence preservation can be found in our knowledge database on digital forensics.

Use specialized forensic tools in a targeted manner

Different devices and operating systems require different tools. Depending on the object of investigation, tools such as Cellebrite UFED, Cellebrite Collector, Cellebrite Inspector, X-Ways Forensics, MOBILedit Forensic, and MEFF 3 PRO, as well as other specialized systems, are used.

However, the number of programs used is not the decisive factor. Forensic software can extract, structure, and visualize data. The professional achievement lies in correctly interpreting relevant artifacts, examining correlations, and transparently presenting the limitations of a finding.

Certified quality and expert competence

LB Detektive GmbH has a quality management system certified by TÜV NORD according to DIN EN ISO 9001, the scope of which includes IT forensics. In addition, the expert is certified according to DIN EN ISO/IEC 17024.

This combines defined organizational quality processes with demonstrably proven expert competence. For digital investigations, this means in particular structured processes, traceable documentation, and a professional evaluation that goes beyond automatically generated software reports.

Typical cases examined in Leipzig

Private individual: Suspicion of digital access after a separation

Another person appears to still have access to confidential information. Instead of immediately assuming spyware, possible access points are narrowed down to smartphones, user accounts, synchronized devices, and known login credentials.

Private individual: Deleted messenger communication

For private or legal disputes, previous messages are needed. First, the device, messaging app, approximate deletion time, and any remaining data sources are examined. Only then can the possibility of reconstruction be reliably assessed.

Companies: Suspicious activities before a change of employer

Before an employee leaves the company, unusual file activity is detected. Depending on the system, relevant computer artifacts, external storage devices, and other data sources can be compared over time.

How does an IT forensic investigation proceed?

1. Define the research question

First, it is defined which technical issue is to be clarified and which time period is to be considered.

2. Determine relevant evidence

Only devices, accounts, and data sources with a real relevance to the question will be included.

3. Back up data professionally

The backup method depends on the object under investigation, the operating system, and the technical condition.

4. Analyze digital traces

Relevant artifacts are examined and, if necessary, compared with other data sources in terms of timing and content.

5. Document results

Depending on the assignment, the findings can be compiled into a structured investigation report or expert opinion.

What should be avoided before an examination?

• Do not hastily reset a potentially compromised smartphone.
• Do not delete suspicious apps yourself.
• Do not install any unknown spyware or cleaning programs.
• Do not unnecessarily modify computers and data storage devices.
• Use devices with deleted data as little as possible.
• Document unknown logins and security alerts.

IT forensics in Leipzig and our areas of operation

Our service area includes Leipzig, the surrounding region, and other parts of Central Germany. This includes Markkleeberg, Schkeuditz, Taucha, Delitzsch, Eilenburg, Grimma, Borna, Halle (Saale), Merseburg, and other cities in the region.

Private individuals, companies, and lawyers can have individual smartphones, computers, or data storage devices, as well as more complex digital issues, examined. Regional city pages are only linked if the corresponding page is already published on lb-forensik.de.

Frequently asked questions about IT forensics in Leipzig

Can I, as a private individual, commission a mobile phone forensics analysis?

Yes. Private investigations often involve smartphones, deleted communications, possible unauthorized access, user accounts, or digital evidence following personal conflicts.

Is it possible to determine if my phone has been hacked?

A smartphone can be examined for existing technical traces of possible unauthorized access. Whether a compromise can actually be proven depends on the device, operating system, and the data still present.

Is it possible to check if my ex-partner still has access to my data?

Depending on the circumstances, relevant devices and account connections may be examined. Besides malware, possible access points include, for example, authorized devices, known passwords, or synchronized accounts.

Can deleted WhatsApp messages be recovered?

Under certain technical conditions, a complete or partial reconstruction may be possible. However, a successful restoration cannot be guaranteed.

Can an iPhone or Android smartphone be scanned for spyware?

Yes. The available investigation options depend, among other things, on the model, operating system, security status, and any existing technical traces.

Is it possible to determine whether company data has been copied?

Depending on the system, file activity, external storage devices, and other artifacts can be examined. Whether a specific copying operation can be proven must be assessed based on the overall evidence.

Can cyberattacks be investigated retrospectively?

This may be possible if suitable data sources are still available. Which devices, protocols, or accounts are relevant depends on the specific attack scenario.

Can an expert report be prepared?

Yes. Depending on the task at hand, an IT forensic expert report can be prepared in addition to a technical investigation report.

How much does an IT forensic investigation cost?

The costs depend on the number and type of devices, data volume, technical accessibility, the research question, and the required documentation. Therefore, the necessary scope is defined as precisely as possible before a more complex investigation.

Request IT forensics services in Leipzig

Whether it's a suspicious smartphone, deleted communication, possible unauthorized access, data leakage or cyberattack: For an initial assessment, the affected device or system, the specific anomaly, the relevant time period and possible changes since the incident are particularly important.

Based on this, it can be determined which digital evidence is actually needed and which preservation and analysis method is suitable for the respective case.