Deleted messages, suspicious access attempts, altered files, or unexplained activity on a smartphone or computer often leave digital traces. It is crucial not to consider this information in isolation, but to examine its technical context. LB Forensik conducts IT forensic investigations for private individuals, companies, and lawyers in Plauen and the Vogtland region.

Depending on the circumstances, we examine smartphones, Windows and macOS systems, hard drives, SSDs, USB storage devices, existing backups, and accessible cloud data. This may involve, for example, reconstructing deleted communications, investigating potential unauthorized access, chronologically classifying user activity, or securing digital data in a traceable manner for legal proceedings.

Various specialized forensic solutions are available for securing and analyzing evidence. Depending on the device and the objective of the investigation, we use tools such as Cellebrite, X-Ways Forensics, Belkasoft, and MOBILedit Forensic . The most suitable method is determined by the specific data source, the technical condition of the device, and the question to be answered.

IT forensics for Plauen at a glance

• Smartphone forensics for Apple iPhone and Android devices
• Computer forensics for Windows and Apple macOS
• Analysis of WhatsApp and other digital communication
• Examination of deleted and no longer immediately visible data
• Examination for technically detectable indications of unauthorized access or compromise.
• Analysis of hard drives, SSDs, USB sticks and other storage media
• Examination of existing backups and accessible cloud data
• Reconstruction of relevant user, file, and system activities
• Temporal classification and correlation of digital traces
• Comprehensible documentation of the security and investigation steps

Those who wish to delve deeper into individual procedures and technical terms will find further information on smartphone and computer forensics, digital evidence preservation, messenger data, deleted information and other forensic topics in our knowledge database on digital forensics .

Which digital traces might be relevant in a case?

Digital traces are created in many places. A smartphone stores different information than a Windows computer, a messenger app different artifacts than a browser or a cloud service. Therefore, an investigation does not begin with a blanket, comprehensive analysis, but rather with the question of which data sources are relevant to the specific case.

The subject of investigation may include, for example, messages, files, photos, videos, app databases, browser information, user accounts, system logs, timestamps, connected storage media, or existing backups.

Typical questions include:

• Were messages or files deleted?
• Are there any indications of unauthorized access?
• When was a specific file created, opened, or modified?
• What activities took place within a specific time period?
• Has a USB storage device been connected to a computer?
• Are there any technical indications of a possible data breach?
• Can a messenger history be examined using the original data?
• Is it possible to combine information from multiple devices in terms of timing?
• Do existing digital traces support a particular interpretation or do they contradict it?

Smartphone forensics in Plauen

Smartphones combine communication, media, apps, internet usage, and a wealth of personal and business information on a single device. Therefore, for a forensic investigation, not only the data that the user can directly see on the display is relevant.

Depending on the smartphone and available database, communication data, app databases, photos, videos, browser information, call data, timestamps, system artifacts, and certain location and connection information can be examined.

How deep a backup goes depends in particular on the device model, operating system version, security status, encryption and available extraction method.

iPhone forensics for clients from Plauen

With Apple devices, hardware, iOS version, and security mechanisms must be considered together. Modern iPhones protect user data through multiple interconnected security and encryption methods. Therefore, it cannot be reliably guaranteed before a technical examination that all data on a device can be accessed.

Depending on the circumstances, messages, app data, media, files, browser information, timestamps, system artifacts, and other data may be available for investigation. Existing local backups or accessible iCloud data can provide additional sources of information.

A forensic analysis must clearly distinguish between actually existing data, technically reconstructed information, and expert interpretation.

We explain further background information under What is iPhone forensics?

Android forensics for Samsung, Google, Honor and other devices

Android smartphones exhibit a particularly wide range of technical variations. Manufacturer, model, chipset, Android version, security patch, and device configuration all influence which extraction methods are possible.

Depending on the device, messenger data, app databases, files, media, browser information, system artifacts and other usage information can be examined.

This is precisely where combining different forensic tools can be useful. One method can unlock data that cannot be accessed or processed differently using another method.

Forensic examination of WhatsApp messages and messenger data

Messenger communication is regularly among the most important data sources in both private and business cases. A forensic analysis of WhatsApp data goes beyond simply reading visible messages.

Depending on the data set, messages, time information, participants, group structures, images, videos, documents, voice messages and other app artifacts can be examined.

This is particularly relevant if messages have been deleted, participants deny a communication history, or only screenshots are available as evidence.

A screenshot only captures what was displayed on a screen at a specific point in time. It does not automatically contain the underlying database structures and other technical information of the original device.

For more in-depth information, see our knowledge article "Forensically evaluating WhatsApp messages".

Is it possible to recover deleted WhatsApp messages?

This may be possible under certain conditions. However, a blanket guarantee of repair would be professionally unsound.

The crucial factor is what information remains and is technically accessible after deletion. Depending on the device, database remnants, backups, media holdings, or other data sources may be relevant for reconstruction.

If no corresponding artifacts are found during an investigation, this initially only means that they could not be detected within the available database. It does not automatically follow that the communication in question never existed.

Computer forensics in Plauen for Windows and macOS

Computers leave behind numerous technical traces during their use. Therefore, a forensic investigation is not limited to searching for existing documents.

Depending on the question being asked, the following can be examined, among other things: file systems, metadata, deleted files, user accounts, browser activities, downloads, program traces, system logs, external storage devices and local traces of cloud applications.

The combination of different artifacts can be particularly relevant. For example, a system entry might indicate that a specific USB drive was connected. However, this alone does not necessarily mean that files were copied. To determine this, further technical traces must be sought and compared.

You can find the basics in the article "What is Computer Forensics?".

Deleted files: What can still be recovered?

"Deleted" doesn't mean the same thing in every system. Whether a file can be fully, partially, or not at all recovered depends on the file system, storage medium, encryption, time of deletion, and subsequent device usage.

With modern SSDs and mobile devices, memory cleanup and cryptographic mechanisms can render deleted information inaccessible relatively quickly. Traditional magnetic hard drives can offer a different starting point.

A device that may be relevant as evidence should therefore not be used unnecessarily or processed with data recovery and cleanup programs. Every further write operation can alter the original data.

IT forensics for private individuals in Plauen

Digital evidence is playing an increasingly important role outside of corporate and criminal proceedings. Private smartphones, computers, and user accounts can contain crucial information in personal or legal disputes.

Typical reasons for investigation include deleted or disputed communications, suspected fraud, stalking and harassment, possible unauthorized access to devices or accounts, separation and divorce situations, and securing existing digital data before a legal dispute.

Has my smartphone been hacked?

This question cannot be reliably answered based on individual symptoms. Unusually high battery consumption, a warm smartphone, poor reception, or unfamiliar notifications do not prove an attack.

A forensic investigation therefore does not attempt to confirm a pre-existing suspicion. Instead, the available data is examined objectively for technically relevant anomalies.

Depending on the device, apps, system information, configurations, profiles, communication artifacts and other technical data may be included.

Even a negative result must be interpreted correctly. If no evidence of a compromise is found within the available data, it cannot necessarily be concluded that an attack did not occur at an earlier time.

Digital evidence in cases of separation, divorce, or personal conflicts

Especially in private disputes, a clear boundary between technical possibility and legal justification is necessary.

LB Forensics only examines devices, user accounts, and data sets for which it has the appropriate authorization. Secretly accessing other people's smartphones, messaging apps, or cloud accounts is not a permissible forensic service.

IT forensics for companies in Plauen and the Vogtland region

Companies may require digital investigations if confidential data has gone missing, an employee may have made unauthorized copies, business information has been deleted, or an IT security incident needs to be investigated.

This can involve the interconnection of desktop computers, laptops, smartphones, external storage devices, user accounts, email data, and cloud applications. Which sources should actually be investigated depends on the specific circumstances.

Data leaks and unauthorized data copies

A single technical finding often does not allow for a conclusive assessment. For example, the connection of a USB stick initially only proves that the storage medium is connected to a system.

Therefore, in cases of suspected data leakage, additional traces such as file access, external storage devices, cloud applications, browser activities, email data and other system information may be relevant.

The aim is not to draw the most far-reaching conclusion possible from a single artifact, but to objectively compare existing traces with one another.

Digital investigation following a cyberattack

Following a suspected cyberattack, system logs, user activity, suspicious files, persistence mechanisms, network clues, and other system artifacts can be examined.

In the event of an acute incident, however, it must be taken into account that securing evidence and limiting damage may have different priorities. For example, a switched-on encrypted computer presents a different starting point than a system that has already been switched off.

Therefore, there is no reliable blanket recommendation to immediately switch off every suspicious device.

Forensic software: Cellebrite, X-Ways Forensics, Belkasoft and MOBILedit

No single forensic program covers all devices, operating systems, and data sources equally. Professional digital forensics therefore requires the selection of suitable tools based on the specific subject of the investigation.

Cellebrite

We use Cellebrite particularly for mobile and other digital examinations. Depending on the device and the initial technical situation, different extraction and analysis methods are available.

X-Ways Forensics

X-Ways Forensics is used particularly for detailed examinations of computers and data storage devices. File systems, files, metadata, deleted data, and other technical structures can be specifically analyzed with it.

Belkasoft

Belkasoft enables the analysis of different digital artifacts and, especially with larger datasets, supports the merging and correlation of relevant information.

MOBILedit Forensic

MOBILedit Forensic expands the extraction and analysis capabilities for mobile devices. Especially given the wide range of technical specifications found in various Android smartphones, an additional method can be beneficial.

Why do we use multiple forensic tools?

Different programs can process the same data in different ways. One tool might detect specific application artifacts, while another reveals additional file system information or metadata.

Therefore, a technical verification may be useful in cases of relevant findings. The decisive factor remains the underlying digital artifact and not merely the presentation of a result within a software interface.

How is digital data forensically secured?

The method of securing the data depends on the type of evidence. A switched-off storage device may require a different approach than a running encrypted computer or a switched-on smartphone.

Where technically and practically feasible, a suitable backup of the relevant data is created first. The analysis can then be carried out on this basis, thus avoiding unnecessary examination steps on the original data as much as possible.

What is the function of hash values?

Hash values ​​can be used to verify the integrity of a specific dataset. They allow for a technical comparison to determine whether the data in question has changed since a defined backup point in time.

However, an identical hash value does not automatically prove that a backup is complete or that a found artifact has been interpreted correctly from a technical perspective. Data integrity, completeness, and interpretation must be considered separately.

Why is documenting the evidence important?

In investigations relevant to evidence, it should be comprehensibly documented which device or data carrier was taken over, what condition the evidence was in, and on which data set the subsequent analysis is based.

This ensures that the data source, backup, and investigation steps remain clearly distinguishable from one another.

How does an IT forensic investigation proceed?

1. Define the specific question

First, the technical issue to be clarified and the time period to be investigated are defined. This allows relevant data sources to be prioritized.

2. Assess the devices and initial state

The device model, operating system, encryption, security status and available access options influence the further course of action.

3. Secure suitable data sources

The preservation method is adapted to the device and the objective of the investigation. Prioritization may be necessary when dealing with multiple pieces of evidence.

4. Examine relevant artifacts

Files, databases, communication data, system information and other technical traces are analyzed based on the defined question.

5. Establish temporal connections

Where the data allows, independent traces are compared and correlated chronologically. This often makes it possible to classify a technical process more precisely.

6. Document the technical findings in a comprehensible manner.

The data collected and its professional interpretation should remain distinguishable. Likewise, technical limitations are taken into account if the available data does not allow for a clear conclusion.

IT forensics in Plauen and the Vogtland region

As the largest city in the Vogtland district, Plauen is a regional center for businesses, freelancers, law firms, and private clients. Naturally, digital matters are not confined to the city limits.

The regional area includes, among others, Oelsnitz/Vogtl., Reichenbach im Vogtland, Auerbach/Vogtland, Falkenstein/Vogtl., and Treuen . Zwickau, Chemnitz, and Hof, which borders directly to the south, can also play a role in matters of supra-regional importance.

The cities mentioned are for geographical reference only and are not intended to represent LB Forensik branches. The primary factors determining the feasibility of a digital investigation are the available equipment and data sources, and the specific question to be answered.

For Saxony, there are already independent and currently verified websites for IT forensics in Leipzig and for IT forensics in Dresden.

What should you not do with potential digital evidence?

A potentially sensitive smartphone should not be reset prematurely, and suspicious applications should not be deleted independently. Installing data recovery, cleanup, or purported anti-spyware programs can also alter existing data and create new system traces.

A computer that has been switched off should not be restarted normally just for the purpose of checking its status. Even a regular operating system startup modifies files, logs, and time information.

Conversely, it would also be technically incorrect to immediately switch off every device that is switched on. In encrypted systems or during ongoing security incidents, this can make access to relevant data more difficult. The appropriate measure depends on the specific condition of the device.

FAQ about IT forensics in Plauen

Does LB Forensik also work for private individuals from Plauen?

Yes. Private individuals can have smartphones, computers, data storage devices, existing backups, and accessible cloud data examined, provided they have the necessary authorization for the data in question.

Can an iPhone be scanned for spyware or unauthorized access?

A forensic investigation can look for technically detectable indications of a possible compromise. What conclusions can be drawn depends on the device, iOS version, available data, and the depth of the investigation.

Can deleted WhatsApp messages be made visible again?

Under certain conditions, database information, backups, media, or other remaining artifacts may enable reconstruction. Whether and to what extent this is possible can only be assessed based on the specific data set.

Is it possible to determine if a USB stick was used?

Computers can contain technical traces of connected USB devices. However, such evidence does not automatically mean that files have been copied. Further artifacts may need to be examined to confirm this.

Can the usage of a computer be reconstructed chronologically?

Depending on the system, logins, file accesses, program activities, browser data, system events, and other time-related information can provide clues about specific usage periods. However, a complete record of every user action does not automatically exist.

Can a screenshot be examined as digital evidence?

A screenshot can be technically analyzed, but on its own it has limited significance. If the original device or other suitable data sources are available, additional artifacts can be used for comparison.

Is it possible to determine if a file has been subsequently modified?

Metadata, file system information, internal file structures, backups, and other technical artifacts can provide clues to changes, depending on the initial situation. Not every manipulation can be definitively detected after the fact.

Can IT forensics prove that a specific person is the perpetrator?

Not automatically. An artifact can, for example, be assigned to a device or user account. This does not necessarily imply which natural person was actually operating the device at the relevant moment.

Which forensic software does LB Forensics use?

Depending on the data source and investigation objective, we use tools such as Cellebrite, X-Ways Forensics, Belkasoft, and MOBILedit Forensic. The specific tool selection depends on the device, operating system, and required depth of analysis.

Can multiple devices be examined together?

Yes. If a situation involves multiple smartphones, computers, storage media, backups, or accessible cloud data, relevant information from these sources can be compared and correlated over time.

Should I reset a suspicious smartphone?

A reset of a device that may contain evidence should never be performed without a prior technical assessment. Relevant data and traces could be altered or deleted during such a process.

What information is needed before an examination begins?

Helpful information includes details about the affected device, operating system, relevant time period, specific event, measures already taken, and the question that the investigation aims to clarify.