Knowledge of digital forensics
The individual articles are intended to explain technical relationships in an understandable way and at the same time show what statements can be made through a forensic investigation and where technical limits exist.
350 specialist topics in 14 subject areas: The knowledge database is being expanded gradually. Below you will find a complete overview of the planned specialist topics.
1. Fundamentals of digital forensics
This section explains key terms, methods, and procedures of digital forensics. This includes forensic data backup , hash values, evidence chains, and how to examine digital traces without unnecessarily altering the original data.
- What is digital forensics?
- What does an IT forensic expert do?
- How does a forensic investigation proceed?
- What is forensic data backup?
- What is a forensic image?
- What is a forensic image?
- What is a bitwise copy of a data carrier?
- What is a hash value in digital forensics?
- What does integrity of digital evidence mean?
- What does "Chain of Custody" mean?
- What is a chain of evidence?
- How is digital evidence secured?
- Why should an original data carrier not be altered if possible?
- What is a write blocker?
- What does read-only data backup mean?
- What data can be forensically examined?
- Which devices can be examined forensically?
- How long does an IT forensic investigation take?
- How much does a digital forensic investigation cost?
- When is an IT forensic investigation useful?
- What is the difference between IT forensics and data recovery?
- What is the difference between IT forensics and IT security?
- What is the difference between IT forensics and cybersecurity?
- What can digital forensics prove?
- Where are the limits of digital forensics?
2. Smartphone forensics
Smartphones can contain numerous different data sources. This section deals with messages, images, call data, location information, apps, browser data, and other digital traces on mobile devices.
- What is smartphone forensics?
- What information can be extracted during mobile phone forensics?
- How does a forensic mobile phone examination work?
- Can deleted data be recovered on a smartphone?
- Can deleted messages be recovered from a mobile phone?
- Can deleted photos be recovered from a smartphone?
- Can deleted videos be recovered from a smartphone?
- Can deleted contacts be recovered?
- Can call logs be forensically analyzed?
- Can deleted SMS messages be recovered?
- Can location data from a smartphone be analyzed?
- Can movement profiles be reconstructed from smartphone data?
- Can Wi-Fi connections be detected on a smartphone?
- Can Bluetooth connections be traced on a smartphone?
- Can installed apps be detected retroactively?
- Can deleted apps be traced?
- Can app usage times be determined?
- Is it possible to determine when a smartphone was used?
- Is it possible to determine when a smartphone was unlocked?
- Can screenshots taken on a smartphone be proven?
- Can downloads on a smartphone be tracked?
- Can browser data from a smartphone be analyzed?
- Can the usage of certain websites on a smartphone be tracked?
- How much does a forensic mobile phone analysis cost?
- How long does a smartphone forensics analysis take?
3. iPhone and iOS Forensics
The possibilities of an iPhone examination depend, among other things, on the device model, the iOS version, the device configuration, the encryption, and the available data sources and backups.
- What is iPhone forensics?
- What data can be read from an iPhone?
- Can deleted data be recovered from an iPhone?
- Can deleted photos be recovered from an iPhone?
- Can deleted messages be recovered from an iPhone?
- Can deleted WhatsApp messages be recovered from an iPhone?
- Can iMessage messages be forensically analyzed?
- Can deleted iMessages be recovered?
- Can location data from an iPhone be read?
- Can data about "Important Places" be analyzed on the iPhone?
- Can Apple Maps data be examined?
- Can Safari browsing history be analyzed on the iPhone?
- Can deleted Safari data be recovered?
- Can iPhone call logs be analyzed?
- Can deleted contacts be recovered on an iPhone?
- Can iPhone backups be forensically examined?
- What is an encrypted iPhone backup?
- What data can be contained in an iCloud backup?
- Can iCloud data be forensically analyzed?
- Can AirDrop activity be tracked on an iPhone?
- Can connections to other devices be tracked on the iPhone?
- Can the use of individual apps on the iPhone be proven?
- Can deleted apps be detected on an iPhone?
- Can timestamps on an iPhone be analyzed?
- What are the limits of a forensic examination of an iPhone?
4. Android Forensics
Android smartphones differ depending on the manufacturer, model, Android version, and security configuration. This section covers typical data sources and questions encountered in the forensic investigation of Android devices.
- What is Android forensics?
- What data can be read from an Android smartphone?
- Can deleted data be recovered from Android devices?
- Can deleted photos be recovered on Android?
- Can deleted videos be recovered on Android?
- Can deleted WhatsApp messages be recovered on Android?
- Can deleted SMS messages be recovered on Android?
- Can Android call logs be forensically analyzed?
- Can location data from an Android smartphone be analyzed?
- Can Google Maps data be forensically examined?
- Can the browser history of an Android device be analyzed?
- Can deleted browser data be recovered on Android?
- Can installed Android apps be detected?
- Can deleted Android apps be proven?
- Can app data be analyzed on Android?
- Can app usage times be verified on Android?
- Can downloads on Android devices be tracked?
- Can the Wi-Fi connections of an Android device be examined?
- Can Bluetooth connections be tracked on Android?
- Can files on an Android SD card be recovered?
- Can locally stored data from a Google account be analyzed?
- Can Android backups be forensically examined?
- Can notification data on Android devices be analyzed?
- What role does Android encryption play in forensics?
- What are the limits of Android forensics?
5. Computer, Windows and macOS forensics
Computers and laptops generate numerous technical traces during use. Files, user activity, connected storage devices, programs, browser data, and system logs can all be relevant for an investigation.
- What is computer forensics?
- How is a computer forensically examined?
- What data on a PC can be forensically analyzed?
- Can deleted files be recovered on a computer?
- Is it possible to determine when a file was deleted?
- Is it possible to determine when a file was created?
- Is it possible to determine when a file was opened?
- Is it possible to determine when a file was modified?
- Can file copying operations be tracked?
- Can the copying of files to a USB stick be proven?
- Can connected USB devices be detected?
- Is it possible to determine which USB stick was used?
- Can connected external hard drives be detected?
- Can Windows logins be traced?
- Can user activity be reconstructed under Windows?
- Can recently opened files be identified in Windows?
- Can Windows browser history be forensically analyzed?
- Can deleted browser data be recovered on a PC?
- Can Windows event logs be forensically analyzed?
- What is the Windows Registry and what traces does it contain?
- Can programs and software installations be verified?
- Can uninstalled programs be detected?
- How does a forensic examination of a Mac work?
- Can deleted files be recovered on a Mac?
- What digital traces do users leave on a computer?
6. Storage media, files and data recovery
Hard drives, SSDs, USB sticks, memory cards, NAS and RAID systems store data in different ways. This affects both forensic investigations and the possibilities for recovering deleted data.
- How does a forensic examination of a hard drive work?
- How does the forensic examination of an SSD work?
- Can deleted data be recovered from an SSD?
- What does TRIM mean for SSD hard drives?
- How does TRIM affect data recovery?
- Can data be recovered from a formatted hard drive?
- Can data be recovered after a fresh installation of Windows?
- Can overwritten files be recovered?
- Can deleted partitions be recovered?
- Can damaged file systems be forensically examined?
- Can USB sticks be forensically examined?
- Can deleted files be recovered from a USB drive?
- Can SD cards be forensically examined?
- Can deleted photos be recovered from an SD card?
- Can external hard drives be forensically examined?
- Can NAS systems be forensically examined?
- Can RAID systems be forensically examined?
- What is file metadata?
- What information does file metadata contain?
- Can metadata be manipulated?
- How can you detect manipulated file timestamps?
- How can file versions be compared?
- Can the origin of a file be determined?
- Is it possible to determine which device a file originated from?
- Why should a forensic backup be created before data recovery?
7. Messenger, email, internet and cloud
Messengers, email services, browsers, social networks, and cloud systems are among the most important sources of digital communication. This section deals with the data generated there and potential forensic issues.
- Can WhatsApp messages be forensically analyzed?
- Can deleted WhatsApp messages be recovered?
- Can WhatsApp images and videos be recovered?
- Can WhatsApp voice messages be forensically examined?
- Can WhatsApp call data be analyzed?
- Can WhatsApp group chats be forensically analyzed?
- Can Telegram data be forensically examined?
- Can signal data be forensically examined?
- Can Facebook Messenger data be analyzed?
- Can Instagram messages be forensically analyzed?
- Can deleted Instagram data be recovered?
- Can TikTok data be forensically examined?
- What is email forensics?
- Can deleted emails be recovered?
- Can email headers be forensically analyzed?
- Can the origin of an email be technically verified?
- How can fake or manipulated emails be investigated?
- Can email attachments be forensically examined?
- Can browser histories be used as digital evidence serve?
- Could there be traces of incognito or private mode usage?
- Can downloads from the internet be traced?
- Can locally stored traces of search queries be analyzed?
- Can cloud storage be forensically examined?
- Can data from OneDrive, Dropbox, or Google Drive be analyzed?
- Can deleted cloud files be recovered or their whereabouts proven?
8. Employees, companies and data theft
In internal cases of suspected data breaches, the focus is often on data leaks, unauthorized copying, data deletion, or activities prior to an employee's departure. Digital forensics can secure and analyze existing technical evidence.
- How can data theft by employees be proven?
- What should you do if you suspect data theft within your company?
- Can it be proven that an employee copied company data?
- Can the copying of customer data be proven?
- Can the copying of trade secrets be proven?
- Is it possible to determine which files an employee has copied?
- Can data leakage via a USB stick be proven?
- Can data leakage via an external hard drive be proven?
- Can a data breach via email be investigated?
- Can a data breach via cloud services be investigated?
- Can a data breach via messenger be investigated?
- Is it possible to determine whether company data has been deleted?
- Employee deletes data before leaving – what should be done?
- Employee copies data before resigning – how can this be investigated?
- What is a forensic examination of an employee's PC?
- What is a forensic examination of a company mobile phone?
- How are company laptops examined in a way that provides evidence against them?
- How is a suspected leak of trade secrets investigated?
- How can digital traces be investigated in cases of potential breaches of confidentiality agreements?
- How can unauthorized software use be investigated within a company?
- Can the use of private USB devices on company computers be detected?
- Can private cloud services be detected on company computers?
- Can user activity of former employees be reconstructed?
- What data should companies secure in case of a suspected case?
- What mistakes should companies avoid before a forensic investigation?
9. Cybercrime, attacks and IT security incidents
Following an IT security incident, a forensic investigation can help secure existing technical evidence and reconstruct events. This includes examining log data, malware, phishing, and compromised systems.
- What is cyber forensics?
- What is Incident Response?
- What is the difference between incident response and IT forensics?
- How does a forensic investigation proceed after a cyberattack?
- What traces can attackers leave on a computer?
- How can unauthorized access be investigated?
- Can failed login attempts be proven?
- Can successful third-party registrations be traced?
- How are potentially compromised user accounts investigated?
- What significance do IP addresses have in a forensic investigation?
- Can log files serve as digital evidence?
- How are server logs forensically analyzed?
- How are firewall logs forensically examined?
- How are VPN connections forensically examined?
- What is malware forensics?
- How can malware be detected on a computer?
- What is smishing?
- Is it possible to determine when malware entered a system?
- How is a Trojan examined forensically?
- How is ransomware forensically investigated?
- What should you do after a ransomware attack?
- How can a phishing incident be forensically investigated?
- How are manipulated or abused user accounts investigated?
- How are compromised email accounts investigated?
- How can potential data leaks following a cyberattack be investigated?
- What digital traces should be secured after an IT security incident?
10. Digital evidence, expert opinions and legal issues
In the case of digital evidence, in addition to the visible content, origin, integrity, timestamps, storage methods, and documentation can also be relevant. This section addresses technical and general legal issues surrounding digital evidence and forensic investigation reports.
- What is digital evidence?
- Under what conditions can digital evidence be legally admissible?
- How can digital evidence be documented in a traceable manner?
- What technical requirements might be relevant for digital evidence?
- What is an IT forensic report?
- What does a forensic investigation report contain?
- What is the difference between an expert opinion and an investigation report?
- How can the authenticity of digital evidence be technically verified?
- How can potential manipulations of digital data be investigated?
- What kind of evidentiary value can screenshots have?
- What are the limits of using WhatsApp screenshots as evidence?
- How can the authenticity of WhatsApp messages be technically verified?
- How can the authenticity of an email be technically verified?
- How can the authenticity of digital photos be verified?
- What informational value can image metadata have?
- Can video recordings be digitally forensically examined?
- Can audio files be digitally forensically examined?
- What does legally compliant data backup mean?
- How are data storage devices secured for potential legal proceedings?
- What is the significance of hash values in digital evidence?
- Why is a traceable chain of evidence important?
- What role can digital evidence play in civil proceedings?
- What role can digital evidence play in labor law?
- What role can digital evidence play in criminal proceedings?
- When should an independent IT forensic expert be involved?
11. Mobile phone hacked, monitored or tapped
Suspected hacking or surveillance of a smartphone is among the most frequent specific security concerns. This section explains typical warning signs, possible causes, sensible immediate measures, and when a forensic examination of the device might be advisable.
- My phone has been hacked – what should I do now?
- How can I tell if my phone has been hacked?
- My phone is being tapped – what can I do?
- How can I find out if my phone is being monitored?
- Can someone remotely monitor my smartphone?
- Is it possible for someone to secretly turn on my microphone?
- Can someone secretly activate my phone's camera?
- Can someone read my smartphone screen?
- Is it possible for someone to secretly read my WhatsApp messages?
- Unknown device at WhatsApp connected – what to do?
- My ex-partner knows the contents of my smartphone – how is that possible?
- Can an ex-partner monitor my mobile phone?
- Unknown app on smartphone – is it spyware?
- How can you detect spyware on a smartphone?
- How can you detect stalkerware on a mobile phone?
- My phone is suddenly using a lot of battery – is this spyware?
- My smartphone is getting unusually hot – has it been hacked?
- My phone is suddenly using a lot of data – what does that mean?
- My smartphone keeps restarting by itself – has it been tampered with?
- Unknown permissions on your smartphone – what to do?
- Unknown device administrator on Android – what to do?
- Unknown accessibility features enabled on Android – what to do?
- Unknown configuration profile on the iPhone – what does that mean?
- Can a smartphone be forensically examined after a hacking attack?
- What should I not do if I suspect my phone is being monitored?
12. Phishing, online fraud and compromised accounts
Phishing, fake websites, and stolen login credentials can lead to account takeovers or financial losses within minutes. This section explains specific immediate actions to take and which digital traces should be preserved for later investigation.
- I clicked on a phishing link – what should I do?
- I clicked on a suspicious link – has my phone been hacked?
- Money was debited after clicking on a link – what should I do?
- I entered my bank details on the wrong website – what should I do?
- I entered my login details on a phishing site – what should I do?
- I entered my credit card details on a fake website – what should I do?
- I scanned a suspicious QR code – what should I do?
- I opened an unknown email attachment – what should I do?
- I downloaded a suspicious file – what should I do?
- I installed a suspicious app – what should I do?
- My online banking has been hacked – what digital traces are left behind?
- Unknown debit after phishing – can IT forensics help?
- My PayPal account has been hacked – what should I do?
- My Amazon account has been hacked – what should I do?
- My Microsoft account has been hacked – what should I do?
- My Google account has been hacked – what should I do?
- My Apple ID or Apple account has been hacked – what should I do?
- My email account has been hacked – what should I do?
- My Instagram account has been hacked – what should I do?
- My Facebook account has been hacked – what should I do?
- My WhatsApp account has been compromised – what should I do?
- Someone has changed my password – how can I trace the access?
- Unauthorized login to my account – how can this be investigated?
- Can it be determined which device accessed my account?
- Can it be determined when my account was hacked?
13. Acute digital security problems
In the event of a potential digital security incident, incorrect actions can alter or destroy crucial evidence. This section answers specific questions about what those affected should do immediately and which data should be preserved for later forensic investigation.
- What should I do if I think my computer has been hacked?
- How can I tell if my Computer hacked became?
- My computer is behaving unusually – is this a hacking attack?
- Unknown program on my computer – what to do?
- Unknown remote maintenance software on my PC – what does that mean?
- Unknown user accounts on my computer – what to do?
- Unknown login on my Windows PC – how can I check this?
- Unknown login on my Mac – what to do?
- My password has been stolen – what should I do now?
- My passwords have surfaced on the darknet – what does that mean?
- My email address was found in a data breach – what should I do?
- My personal data has been published – what digital traces can be secured?
- My files were suddenly encrypted – is this ransomware?
- What to do if you receive a ransomware alert on your computer?
- Should I immediately shut down a hacked computer?
- Should I disconnect a compromised computer from the internet?
- Should I immediately turn off a hacked smartphone?
- Should I reset a suspicious device?
- Should I delete suspicious software before a forensic examination?
- What evidence should I secure after a hacking attack?
- Which screenshots should I save in case of online fraud?
- Which emails should I keep after a phishing attack?
- What log data might be important after a hacker attack?
- When should an IT forensic expert be called in after a security incident?
- How quickly should digital evidence be secured after an incident?
14. Digital surveillance, stalking and account abuse
Digital surveillance can be carried out via smartphones, user accounts, cloud services, location sharing, or linked devices. This section explains typical technical possibilities and shows which pieces of evidence can be forensically investigated.
- How can I tell if someone is monitoring my digital accounts?
- Can someone track my location via my smartphone?
- How can I detect a hidden location sharing on my mobile phone?
- Can someone track my location using Google Maps?
- Can someone track my location via my Apple account?
- Can someone monitor me using "Find My" on my iPhone?
- Unknown device in my Apple account – what to do?
- Unknown device in my Google account – what to do?
- Unknown login to Microsoft 365 – what to do?
- Unknown forwarding in my email account – what does that mean?
- Is it possible for someone to secretly forward my emails?
- Can someone read my messages via an email rule?
- Can someone read WhatsApp messages on a second device?
- Can someone use Telegram on a second device?
- Can someone use my Google account on someone else's smartphone?
- Can someone see my iCloud data on another device?
- Can someone see my photos via a connected cloud account?
- Is it possible for someone to secretly sync my contacts and calendar?
- Can a family account be used to monitor a smartphone?
- Can Mobile Device Management be used to monitor a mobile phone?
- Can Family Link be used to monitor a smartphone?
- Could an unknown VPN be dangerous on my smartphone?
- Can a stranger's Wi-Fi network monitor my smartphone?
- Can Bluetooth be used to secretly monitor a smartphone?
- What digital traces can cyberstalking leave behind?
Digital incident? Act now.
The faster digital evidence is secured, the higher its usability. Our IT forensic experts in Esslingen are available at short notice.
IT forensics: Why professional evidence gathering is crucial
An internal IT incident is more than just a technical problem – it poses a significant legal risk. Securing digital evidence in a legally admissible manner requires a structured and forensically sound approach that considers IT systems, legal requirements, and business interests equally.
The decisive advantage
Legally admissible digital evidence preservation
Legally compliant backup and mirroring of data carriers according to recognized forensic standards – without altering or impairing the original data.
Analysis of complex IT systems
Structured analysis of emails, server data, cloud systems and mobile devices – with clear documentation for management, law firms and courts.
Incident Response & Emergency Support
Fast and structured response to cyberattacks, data leaks or internal IT incidents – including immediate evidence preservation and initial technical assessment to minimize further risks.
Compliance and fraud investigations
Discreet investigation of internal suspicions, data manipulation or compliance violations – with comprehensible analysis and legally sound documentation.
Our systematic analysis process
Our structured forensic approach ensures secure evidence handling, precise analyses, and clear, legally defensible results.
01
Recording of compliant evidence
Certified forensic tools are used to securely capture data while maintaining the long-term integrity of the evidence.
02
Forensic analysis in full agreement
Our specialists conduct in-depth analyses, ensuring that digital evidence is organized, traceable, and reliable.
03
Transparent, structured reporting
Transparent, structured IT forensics reporting with clear, comprehensible and legally compliant results.
Frequently Asked Questions
Q. Who can use your forensic investigation services?
Our services are available to companies, law firms, government agencies and private individuals who require secure and legally compliant digital forensic investigations.
Q. How can the confidentiality of data be guaranteed during investigations?
We follow strict confidentiality guidelines, secure evidence handling procedures, and controlled access to ensure that all customer data remains protected throughout the entire investigation process.
Q. What types of cases do you handle?
We handle cases related to cybercrime, data breaches, internal fraud, intellectual property theft, unauthorized access, data recovery, and investigations to respond to security incidents.
Q. How long does an IT forensics investigation take?
The duration depends on the scope, data volume, and complexity of the case. Smaller investigations may take a few days, while complex cases can take several weeks.
Q. What standards and methods do you follow?
Our investigations are based on internationally recognized standards and best practices in digital forensics to ensure accuracy, integrity, and legally sound results.
*A NOTICE
LB Detektive GmbH (LB Group®) points out that the mention of cities, municipalities, or regions on this website does not necessarily imply the existence of a branch, office, or operating facility at the respective location. Existing locations are explicitly marked as such. Furthermore, location information primarily refers to areas of operation, activity, or service provision. This applies in particular to services in the fields of detective work, investigations, surveillance, IT forensics, digital investigations, counter-surveillance, technical security checks, and expert opinions. Case studies and operational reports presented are based on real events. To protect personal rights and legitimate confidentiality interests, names, locations, times, and other details may have been anonymized, altered, or summarized.
This notice applies to the entire website of LB Detektive GmbH (LB Gruppe®), unless otherwise stated on individual pages.
Latest news
- September 17, 2026
Suddenly, your Instagram password stops working. Unknown messages have been sent, your registered email address has been changed, or Instagram is reporting an unauthorized login attempt...
Latest news
- August 17, 2026
Digital forensics increasingly determines whether a suspicion becomes a verifiable technical finding. However, powerful software, modern...
- April 1, 2026
Smartphones are key digital evidence repositories because they store extensive and often unnoticed data on communication, location, and usage. The article...
- March 19, 2026
