IT forensics

IT forensic investigations for the judiciary, businesses and private individuals

LanCologne examines digital evidence and documents its findings in such a way that they remain verifiable by experts. The examination covers computers, Server, data storage media, smartphones, cloud data and other digital systems – without prejudging the outcome and based solely on the evidence actually present.

Our technical expertise is underpinned by a qualification in mobile device and Windows forensics, certified by TÜV Rheinland, which is publicly available in the Certipedia certificate database under certification number 0000067863. We have been carrying out investigations throughout Germany since 2015.

Original data is protected against alteration, forensic images are created and the processing steps are documented. Depending on the assignment, the result may be technical documentation, a forensic investigation report or an IT forensic expert’s report.

Our overview of how a cyber incident within a company is investigated from a technical perspective describes IT forensics following a cyber attack.

Our areas of research

Courts

Expert analysis of digital evidence and transparent expert reports on issues of evidence in court proceedings.

Lawyers and criminal defence lawyers

Technical examination of digital evidence, independent expert reports and assessment of the available investigation findings.

law enforcement agencies

Forensic data recovery and analysis for public prosecutors’ offices, the police and other investigative authorities.

The company

Internal investigations, potential data breaches, cyber incidents and the reconstruction of specific sequences of events.

Insurance

Technical investigation of claims, verification of digital evidence and identification of data loss.

Private individuals

Examination of personal devices, securing digital evidence and providing a clear explanation of the findings.

Windows Forensics

The registry, event logs, prefetch, shellbags and file system metadata provide clues about user and programme activity.

macOS Forensics

APFS volumes, unified logs, Spotlight metadata and extended Apple metadata relating to the origin and usage of files.

Linux Forensics

File systems such as ext4, XFS and Btrfs, as well as the systemd journal, shell histories and authentication logs.

Vehicle Forensics

Infotainment and telematics systems: connection histories, navigation destinations, and event and location data.

Drone forensics

Flight logs, telemetry, memory cards, and controller and app data for reconstructing flight paths.

IT Forensics OSINT

Research and analysis of openly accessible sources, documented and presented in a way that is easy to follow.

Do you have a specific question or a device you’d like us to examine? Tell us the details – we’ll let you know what is and isn’t technically possible.

Request a survey