Securing digital evidence. Clarity for your case.

If you suspect a data leak, tampered communications, compromised devices or other digital evidence, taking the right first step is crucial. LanCologne secures and analyses digital evidence using TÜV-certified expertise, specialised forensic tools and its own laboratory.

Acute incident: If possible, do not continue to use the device and do not delete or alter anything. If an attack is underway or there is a potential data breach, please call us directly.

IT forensic investigations for the judiciary, businesses and private individuals

LanCologne examines digital evidence and documents its findings in such a way that they remain verifiable by experts. The examination covers computers, Server, data storage media, smartphones, cloud data and other digital systems – without prejudging the outcome and based solely on the evidence actually present.

Our technical expertise is underpinned by a qualification in mobile device and Windows forensics, certified by TÜV Rheinland, which is publicly available in the Certipedia certificate database under certification number 0000067863. We have been carrying out investigations throughout Germany since 2015.

Original data is protected against alteration, forensic images are created and the processing steps are documented. Depending on the assignment, the result may be technical documentation, a forensic investigation report or an IT forensic expert’s report.

Our overview of how a cyber incident within a company is investigated from a technical perspective describes IT forensics following a cyber attack.

Samples are collected and analysed in our own laboratory in Cologne. A look inside the IT forensics laboratory →

Do you have general questions to begin with? Our multilingual AI assistant Bubs can help you get your bearings. More about Bubs →

Our areas of research

Courts

Expert analysis of digital evidence and transparent expert reports on issues of evidence in court proceedings.

Lawyers and criminal defence lawyers

Technical examination of digital evidence, independent expert reports and assessment of the available investigation findings.

law enforcement agencies

Forensic data recovery and analysis for public prosecutors’ offices, the police and other investigative authorities.

The company

Internal investigations, potential data breaches, cyber incidents and the reconstruction of specific sequences of events.

Insurance

Technical investigation of claims, verification of digital evidence and identification of data loss.

Private individuals

Examination of personal devices, securing digital evidence and providing a clear explanation of the findings.

Windows Forensics

The registry, event logs, prefetch, shellbags and file system metadata provide clues about user and programme activity.

macOS Forensics

APFS volumes, unified logs, Spotlight metadata and extended Apple metadata relating to the origin and usage of files.

Linux Forensics

File systems such as ext4, XFS and Btrfs, as well as the systemd journal, shell histories and authentication logs.

Vehicle Forensics

Infotainment and telematics systems: connection histories, navigation destinations, and event and location data.

Drone forensics

Flight logs, telemetry, memory cards, and controller and app data for reconstructing flight paths.

IT Forensics OSINT

Research and analysis of openly accessible sources, documented and presented in a way that is easy to follow.

Do you have a specific question or a device you’d like us to examine? Tell us the details – we’ll let you know what is and isn’t technically possible.

Request a survey