IT Forensics · Business

How can a company have a work smartphone or tablet subjected to a forensic examination?

Work smartphones and tablets often contain crucial evidence: business chats, call logs, location data and photos of documents. At the same time, they are frequently used for private purposes as well – the investigation must clearly distinguish between the two.

Enquire without obligation

Why this question is important for a business

In the case of internal incidents, commercial interests, the preservation of evidence and employees’ rights may all be affected simultaneously. A technically wide-ranging investigation is therefore not automatically a good one. What is crucial is a clearly defined question of evidence and a transparently limited scope of the investigation.

Technical background

An MDM system can manage device status and apps, but does not usually provide a forensically complete backup. The extent to which data can be backed up depends on the model, operating system version and lock status. If a device is wiped or reset via MDM, the data is usually lost.

Relevant evidence and data sources

  • Messaging app databases (e.g. WhatsApp, Teams, Signal – where available)
  • Call logs, text messages, contacts, calendar
  • Location data and photos with metadata
  • iOS KnowledgeC/Biome or Android UsageStats (device usage)
  • MDM logs (assignment, wipes, profiles)

Borders

  • Locked devices without a code can only be secured to a limited extent.
  • End-to-end-encrypted messaging apps can only be decrypted on the device itself.

Possible results

  • Relevant communications and activities during the period
  • Evidence of deletions or resets

Why LanCologne?

Internal investigations involve a direct clash of several interests: the company must be able to protect its systems, data, trade secrets and commercial interests. At the same time, employee data protection, proportionality, co-determination and, where applicable, the protection of private data must be observed.

Here’s how we do it

  • Do not reset the device or wipe it via MDM; be mindful of the battery and flight mode.
  • Determining the scope (work-related data, time period) with legal advice.
  • Backup at the maximum technically feasible depth and filtered analysis.

No prejudgement of employees

An internal suspicion is not simply declared to be the outcome of the investigation. We examine which technical facts support it, which contradict it, and what alternative explanations exist. Even a finding that is unfavourable to the company or exonerates it is fully documented.

Comprehensible to senior management and the legal department – reproducible for forensic experts

The main body explains the key message without using unnecessary technical jargon. The technical section documents data sources, backup statuses, identifiers, integrity information, time references, artefact locations and validation steps. This ensures that the investigation remains traceable for subsequent technical cross-checking.

LanCologne: independent technical support for businesses

Where an internal incident requires technical investigation, LanCologne provides support in the form of an objective, unbiased and transparent IT forensic investigation. The focus is not on a desired outcome, but solely on what can actually be substantiated on the basis of the digital evidence within the permissible scope of the investigation.

Legal framework

In Germany, Section 26 of the Federal Data Protection Act (BDSG) must be observed in particular with regard to employees’ data. Personal data relating to employees may be processed for the purposes of the employment relationship if this is necessary for the purposes specified therein. Section 26(1) of the BDSG sets out specific conditions for the detection of criminal offences: There must be documented factual grounds justifying the suspicion that the data subject has committed a criminal offence in the course of their employment; the processing must be necessary for the detection of the offence, and the employee’s legitimate interests must not outweigh this. In particular, the nature and extent of the processing must not be disproportionate.

In addition, the general principles of the GDPR apply. Article 5 of the GDPR requires, amongst other things, lawfulness, purpose limitation and data minimisation. Article 6 of the GDPR requires a valid legal basis for processing. Consequently, the fact that an analysis is technically feasible does not automatically mean that it is legally permissible.

In the case of technical equipment, Section 87(1)(6) of the Works Constitution Act (BetrVG) may also be relevant. According to this provision, in the absence of any statutory or collective agreement provisions, the works council has the right to be consulted on the introduction and use of technical systems designed to monitor employees’ behaviour or performance. Depending on their design, this may be relevant, for example, in the case of MDM, EDR, DLP, logging or other monitoring systems.

Section 26(6) of the Federal Data Protection Act (BDSG) expressly clarifies that the participation rights of employees’ representative bodies remain unaffected. The specific admissibility of an investigative measure under labour law and works constitution law should therefore, where employees are concerned, be clarified with the relevant legal advisers and, where appropriate, the designated company bodies before it is carried out.

LanCologne does not replace this legal assessment. Our task is, once the permissible scope of the investigation has been defined, to examine the technical question of evidence in a transparent, proportionate and unbiased manner.

Frequently Asked Questions

Can a company-owned device be automatically analysed in full simply because it is owned by the company?+
Not automatically. Ownership of the device and the lawfulness of processing employees’ personal data are separate issues. The purpose, legal basis, necessity and proportionality must be taken into account.
Can Mobile Device Management (MDM) data be used without restriction for an internal investigation?+
MDM data can provide technically valuable information. However, it must be assessed on a case-by-case basis to determine what data is actually available and whether it may be used for the specific investigation.
Is an internal IT forensic investigation specifically looking for incriminating evidence against a particular employee?+
No. We address a specific technical question of evidence without prejudging the outcome. Exculpatory findings and standard technical explanations are documented to the same standard.
What happens if an action cannot be definitively attributed to a specific person?+
In that case, the statement is restricted accordingly. A user account, device or session must not be equated with a natural person without sufficient connecting factors.
Do you need the unlock code?+
Generally speaking, yes. Without the code, the security is severely limited.
What about personal data on the device?+
Where possible, these will be excluded. You should determine the scope in consultation with your legal adviser.
Is an iCloud backup enough?+
It may be helpful, but it is not always comprehensive and is not always up to date.

Related topics

LanCologne – IT Forensics for Businesses

Do you have a digital enquiry? LanCologne can assist you with an objective, unbiased IT forensic investigation.

Get in touch now