IT FORENSICS · COURTS

IT Forensics for the Courts – the focus is on the question of evidence

As independent IT experts, we assist the courts in the technical clarification of issues relating to digital evidence – from the classification of individual artefacts, through the assignment of timestamps, devices and accounts, to the explanation of written expert reports during court hearings.

Our assessment is carried out in accordance with recognised principles of IT forensics and remains bound by the terms of the court order. We attach particular importance to adopting a neutral, non-prejudicial approach and to producing documentation that is transparent to all parties involved in the proceedings. Where necessary, key findings are independently verified using a second recognised method or directly on the basis of the raw data.

Independent assessment
Documentation admissible in court
GDPR-compliant processing
Experienced experts

THE QUESTION OF EVIDENCE

How a question of evidence becomes a robust investigation

We break down the legal issue into sub-questions that can be technically examined. A single timestamp is generally not sufficient for this – the elements to be examined include, amongst others, file system metadata, application traces, backups, logs and, where applicable, synchronisation processes. The investigation remains bound by the court’s instructions: if the court specifies, pursuant to Section 404a(3) of the Code of Civil Procedure (ZPO), which facts are to form the basis of the expert assessment, we do not replace this specification with our own assumptions. The result may be positive evidence, a ruling of exclusion, or a reasoned conclusion that „it cannot be established with certainty on the basis of the available data“ – all three conclusions may be technically correct.

OUR APPROACH

This is how your examination will be carried out

A transparent process – from the initial enquiry to the handover of the report.

1
We examine whether the question falls within our area of expertise, what facts the court has taken as a basis, and whether there are any doubts as to its impartiality. In the event of any ambiguity, the court will provide clarification (Sections 404a and 407a of the Code of Civil Procedure).
2
Devices, storage media and files provided are identified and documented. Where technically feasible, we create a forensic copy; hash values ensure the integrity of the data, whilst the original is retained for future verification.
3
We determine which pieces of evidence would support or refute the alleged event, and examine only those artefacts that have scientific value in relation to the question of proof. Automatic matches are not accepted without verification.
4
Findings that are relevant to the decision are – where necessary – cross-checked using a second recognised method. At the same time, we expressly state what conclusions must not be drawn from the data.
5
The final conclusion is drawn from the documented findings and is not stated in stronger terms than the data permits. A technical appendix enables an independent IT forensic expert to carry out a technical review or prepare a counter-report.

TYPICAL QUESTIONS

When is a forensic IT investigation advisable?

  • ✔Contested digital issues in civil proceedings
  • ✔Criminal proceedings involving digital evidence
  • ✔Review of an existing IT report (counter-report)
  • ✔Clarification of timestamp, device and account mapping
  • ✔Assessment of the evidential value of digital traces in court
  • ✔Explanation of an expert report at a court hearing
  • ✔Re-assessment pursuant to Section 412 of the Code of Civil Procedure (ZPO)
  • ✔Questions regarding the chain of custody

LIMITATIONS & CONCLUSION

What you should know

We assist courts in the technical clarification of issues relating to digital evidence – from the classification of individual artefacts, through the attribution of timestamps, devices and accounts, to the explanation of written expert reports during court hearings. The legal assessment and the final evaluation of the evidence remain the responsibility of the court (Section 286 of the German Code of Civil Procedure (ZPO)); we provide the technical factual basis – whether in the form of positive evidence, exclusion or substantiated lack of evidence.

CUSTOMER REVIEWS

What our customers say

4.8 out of 5 stars on Trustpilot · 54 reviews

★★★★★

“The highest standards of professionalism, prompt service and excellent communication. They made the seemingly impossible a reality. This is what genuine customer service is all about – unrivalled in Germany!”

idalein

Verified review on Trustpilot

★★★★★

“Very helpful advice, excellent responsiveness and communication. My problem was completely resolved and the lost data was recovered. I’m very satisfied and, of course, relieved!”

Layla Pankratz

Verified review on Trustpilot

★★★★★

“My problem was sorted out professionally and quickly; everyone I spoke to was always friendly, and I can still get in touch if I have any questions – I’m very grateful for that!”

a woman from Cologne

Verified review on Trustpilot

Enquire now – free initial consultation

Do you require an independent technical investigation in relation to a question of evidence in court? LanCologne examines digital evidence objectively, transparently and in a reproducible manner, and documents both positive findings and cases where no evidence is found, as well as technical limitations, in a way that is easy to follow.

FREQUENTLY ASKED QUESTIONS

Frequently Asked Questions

Click on a question to see the answer.

Why is the question of evidence central to a forensic IT investigation in court?+
A court does not need a technical report that is as long as possible, nor does it need a list of the programmes used. It needs a robust answer to the question of evidence put before it. How does a question of evidence before the court become a technically sound investigation?
How is such a technical investigation carried out in practice?+
How we work – from the court’s instruction to the response We first check whether the question falls within our area of expertise, what facts the court has taken as a basis, and whether the content or scope of the instruction is clear.
Does the result of the investigation provide clear evidence for the court?+
An expert witness must not, of their own accord, reinterpret an unclear issue of evidence as a different issue. If there is any doubt as to the content or scope of the terms of reference, section 407a(4) of the Code of Civil Procedure (ZPO) requires the court to clarify the matter.
Is there a legal basis for this?+
Sections 403, 404a, 407a, 411 and 412 of the Code of Civil Procedure (ZPO); supplemented by Section 286 of the ZPO on the judicial assessment of evidence. In criminal cases, sections 72 et seq. of the Code of Criminal Procedure (StPO) apply to expert witnesses. The expert witness provides the technical factual basis.

Do you have a specific question about IT forensics for the courts? → View all questions and answers

IT Forensics for the Courts – the focus is on the question of evidence →