IT Forensics · Private Individuals

How can I find out whether anyone still had access to my personal data following a break-up?

Old passwords, sessions, device linkings or authorisations may remain active after a disconnection.

Enquire without obligation

Why this question is important for private individuals

In family disputes, digital data can take on considerable significance. At the same time, there is a particularly high risk of over-interpreting technical evidence from one’s own perspective on the dispute. An independent investigation therefore distinguishes between allegations, technically verifiable facts and legal assessments.

Technical investigative approach

We check our own accounts and devices for any login, session, authorisation and security artefacts.

Where the limits of what can be said lie

The possibility of access is not the same as proven access.

Why LanCologne?

In cases of separation, divorce and family disputes, digital evidence is particularly sensitive. The parties involved know one another, may have previously shared devices or accounts, and understandably interpret technical matters through the lens of their personal conflict.

This is precisely where IT forensics must maintain a degree of detachment. LanCologne does not accept one party’s account as technical fact. We formulate specific questions of evidence: Was a message present in the original data? When was a file saved or modified? Which devices were linked to a particular account? Is there merely the possibility of access, or can actual use be proven?

Shared use is explicitly taken into account. A password that was known during the relationship, a family computer or a shared cloud service significantly alter the technical circumstances. The subsequent legal assessment is separate from this.

We only examine devices and data that have been lawfully handed over to us. A private commission does not authorise us to bypass a former partner’s security measures or to secretly access their accounts.

The report distinguishes between findings, technical interpretation and the limits of its conclusions. This makes it accessible to private clients whilst also enabling lawyers, courts or other IT experts to follow the technical reasoning.

How we work

1Define the specific technical issue to be investigated in consultation with the client.
2Clarify ownership, authority to dispose of the data and the permissible scope of data prior to the investigation.
3Retain the original data wherever possible and carry out the analysis on working copies.
4Distinguish between shared and sole use of accounts or devices.
5Where possible, compare screenshots and exports with the source data.
6Interpret timestamps in the context of their source, taking time zones into account.
7Do not equate ‘account’, ‘device’, ‘user account’ and ‘natural person’.
8Separate relevant data from unnecessary private third-party content.
9Examine incriminating and exculpatory artefacts using the same criteria.
10Explicitly take alternative technical explanations into account.
11Openly acknowledge questions that cannot be answered and gaps in the data.
12Document the technical section in such a way that it can be subject to a technical review.

A personal conflict does not alter the forensic standard

Even though the implications of a finding may be significant for the client, the desired outcome must not influence the technical assessment. A message, file or account activity is examined according to the same criteria, regardless of which party stands to benefit from the finding.

Technical access does not constitute legal authorisation to access

The fact that a password previously shared by both parties is still known, or that a device is technically accessible, does not automatically mean that a third party’s data may be examined. LanCologne consistently distinguishes between technical feasibility and the permissible scope of an investigation.

Why choose LanCologne for private and family law disputes?

LanCologne does not act as a technical extension of a party to the conflict. Our remit is to carry out an open-ended, technical assessment of the facts. The key primary data, the methodology and the limitations of the findings are documented in such a way that the private client can understand the findings and a solicitor, court or other qualified IT forensic expert can review them from a technical perspective.

Legal framework

In terms of procedural law, family law proceedings are often governed by the FamFG. Section 26 of the FamFG lays down the principle of ex officio investigation; under Section 29 of the FamFG, the court takes the necessary evidence in an appropriate manner. Section 30 of the FamFG governs the formal taking of evidence and refers in this regard to the Code of Civil Procedure. If an allegation of fact relevant to the decision is expressly disputed and the decision is to be based substantially on that allegation, formal taking of evidence must take place in accordance with Section 30(3) of the FamFG.

Electronic documents may also constitute evidence in civil proceedings. Section 371 of the Code of Civil Procedure (ZPO) expressly stipulates that, in the case of an electronic document, evidence by inspection is provided by presenting or transmitting the file. The special evidential value under Section 371a of the German Code of Civil Procedure (ZPO) applies to specific electronic documents and must not be applied across the board to every ordinary chat, screenshot or image file.

Sections 402 et seq. of the Code of Civil Procedure (ZPO) deal with expert evidence. A privately commissioned IT forensic report does not automatically become a court expert’s report as a result. However, it can document technical facts in a comprehensible manner and provide a solicitor with a basis for further arguments or for formulating specific questions of evidence.

Particular caution is required in cases concerning children. Section 151 of the FamFG includes, amongst other things, parental responsibility and access rights within the scope of cases concerning children. Section 163 of the FamFG sets out specific requirements for suitable experts in proceedings under Section 151( 1 to 3, and specifies, in particular, professional qualifications in psychology, psychotherapy, child and adolescent psychiatry, psychiatry, medicine, education or social pedagogy. A digital forensics expert must therefore not confuse their technical role with an assessment of the child’s best interests, parenting ability or family psychology.

There are also limits to the collection of digital evidence. Section 202a of the German Criminal Code (StGB) may be relevant in cases of unauthorised access to data that is subject to special security measures and not intended for the person carrying out the act. Section 201 of the German Criminal Code (StGB) protects the confidentiality of private conversations, subject to certain conditions; Section 201a of the German Criminal Code (StGB) protects, under certain conditions, the highly personal sphere of life and personal rights in relation to photographic recordings. A private dispute does not create a general authorisation for covert digital surveillance.

LanCologne sets out technical facts. It is for the solicitor and the court to assess whether the evidence is admissible in court proceedings, what the consequences under family law are, and which evidence strategy should be adopted.

Frequently Asked Questions

How can I find out whether anyone still had access to my personal data following a break-up?
In family disputes, digital data can take on considerable significance. At the same time, there is a particularly high risk of over-interpreting technical evidence from one’s own perspective on the dispute. An independent investigation therefore distinguishes between allegations, technically verifiable facts and legal assessments.
How is such a technical investigation carried out in practice?
We check our own accounts and devices for any login, session, authorisation and security artefacts.
Can such an investigation always produce a clear result?
The possibility of access is not the same as proven access.
Is there a legal basis for this?
In terms of procedural law, family law proceedings are often governed by the FamFG. Section 26 of the FamFG lays down the principle of ex officio investigation; under Section 29 of the FamFG, the court shall take the necessary evidence in an appropriate manner. Section 30 of the FamFG governs the formal taking of evidence and refers in this regard to the Code of Civil Procedure. If an allegation of fact that is relevant to the decision is expressly disputed and the decision is to be based predominantly on that fact, a formal taking of evidence must take place in accordance with Section 30(3) of the FamFG. Electronic documents may also form part of the evidence in civil proceedings. Section 371 of the Code of Civil Procedure (ZPO) expressly stipulates that, in the case of an electronic document, evidence by inspection is provided by the production or transmission of the file. The special probative value under Section 371a of the ZPO applies to certain electronic documents and must not be applied indiscriminately to every ordinary chat, screenshot or image file. The ZPO contains provisions on expert evidence in Sections 402 et seq. A privately commissioned IT forensic report does not thereby automatically become a court expert’s report. However, it can document technical facts in a comprehensible manner and provide a solicitor with a basis for further submissions or the formulation of specific questions of evidence. Particular caution is required in cases concerning parentage. Section 151 of the Family Proceedings Act (FamFG) includes, amongst other things, parental responsibility and access rights within the scope of child-related matters. Section 163 of the FamFG sets out specific requirements for suitable experts in court reports in proceedings under Section 151(1) to (3) and specifically mentions professional qualifications in psychology, psychotherapeutic, child and adolescent psychiatric, psychiatric, medical, educational or socio-educational professional qualifications. A digital forensics expert must therefore not conflate their technical role with an assessment of the child’s welfare, parenting ability or family psychology. There are also limits to the collection of digital evidence. Section 202a of the German Criminal Code (StGB) may be relevant in cases of unauthorised access to specially secured data not intended for the person acting. Section 201 of the German Criminal Code (StGB) protects, subject to its conditions, the confidentiality of private conversations; Section 201a of the German Criminal Code (StGB) protects, under certain conditions, the highly personal sphere of life and personality rights in relation to photographic recordings. A private dispute does not create a general authorisation for covert digital surveillance. LanCologne establishes technical facts. Whether data is admissible in court, what consequences arise under family law, or which evidence strategy is chosen, is assessed by the lawyer and the court.

LanCologne – IT Forensics for Private Individuals

Do you have a digital enquiry? LanCologne can assist you with an objective, unbiased IT forensic investigation.

Get in touch now