IT Forensics · Private Individuals

How can I carry out a technical investigation into cyberstalking and have digital evidence secured?

Cyberstalking rarely consists of a single incident. Typically, it involves many minor incidents across various channels: messages from different accounts, unexplained knowledge of one’s whereabouts, and unauthorised logins to accounts. The forensic task is to provide technical evidence for these individual incidents and to piece them together into a coherent timeline.

Enquire without obligation

Why this question is important for private individuals

Digital reconstruction can have a profound impact on a person’s everyday life. At the same time, joint accounts, old shared files or routine technical procedures can have a similar effect. An independent investigation should therefore neither downplay the issue nor confirm a suspicion prematurely.

Technical background

The challenge lies in distinguishing between the two: many instances of this behaviour have harmless causes – such as a forgotten family sharing setting, a synchronised secondary device or a shared account. Conversely, stalkerware and account takeovers often leave only a few, but clear, traces.

Relevant evidence and data sources

• Login and session histories for accounts (Google, Apple ID, Microsoft, Meta, Messenger)
• Connected devices and active sessions, family sharing, „Find My“/location sharing
• Installed apps, device administrator and accessibility permissions (Android), profiles/MDM (iOS)
• Message histories with metadata, sender accounts and timestamps
• Tracker alerts and Bluetooth trackers found

Borders

• It is usually not technically possible to determine who is behind an account or an IP address – that is a matter for the investigating authorities to clarify.
• Data held solely by the provider cannot be verified without the provider disclosing it.
• If a device has been reset, any previous records will be missing.

Possible results

• Unauthorised access to an account technically verified (with timestamps)
• Proof of location authorisation or use of a monitoring app
• No indication of technical surveillance in the data examined – with details of the scope of the audit
• A timeline of events as a basis for filing a complaint or consulting a solicitor

Why LanCologne?

Where cyberstalking or digital surveillance is suspected, the situation is often emotionally distressing for those affected. It is precisely for this reason that a professional investigation must draw a clear distinction between mere observation, technical capability and an incident that has actually been proven to have taken place.

Here’s how we do it

• Work together to record the specific incidents, including the dates, and translate them into verifiable questions.
• Check devices and accounts separately: device associations, sharing, permissions, sessions.
• Abnormalities correlate with the times of the incidents.
• Document a timeline, including evidence and unresolved questions.

Personal safety takes precedence over the full preservation of evidence

Where there is a specific threat, the desire to obtain as complete a set of digital evidence as possible must not delay the necessary protective measures. The Police Crime Prevention Service recommends dialling the police emergency number in the event of an immediate threat. Forensic evidence collection and protective measures must therefore be appropriately coordinated on a case-by-case basis.

Suspicion, the ability to gain access and actual access are three different things

A previously known password, an active family sharing arrangement or installed remote maintenance software may provide a means of access. Only further evidence can reveal whether this means of access was actually used. Additional evidence may be required to attribute such use to a specific individual.

Why LanCologne in the context of cyberstalking and digital surveillance?

LanCologne is not commissioned to provide technical confirmation of a suspect who has already been identified. We examine the available digital evidence with an open mind. The report should be comprehensible to the person concerned whilst remaining sufficiently transparent to enable a solicitor, investigating authority or another qualified IT forensic expert to understand the key technical findings.

Section 238 of the German Criminal Code (StGB) governs stalking. The provision covers, subject to its conditions, repeated unauthorised stalking which is likely to significantly disrupt the affected person’s way of life. Examples include attempts to make contact via telecommunications or other means of communication, the misuse of personal data, and offences under Sections 202a to 202c of the German Criminal Code (StGB) committed against the affected person or persons close to them. Section 238(2) of the German Criminal Code (StGB) also cites, as a typical example of a particularly serious case, the use of a computer programme for digital spying in connection with such an offence.

Sections 202a et seq. of the German Criminal Code (StGB) may be relevant in cases of unauthorised access to specially secured data or certain forms of interception or preparation for such acts. It cannot be automatically concluded from a single technical artefact whether all the elements of the offence have been fulfilled.

The Protection Against Violence Act provides for court-ordered protective measures, subject to certain conditions. Section 1 of the Protection Against Violence Act (GewSchG), for example, prohibits making contact with the victim, including via means of remote communication. Under certain conditions, the provision also covers repeated stalking or harassment via means of remote communication. Legal advisers and the court will assess which protective measure is possible in a specific case.

The Police Crime Prevention Service advises victims of cyberstalking to keep any existing evidence – such as emails, messaging histories, digital photos or videos – as complete and unaltered as possible until they first contact the police. In the event of an immediate threat, personal safety takes priority.

LanCologne does not make any criminal attributions of guilt or liability, nor does it rule on protection orders. Our role is to establish the technical facts based on data lawfully provided to us and to document these findings in a transparent manner.

Frequently Asked Questions

🔗 Related topics