IT Forensics · Private Individuals
How can I find out whether photos of damage or evidence have been tampered with?
Whether it’s for insurance purposes, a tenancy dispute or an accident: photos of damage are often called into question. A forensic examination determines whether a photo was taken with the device stated and whether there are any signs of it having been edited.
Why this question is important for private individuals
In cases of personal injury, accidents and legal disputes, digital data may contain crucial temporal or technical information. However, its evidential value depends on its origin, completeness and context. An independent investigation prevents a single timestamp or screenshot from being over-interpreted.
Technical background
Every edit and every export leaves its own tell-tale signs: altered metadata, software entries, differing compression tables, missing camera data. Messaging apps and social media platforms recompress images and remove metadata – which makes verification considerably more difficult.
Relevant evidence and data sources
- EXIF/XMP metadata (camera, software, timestamps)
- JPEG quantisation tables and compression characteristics
- Thumbnail in EXIF compared to the main image
- Photo database and editing history on a smartphone (e.g. iOS edits)
- More photos from the same series for comparison
Borders
- Careful alterations are not always detectable; the absence of evidence does not prove authenticity.
- In the case of images that have been forwarded several times, it is only possible to draw conclusions to a very limited extent.
Possible results
- Notes on editing or exporting using Software X
- Consistency with the recording device and the time of recording
- No information available (e.g. metadata removed)
Why LanCologne?
Private IT forensic investigations often have immediate personal, financial or legal consequences. It is therefore not enough simply to open the data using an analysis programme.
Here’s how we do it
- Back up the original from the recording device.
- Metadata and structural analysis; comparison with reference images of the same device.
- Assessment with a clear distinction between findings and interpretation.
Technical data must be interpreted in context
A log entry, location point or file timestamp is, first and foremost, a technical artefact. Only by understanding the logic behind its creation and comparing it with other independent data sources can a reliable interpretation be made.
Preserving evidence does not automatically mean assessing evidence
LanCologne can secure and analyse digital data and explain its technical significance. Whether a piece of evidence is admissible in court, what claims may arise from it, or how a court will assess it, remains separate from the technical analysis.
Why use LanCologne for private IT forensic evidence cases?
LanCologne does not conduct investigations with the aim of confirming the client’s assumption. We formulate a verifiable technical question of evidence, work on the basis of the available primary data, and document positive, negative and inconclusive findings. The result should be comprehensible to the private client and technically verifiable by a solicitor, insurance company, investigating authority, court or another IT forensic expert.
Legal framework
Which statutory provisions are relevant depends on the specific circumstances of the case. In the event of unauthorised access to data subject to special security measures, Sections 202a et seq. of the German Criminal Code (StGB) may be applicable. In cases of fraud or computer-related financial loss, Sections 263 and 263a of the German Criminal Code (StGB) may be particularly relevant, depending on the circumstances. In cases of stalking, Section 238 of the German Criminal Code (StGB) may be relevant. However, it is not the IT forensic expert who determines the criminal classification.
In the case of private audio recordings, Section 201 of the German Criminal Code (StGB) must be observed. Subject to certain conditions, this provision protects the confidentiality of words spoken in private. The technical feasibility of analysing a recording must therefore be distinguished from the question of whether it was lawfully made or used.
Photographs and video recordings may raise issues relating to the right to privacy and data protection. Sections 22 and 23 of the Artistic Copyright Act (KunstUrhG) contain provisions relating to images in particular. Section 201a of the Criminal Code (StGB) may also apply to certain types of photographic recordings. In the case of private cameras, dashcams or smart home systems, additional data protection issues may arise, which must be assessed on a case-by-case basis.
Electronic documents may form part of the evidence presented at an on-site inspection in civil proceedings pursuant to section 371 of the Code of Civil Procedure (ZPO). Sections 402 et seq. of the Code of Civil Procedure (ZPO) apply to expert evidence. A privately commissioned IT forensic report does not automatically become a court expert report; however, it can present technical facts, primary data and questions of evidence in a manner that is comprehensible to both the lawyer and the court.
LanCologne provides technical findings of fact; it does not offer legal advice. Questions regarding admissibility, admissibility as evidence, liability, claims or criminal liability are a matter for solicitors, investigating authorities and the courts.
Frequently Asked Questions
How can I find out whether photos of damage or evidence have been tampered with?
Which file do you need?
Is it possible to tell whether an image has been altered using AI?
Do you also check photos from the other side?
LanCologne – IT Forensics for Private Individuals
Do you have a digital enquiry? LanCologne can assist you with an objective, unbiased IT forensic investigation.
Related to this topic
- How can I have digital evidence of a purchase, sale or handover examined in the event of a private dispute?
- How can I have digital evidence on my own devices secured following a break-in or theft?
- How can I have smartphone data analysed to help reconstruct the events following a road traffic accident?
- How can I find out whether a smartphone was being used at the time of the accident?