IT Forensics · Private Individuals

How can I document digital threats, harassment or repeated attempts to make contact in a way that provides reliable evidence?

In the event of threats or repeated harassment, it is very tempting to delete messages or block the sender. However, the messages are needed for reporting the offence and obtaining a protection order – ideally with the sender’s details, a timestamp and the content left unaltered.

Enquire without obligation

Why this question is important for private individuals

Digital reconstruction can have a profound impact on a person’s everyday life. At the same time, joint accounts, old shared files or routine technical procedures can have a similar effect. An independent investigation should therefore neither downplay the issue nor confirm a suspicion prematurely.

Technical background

Screenshots show the content, but not the technical specifications. Depending on the service, blocking may hide or delete the history. Messages with a self-destruct function or sent in „view once“ mode disappear. On social media, posts and profiles can be removed at any time.

Relevant evidence and data sources

• Message histories with sender ID or telephone number
• Profile URLs, user IDs and archived copies of public posts
• Email headers in threatening emails
• Call logs and voicemail messages

Borders

• Investigating authorities use information provided by service providers to identify the people behind anonymous accounts.
• Messages that have already been deleted cannot always be recovered.

Possible results

• Secure messages with metadata and hash values
• Chronology of events
• Documentation showing which accounts were involved

Why LanCologne?

Where cyberstalking or digital surveillance is suspected, the situation is often emotionally distressing for those affected. It is precisely for this reason that a professional investigation must draw a clear distinction between mere observation, technical capability and an incident that has actually been proven to have taken place.

Here’s how we do it

• Immediate danger: call the police first – security measures can be carried out at the same time.
• Backing up the original logs from the device and exporting them from platforms.
• Documentation of profile and post URLs with timestamps.
• Overview of incidents for the police or a solicitor.

Personal safety takes precedence over the full preservation of evidence

Where there is a specific threat, the desire to obtain as complete a set of digital evidence as possible must not delay the necessary protective measures. The Police Crime Prevention Service recommends dialling the police emergency number in the event of an immediate threat. Forensic evidence collection and protective measures must therefore be appropriately coordinated on a case-by-case basis.

Suspicion, the ability to gain access and actual access are three different things

A previously known password, an active family sharing arrangement or installed remote maintenance software may provide a means of access. Only further evidence can reveal whether this means of access was actually used. Additional evidence may be required to attribute such use to a specific individual.

Why LanCologne in the context of cyberstalking and digital surveillance?

LanCologne is not commissioned to provide technical confirmation of a suspect who has already been identified. We examine the available digital evidence with an open mind. The report should be comprehensible to the person concerned whilst remaining sufficiently transparent to enable a solicitor, investigating authority or another qualified IT forensic expert to understand the key technical findings.

Section 238 of the German Criminal Code (StGB) governs stalking. The provision covers, subject to its conditions, repeated unauthorised stalking which is likely to significantly disrupt the affected person’s way of life. Examples include attempts to make contact via telecommunications or other means of communication, the misuse of personal data, and offences under Sections 202a to 202c of the German Criminal Code (StGB) committed against the affected person or persons close to them. Section 238(2) of the German Criminal Code (StGB) also cites, as a typical example of a particularly serious case, the use of a computer programme for digital spying in connection with such an offence.

Sections 202a et seq. of the German Criminal Code (StGB) may be relevant in cases of unauthorised access to specially secured data or certain forms of interception or preparation for such acts. It cannot be automatically concluded from a single technical artefact whether all the elements of the offence have been fulfilled.

The Protection Against Violence Act provides for court-ordered protective measures, subject to certain conditions. Section 1 of the Protection Against Violence Act (GewSchG), for example, prohibits making contact with the victim, including via means of remote communication. Under certain conditions, the provision also covers repeated stalking or harassment via means of remote communication. Legal advisers and the court will assess which protective measure is possible in a specific case.

The Police Crime Prevention Service advises victims of cyberstalking to keep any existing evidence – such as emails, messaging histories, digital photos or videos – as complete and unaltered as possible until they first contact the police. In the event of an immediate threat, personal safety takes priority.

LanCologne does not make any criminal attributions of guilt or liability, nor does it rule on protection orders. Our role is to establish the technical facts based on data lawfully provided to us and to document these findings in a transparent manner.

Frequently Asked Questions

Related topics

• How can I carry out a technical investigation into cyberstalking and have digital evidence secured?
• How can I have offensive or defamatory online posts preserved in a way that provides reliable evidence?
• How can I document repeated logins from unknown accounts as a possible part of cyberstalking?
• IT Forensics for Private Individuals

LanCologne – IT Forensics for Private Individuals

Do you have a digital enquiry? LanCologne can assist you with an objective, unbiased IT forensic investigation.

Get in touch now