IT Forensics · Private Individuals

How can I have digital evidence from a smart home secured for use in a private dispute?

Smart home devices record a great deal: video doorbells and cameras store clips, door locks log when doors are opened, and motion and door sensors detect events. In private disputes – such as between neighbours or following a break-up – this data can be important, but is often only available for a short time.

Enquire without obligation

Why this question is important for private individuals

In cases of personal injury, accidents and legal disputes, digital data may contain crucial temporal or technical information. However, its evidential value depends on its origin, completeness and context. An independent investigation prevents a single timestamp or screenshot from being over-interpreted.

Technical background

Most systems store events in the manufacturer’s cloud for a limited period (often just a few days to weeks, depending on the subscription). Local storage (SD card, hub, NAS) is less common. Timestamps are derived from the device or Server clock.

Relevant evidence and data sources

• Event lists and clips in the manufacturer’s app or cloud
• Local storage (SD card in the camera, hub, NVR)
• App data on your smartphone (notifications, cache)
• Account logs: which account accessed the system and when

Borders

• Deleted or expired cloud events are usually irrecoverable.
• Photographing members of the public or public areas may raise data protection issues; a solicitor will clarify whether this is permitted.

Possible results

• Verified events and clips with documented provenance
• Timeline across multiple devices
• Statement regarding the completeness of the available data

Why LanCologne?

Private IT forensic investigations often have immediate personal, financial or legal consequences. It is therefore not enough simply to open the data using an analysis programme.

Here’s how we do it

• Find out straight away how long the provider retains data, and initiate data exports.
• Securing exports using a hash value and documenting the export path.
• Validation of timestamps and synchronisation between devices.

Technical data must be interpreted in context

A log entry, location point or file timestamp is, first and foremost, a technical artefact. Only by understanding the logic behind its creation and comparing it with other independent data sources can a reliable interpretation be made.

Preserving evidence does not automatically mean assessing evidence

LanCologne can secure and analyse digital data and explain its technical significance. Whether a piece of evidence is admissible in court, what claims may arise from it, or how a court will assess it, remains separate from the technical analysis.

Why use LanCologne for private IT forensic evidence cases?

LanCologne does not conduct investigations with the aim of confirming the client’s assumption. We formulate a verifiable technical question of evidence, work on the basis of the available primary data, and document positive, negative and inconclusive findings. The result should be comprehensible to the private client and technically verifiable by a solicitor, insurance company, investigating authority, court or another IT forensic expert.

Which statutory provisions are relevant depends on the specific circumstances of the case. In the event of unauthorised access to data subject to special security measures, Sections 202a et seq. of the German Criminal Code (StGB) may be applicable. In cases of fraud or computer-related financial loss, Sections 263 and 263a of the German Criminal Code (StGB) may be particularly relevant, depending on the circumstances. In cases of stalking, Section 238 of the German Criminal Code (StGB) may be relevant. However, it is not the IT forensic expert who determines the criminal classification.

In the case of private audio recordings, Section 201 of the German Criminal Code (StGB) must be observed. Subject to certain conditions, this provision protects the confidentiality of words spoken in private. The technical feasibility of analysing a recording must therefore be distinguished from the question of whether it was lawfully made or used.

Photographs and video recordings may raise issues relating to the right to privacy and data protection. Sections 22 and 23 of the Artistic Copyright Act (KunstUrhG) contain provisions relating to images in particular. Section 201a of the Criminal Code (StGB) may also apply to certain types of photographic recordings. In the case of private cameras, dashcams or smart home systems, additional data protection issues may arise, which must be assessed on a case-by-case basis.

Electronic documents may form part of the evidence presented at an on-site inspection in civil proceedings pursuant to section 371 of the Code of Civil Procedure (ZPO). Sections 402 et seq. of the Code of Civil Procedure (ZPO) apply to expert evidence. A privately commissioned IT forensic report does not automatically become a court expert report; however, it can present technical facts, primary data and questions of evidence in a manner that is comprehensible to both the lawyer and the court.

LanCologne provides technical findings of fact; it does not offer legal advice. Questions regarding admissibility, admissibility as evidence, liability, claims or criminal liability are a matter for solicitors, investigating authorities and the courts.

Frequently Asked Questions

Related topics

• How can I have digital evidence processed for use in a tenancy or neighbourhood dispute?
• How can I have data from USB-Sticks, memory cards or external hard drives secured as private evidence?
• IT Forensics for Private Individuals

LanCologne – IT Forensics for Private Individuals

Do you have a digital enquiry? LanCologne can assist you with an objective, unbiased IT forensic investigation.

Get in touch now