IT Forensics · Private Individuals

How can I have data from USB-Sticks, memory cards or external hard drives secured as private evidence?

If you simply copy files from a USB-Stick to your own computer, you alter the timestamps and lose deleted files as well as metadata. An evidence-secure backup captures the entire data carrier bit-for-bit without altering it, and verifies this using hash values.

Enquire without obligation

Why this question is important for private individuals

In cases of personal injury, accidents and legal disputes, digital data may contain crucial temporal or technical information. However, its evidential value depends on its origin, completeness and context. An independent investigation prevents a single timestamp or screenshot from being over-interpreted.

Technical background

Simply plugging a device into a Windows or macOS system can cause data to be written (e.g. index files, the Recycle Bin or Spotlight folders). This is why a write blocker is used. With flash storage, there is the additional risk that deleted data may be overwritten by internal processes.

Relevant evidence and data sources

• Complete image, including unallocated areas
• File system metadata (created, modified, accessed)
• Deleted files and fragments
• Volume serial number and device ID (for subsequent assignment to computers)

Borders

• Any data that was overwritten before the backup was taken cannot be recovered.
• You can tell which computer a USB stick has been used on by looking at the computer, not the stick itself.

Possible results

• Backup image with hash value and backup log
• List of relevant files (including deleted ones)
• Time references to files

Why LanCologne?

Private IT forensic investigations often have immediate personal, financial or legal consequences. It is therefore not enough simply to open the data using an analysis programme.

Here’s how we do it

• Do not use the data storage medium yourself any longer; document the handover.
• Forensic imaging via write-blockers, calculation of hash values.
• Analysis based solely on the image; report including the chain of evidence.

Technical data must be interpreted in context

A log entry, location point or file timestamp is, first and foremost, a technical artefact. Only by understanding the logic behind its creation and comparing it with other independent data sources can a reliable interpretation be made.

Preserving evidence does not automatically mean assessing evidence

LanCologne can secure and analyse digital data and explain its technical significance. Whether a piece of evidence is admissible in court, what claims may arise from it, or how a court will assess it, remains separate from the technical analysis.

Why use LanCologne for private IT forensic evidence cases?

LanCologne does not conduct investigations with the aim of confirming the client’s assumption. We formulate a verifiable technical question of evidence, work on the basis of the available primary data, and document positive, negative and inconclusive findings. The result should be comprehensible to the private client and technically verifiable by a solicitor, insurance company, investigating authority, court or another IT forensic expert.

Which statutory provisions are relevant depends on the specific circumstances of the case. In the event of unauthorised access to data subject to special security measures, Sections 202a et seq. of the German Criminal Code (StGB) may be applicable. In cases of fraud or computer-related financial loss, Sections 263 and 263a of the German Criminal Code (StGB) may be particularly relevant, depending on the circumstances. In cases of stalking, Section 238 of the German Criminal Code (StGB) may be relevant. However, it is not the IT forensic expert who determines the criminal classification.

In the case of private audio recordings, Section 201 of the German Criminal Code (StGB) must be observed. Subject to certain conditions, this provision protects the confidentiality of words spoken in private. The technical feasibility of analysing a recording must therefore be distinguished from the question of whether it was lawfully made or used.

Photographs and video recordings may raise issues relating to the right to privacy and data protection. Sections 22 and 23 of the Artistic Copyright Act (KunstUrhG) contain provisions relating to images in particular. Section 201a of the Criminal Code (StGB) may also apply to certain types of photographic recordings. In the case of private cameras, dashcams or smart home systems, additional data protection issues may arise, which must be assessed on a case-by-case basis.

Electronic documents may form part of the evidence presented at an on-site inspection in civil proceedings pursuant to section 371 of the Code of Civil Procedure (ZPO). Sections 402 et seq. of the Code of Civil Procedure (ZPO) apply to expert evidence. A privately commissioned IT forensic report does not automatically become a court expert report; however, it can present technical facts, primary data and questions of evidence in a manner that is comprehensible to both the lawyer and the court.

LanCologne provides technical findings of fact; it does not offer legal advice. Questions regarding admissibility, admissibility as evidence, liability, claims or criminal liability are a matter for solicitors, investigating authorities and the courts.

Frequently Asked Questions

Related topics

• How can I have digital evidence from a smart home secured for use in a private dispute?
• How can I retrieve data from a USB-Stick that has been accidentally formatted?
• IT Forensics for Private Individuals

LanCologne – IT Forensics for Private Individuals

Do you have a digital enquiry? LanCologne can assist you with an objective, unbiased IT forensic investigation.

Get in touch now