IT Forensics – Windows

Forensic Analysis of Windows Portable Devices (WPD) – Mobile Devices as Digital Evidence

Windows uses the Windows Portable Devices (WPD) interface to integrate smartphones, tablets, digital cameras and other portable devices. Depending on the device type and version of Windows, this generates various artefacts which may provide information about recognised devices, their usage and their integration into the system.

Enquire without obligation

As part of a professional IT forensic investigation, WPD artefacts are never assessed in isolation. Only by correlating them with USB artefacts, SetupAPI logs, MountPoints2, registry hives, event logs and other digital traces is it possible to carry out a reliable technical reconstruction.

Why LanCologne?

Since its foundation, LanCologne has specialised in professional IT forensics. Our staff have decades of experience in the field of information technology and provide support to businesses, solicitors, private individuals and, on a regular basis, the courts.

The examination is carried out exclusively on a forensic copy or a forensic image. The original evidence remains unchanged and is stored in a manner that preserves its evidential integrity.

Our services

Analysis of WPD artefacts, identification of mobile devices, correlation with other Windows artefacts, and full documentation of all investigation steps.

Typical areas of application

•Smartphone and Tablet Forensics
•Investigation of data leaks
•Incident Response
•Corporate Forensics
•Employment law proceedings
•Expert reports for the courts

This is how the analysis works

Once a forensic image has been created, WPD-related artefacts are identified, technically analysed and assessed in conjunction with other digital evidence.

Why are WPD artefacts important?

They can provide information on which mobile devices were connected to a Windows system, thereby helping to piece together a picture of user and device activity.

Frequently Asked Questions

Which devices are detected via WPD?+
Typically, smartphones, tablets, digital cameras and other compatible portable devices.
Can the times of connection be reconstructed?+
Depending on the artefacts available, relevant clues can be gleaned.
Is the original system being examined?+
No. Only a forensic copy or forensic image is analysed.
Are WPD artefacts sufficient on their own?+
No. They are always assessed alongside other digital evidence.

LanCologne – Windows Forensics in Cologne

LanCologne supports you in carrying out legally admissible analyses of Windows portable devices and the objective reconstruction of digital device histories.

Get in touch now