MOBILE FORENSICS

Evidence of deleted data

Deleted data plays a key role in many IT forensic investigations. It is often assumed that deleted content has disappeared completely. In fact, this depends on numerous technical factors. Even if a file can no longer be recovered, traces of its former existence may often still remain.

Forensic analysis
Documentation admissible in court
GDPR-compliant processing
Experienced experts

OUR APPROACH

This is how your examination will be carried out

A transparent process – from the initial enquiry to the handover of the report.

1
Once the evidence has been secured, all relevant artefacts are examined for signs of deleted data. This involves searching not only for recoverable files, but also for technical traces that may indicate their previous existence or use.
2
LanCologne prepares private expert reports on behalf of private individuals, companies and solicitors, as well as expert reports in the context of court-ordered assignments. Our investigations have already been used in various court proceedings. Furthermore, in some cases we have been directly commissioned to prepare IT forensic reports. All findings are documented in a transparent manner and supported by technical justification.

TYPICAL QUESTIONS

When is this analysis required?

LIMITATIONS & CONCLUSION

What you should know

Not every deleted file can be recovered. Overwritten storage areas, encryption or missing artefacts may limit the evidence that can be obtained. A reputable expert report describes these limitations openly and transparently.

The evidence of deleted data is not limited to the recovery of files. Often, the metadata and associated traces that remain provide important insights for the technical assessment of a case.

CUSTOMER REVIEWS

What our customers say

4.8 out of 5 stars on Trustpilot · 54 reviews

★★★★★

“The highest standards of professionalism, prompt service and excellent communication. They made the seemingly impossible a reality. This is what genuine customer service is all about – unrivalled in Germany!”

idalein

Verified review on Trustpilot

★★★★★

“Very helpful advice, excellent responsiveness and communication. My problem was completely resolved and the lost data was recovered. I’m very satisfied and, of course, relieved!”

Layla Pankratz

Verified review on Trustpilot

★★★★★

“My problem was sorted out professionally and quickly; everyone I spoke to was always friendly, and I can still get in touch if I have any questions – I’m very grateful for that!”

a woman from Cologne

Verified review on Trustpilot

Enquire now – free initial consultation

Would you like to find out whether deleted data or traces of it can still be detected on a smartphone? LanCologne can assist you with an objective IT forensic investigation.

RELATED TOPICS

You might also be interested in

FREQUENTLY ASKED QUESTIONS

Frequently Asked Questions

Click on a question to see the answer.

Can every deleted file be recovered?
No. Whether it can be restored depends on many technical factors and how the device is used in future.
Can deleted Messenger messages be traced?
Depending on the messaging service and the databases involved, traces of deletion or associated artefacts may be present.
What is the difference between recovery and detection?
A file does not need to be fully recoverable for its previous existence to be technically proven.
Are cloud traces also being investigated?
Where they are relevant to the issue at hand and technically available, cloud-related artefacts may also be taken into account.
Will I receive a written report?
Yes. All results are documented in a structured manner and explained in a way that is easy to follow.