MOBILE FORENSICS

IT forensic malware reports for smartphones

A malware report is required when the findings need to stand up to scrutiny by third parties: in court, vis-à-vis an employer, an insurance company or a public authority. The focus is therefore not only on the technical findings, but also on their transparent methodology and clearly defined scope.

Description of the investigation mandate
Documentation of data backup
Description of the investigative methods used
Analysis of relevant artefacts
Assessment of IoCs, MVT and YARA hits
Manual validity check
Summary technical assessment
Documenting boundaries and uncertainties

ORIENTATION

Which service is right for you?

Technical background

Technical background

An expert report documents the evidence-gathering process (method, hash values, chain of custody), the tools and versions used, findings with supporting references, and their assessment. It distinguishes between „proven“, „indication“ and „cannot be established“ and answers the specific question of evidence – nothing more.

Traces and data sources

Relevant evidence and data sources

  • •Documented device backup with hash values
  • •Findings from checks, spyware investigations or malware analysis, with references
  • •Account statements, where relevant

Our approach

Here’s how we do it

  • •Formulating the question of proof with you or your solicitor.
  • •Backup, documented in a manner that is verifiable in legal proceedings (method, hash values, chain of custody).
  • •Investigation and assessment.
  • •Report including a summary, methodology, findings and limitations.

LanCologne produces private expert reports for private individuals, companies and solicitors, as well as expert reports for use in legal proceedings. Our expert reports have already been used in court proceedings. Furthermore, in certain cases we have been directly commissioned to prepare IT forensic expert reports. Upon request, anonymised and redacted reference reports, or extracts therefrom, can be provided.

Borders

Borders

  • •A private expert report is not binding on a court.
  • •A negative result does not prove that there was no malware present.

Result

Possible results

  • •Expert report with the evidence question answered and appendices

TYPICAL QUESTIONS

When is this analysis required?

  • ✔Has the smartphone been infected with malware?
  • ✔Are there any signs of spyware or stalkerware?
  • ✔Which technical findings can be objectively verified?
  • ✔How significant are the existing artefacts?
  • ✔What conclusions are technically justifiable?

LIMITATIONS & CONCLUSION

What you should know

The validity of an expert report depends largely on the available data, the condition of the device and the technical capabilities of the investigation. Not all malware leaves behind traces that can be used in the long term. These limitations are documented transparently and taken into account in the assessment.

An IT forensic malware report combines a structured technical investigation with an objective and transparent assessment of the findings. This provides clients with a sound basis for further decision-making.

CUSTOMER REVIEWS

What our customers say

4.8 out of 5 stars on Trustpilot · 61 reviews

★★★★★

“The highest standards of professionalism, prompt service and excellent communication. They made the seemingly impossible a reality. This is what genuine customer service is all about – unrivalled in Germany!”

idalein

Verified review on Trustpilot

★★★★★

“Very helpful advice, excellent responsiveness and communication. My problem was completely resolved and the lost data was recovered. I’m very satisfied and, of course, relieved!”

Layla Pankratz

Verified review on Trustpilot

★★★★★

“My problem was sorted out professionally and quickly; everyone I spoke to was always friendly, and I can still get in touch if I have any questions – I’m very grateful for that!”

a woman from Cologne

Verified review on Trustpilot

Enquire now – free initial consultation

Do you require a forensic IT report on malware, or would you like to have a suspected case of malware investigated technically? LanCologne can assist you with an objective investigation and comprehensive expert documentation.

FREQUENTLY ASKED QUESTIONS

Frequently Asked Questions

Click on a question to see the answer.

Can a malware report be used in court?

Depending on the terms of the commission and the issues involved, an expert report may be used in legal proceedings.

Who can commission a malware assessment?

Private individuals, companies, solicitors and – depending on the proceedings – courts or other public bodies.

Are assumptions being presented as facts?

No. Verified findings and technical assessments are clearly distinguished from one another.

Which devices can be examined?

Depending on the nature of the enquiry, Android and iPhone devices, as well as their forensic backups.

Can an existing expert report be reviewed?

Yes. Existing expert reports can be assessed from a technical perspective as part of a counter-assessment or a plausibility check.

When do I need an expert opinion rather than a report?

If third parties were able to review or challenge the outcome – for example, in court or with an insurance company.

Can a check be expanded into a full assessment at a later date?

Yes, provided that the backup was documented from the outset.