MOBILE FORENSICS

Mobile artefacts – Notifications in IT forensics

Push notifications are part of everyday life on modern smartphones. Messages from messaging services, emails, calendars, social media platforms or banking apps frequently appear as notifications on the lock screen or in the notification centre. Depending on the operating system, these notifications may contain information of forensic relevance.

Forensic analysis
Documentation admissible in court
GDPR-compliant processing
Experienced experts

OUR APPROACH

This is how your examination will be carried out

A transparent process – from the initial enquiry to the handover of the report.

1
We analyse existing notification databases, system logs and app-specific artefacts, and compare these with messaging data, calendars, browser artefacts and other digital traces. Every step of the investigation is documented in a way that allows for full traceability.

TYPICAL QUESTIONS

When is this analysis required?

  • ✔Which notifications have been received?
  • ✔At what point was a notification displayed?
  • ✔Which application is it from?
  • ✔Could a message have been deleted after it was displayed?
  • ✔Can notifications be correlated with other artefacts?

LIMITATIONS & CONCLUSION

What you should know

Not all operating systems or apps store notifications permanently. The scope and retention period vary considerably. Notification artefacts should therefore always be assessed in conjunction with communication, time and app data.

Notifications can provide important additional information about events and communications received. When combined with other artefacts, they make a valuable contribution to a comprehensive mobile IT forensic investigation.

CUSTOMER REVIEWS

What our customers say

4.8 out of 5 stars on Trustpilot · 54 reviews

★★★★★

“The highest standards of professionalism, prompt service and excellent communication. They made the seemingly impossible a reality. This is what genuine customer service is all about – unrivalled in Germany!”

idalein

Verified review on Trustpilot

★★★★★

“Very helpful advice, excellent responsiveness and communication. My problem was completely resolved and the lost data was recovered. I’m very satisfied and, of course, relieved!”

Layla Pankratz

Verified review on Trustpilot

★★★★★

“My problem was sorted out professionally and quickly; everyone I spoke to was always friendly, and I can still get in touch if I have any questions – I’m very grateful for that!”

a woman from Cologne

Verified review on Trustpilot

Enquire now – free initial consultation

Do you have any questions? Please contact us for a free initial consultation.

RELATED TOPICS

You might also be interested in

FREQUENTLY ASKED QUESTIONS

Frequently Asked Questions

Click on a question to see the answer.

Can notifications still be present after a message has been deleted?
Depending on the operating system and the data available, notification artefacts may still contain information about when a message was originally received.
Are all notifications stored permanently?
No. The scope and duration of data storage depend on the operating system, the app in question and the device settings.
Are notification timestamps admissible as evidence?
Yes. They can help to reconstruct the chronological sequence of events.
Can notifications be tampered with?
As with other digital artefacts, a plausibility check is required. For this reason, notifications are always cross-checked against other data sources.
Why are notification artefacts important?
They can provide evidence of messages or events that have been received, even if the actual content has subsequently been altered or deleted.