MOBILE FORENSICS

Forensic analysis of Threema on Android

Threema is a privacy-focused messaging app with strong end-to-end encryption. As part of an Android forensic investigation, local databases, media files and other technical artefacts can be analysed, depending on the available data.

SQLite databases
Encrypted application data
Media and attachments
Contact and profile details
Backups and export files
Timestamps and metadata
Configuration files
Journal and WAL files

TECHNICAL BACKGROUND

Technical Fundamentals

Threema stores most of its application data locally on the device.

Forensically relevant artefacts include, amongst others:

  • •SQLite databases
  • •Encrypted application data
  • •Media and attachments
  • •Contact and profile details
  • •Backups and export files
  • •Timestamps and metadata
  • •Configuration files
  • •Journal and WAL files

The layout and storage locations may vary depending on the app and Android version.

OUR APPROACH

This is how your examination will be carried out

A transparent process – from the initial enquiry to the handover of the report.

1
Following a suitable forensic data backup, databases, media, metadata and other artefacts are examined using recognised IT forensic tools and manual analysis. All technical findings are documented in a reproducible manner and assessed solely on the basis of objective evidence.
2
LanCologne produces expert reports for private individuals, as well as for companies and solicitors. Our reports have already been used in court proceedings. In some cases, we have been directly commissioned to produce IT forensic reports. Upon request, we can provide anonymised or redacted sample reports or extracts.

TYPICAL QUESTIONS

When is this analysis required?

  • ✔What chat services and media are available?
  • ✔Which databases can be analysed?
  • ✔What are the implications of encryption?
  • ✔What information do backups contain?
  • ✔How significant are the existing artefacts?

LIMITATIONS & CONCLUSION

What you should know

End-to-end encryption, deleted data, missing backups or unavailable keys may limit the scope of a forensic analysis. Conclusions are drawn solely on the basis of the technical artefacts that are actually available.

Analysing Threema requires in-depth knowledge of local data storage and the security mechanisms in use. A robust assessment requires a comprehensive evaluation of all available artefacts.

CUSTOMER REVIEWS

What our customers say

4.8 out of 5 stars on Trustpilot · 54 reviews

★★★★★

“The highest standards of professionalism, prompt service and excellent communication. They made the seemingly impossible a reality. This is what genuine customer service is all about – unrivalled in Germany!”

idalein

Verified review on Trustpilot

★★★★★

“Very helpful advice, excellent responsiveness and communication. My problem was completely resolved and the lost data was recovered. I’m very satisfied and, of course, relieved!”

Layla Pankratz

Verified review on Trustpilot

★★★★★

“My problem was sorted out professionally and quickly; everyone I spoke to was always friendly, and I can still get in touch if I have any questions – I’m very grateful for that!”

a woman from Cologne

Verified review on Trustpilot

Enquire now – free initial consultation

Would you like to have Threema data on an Android device examined by professionals? LanCologne can assist you with an objective IT forensic analysis and comprehensive expert documentation.

RELATED TOPICS

You might also be interested in

FREQUENTLY ASKED QUESTIONS

Frequently Asked Questions

Click on a question to see the answer.

Does Threema use end-to-end encryption?
Yes. Messages are end-to-end encrypted by default.
Is data stored locally?
Yes. Depending on the version, relevant artefacts are stored in the app’s internal storage.
Are backups relevant to forensic investigations?
Yes, provided they are available and can be analysed technically.
Can deleted messages be recovered?
That depends on the data set and the artefacts available.
Could an expert report be drawn up on this matter?
Yes. The results are documented in a transparent manner and assessed from a technical perspective.