IT forensics & digital evidence preservation
When data must not only come back, but hold up.
A data recovery asks: do we get the file back? A forensic image asks in addition: can it later be shown that the file was exactly like this and that nothing was changed along the way? That is a different standard — and a different procedure.
Confidentiality first
A confidentiality agreement before intake, not after.
Only on the copy
What is analysed is a secured copy with a checksum, not the original.
One location
Everything in our own lab in Frankfurt. Nothing outsourced, no intermediate stops.
One contact
You speak to the person handling the case.
The difference from data recovery
In a data recovery the result is what counts: the file is back, all good. In a forensic image the route there counts as well. Who had the drive and when? What was used to read it? Can it be shown that nothing changed between intake and analysis?
That is why it starts with an acquisition over which a checksum is calculated — a kind of fingerprint of the data. Every later analysis runs on a copy of that acquisition. If the checksum can be recalculated at any time, it is established that the analysed copy has not changed since the acquisition.
For hard drives and SSDs this is a complete image, read with write protection. For smartphones a bit-exact image is often not possible, and every extraction requires the device to be running and communicating with the extraction system. Which interventions this required is therefore documented.
For you that means one thing above all: please do not reach for it yourself beforehand. A common reason a data set loses value as evidence is not manipulation but well-meant initiative — a colleague who “just had a quick look”.
Until acquisition: preserve the state
Typical occasions
Data leaving with a departing employee
Someone leaves the company and there is a suspicion that documents went with them. What has to be established is what was copied to which medium and when.
Internal investigation
Compliance cases, suspicion of breach of trust or manipulation. The findings have to withstand later scrutiny.
Civil dispute
Securing and preparing a data set both sides refer to — with comprehensible documentation of how it came about.
Insurance and damage claims
After fire, water or a break-in: what was on the device, and can its state be documented?
Estates and legal guardianship
Access to devices when the entitled person can no longer access them — with evidence of entitlement.
Lost credentials in a company
Encrypted drives with no findable key, locked devices with no known code. Legitimate, but technically demanding.
How we work
- 01
Settle confidentiality
A confidentiality agreement before intake — your template or ours. Only then is the device opened.
- 02
Log the handover
Record the device with its serial number, document its condition, put the handover in writing. From here on it is traceable who had access and when.
- 03
Acquisition with checksum
For drives a complete image read with write protection, for mobile devices a forensic extraction. A checksum is calculated over the acquisition and recorded.
- 04
Analysis on the copy
Every further step runs on a copy of the acquisition. After the acquisition the original is not touched again.
- 05
Document the findings
What was found, by which method, and what can be shown from it — and what expressly cannot.
- 06
Handover or safekeeping
Results handed over encrypted. The original goes back or stays under lock until revoked.
Mobile device forensics: iPhone and Android
Smartphone forensics covers the forensic preservation and data extraction of iPhone and Android devices. The smartphone is today the richest source in almost any case — and the least accessible. Current devices encrypt by default, and the passcode goes into the derivation of the key. For locked devices with a known code, the route is short. Without a known lock code, access may nevertheless be possible depending on model, operating system version, device condition and the forensic procedures available. Whether this applies to a specific device can only be determined after examination.
For the analysis we use established forensic extraction systems. If the device is physically damaged, reconstruction of the hardware comes before extraction — the same Board-Level work as in a smartphone data recovery. A successful hardware reconstruction does not automatically make decryption possible; it can, however, create the precondition for specialised extraction procedures to be used at all.
Physically damaged device?
Passwords and encryption
Encrypted containers, locked archives, drives with a forgotten password: for cases with a legitimate claim to access we work with Passware. The encryption itself is not broken in the process. Passware searches for the password in a structured way and can — where available — also obtain keys from memory images or hibernation files.
How promising a password search is depends on what is known: approximate length, patterns used, older variants, company conventions. From such details a search space can be built that is small enough. Without clues and without key material it does not work, and we would rather say so beforehand.
What you get in writing
Confidentiality agreement
Mutual, before intake. Your template or ours.
Intake record
Device, serial number, condition, date, people involved.
Checksum of the image
The proof that the analysed state matches the one received.
Findings report
Method, tools, results — and expressly also the limits of what can be said.
Proof of deletion
In writing on request, once our working copies have been removed.
Clear limits are part of forensics.
What is not possible technically or legally, we tell you before intake — not afterwards.
No breaking of encryption
Modern strong encryption cannot simply be technically “broken”. Access may, however, be possible depending on the platform via existing keys, credentials, forensic procedures or device-specific access options.
Only with a traceable claim to access
We only work on devices where a comprehensible claim exists. We ask about it, and we ask before intake.
Answered briefly.
Do you sign a confidentiality agreement?
Yes, and before the device is accepted. Your template or ours — both are common. Only then is it opened.
How long does it take?
The imaging itself takes hours to days depending on scope. The analysis depends on the case. Tell us if a deadline applies — then we plan around it.
Is access to a locked mobile device possible?
With the passcode it is the short route — the device decrypts itself. Without a known lock code, access may nevertheless be possible depending on model, operating system version, device condition and the forensic procedures available. Whether this applies to a specific device can only be determined after examination. We only work where a demonstrable right of access exists.
Do we get something in writing?
Yes: an intake record, the checksum of the image and a findings report with method, tools and results — including the limits of what can be said.
What happens to the data after the case?
It sits exclusively on our encrypted server. After completion our working copies are deleted, on request with written proof. Alternatively we keep the image in safekeeping until revoked.
Do you also work for private individuals?
Yes, where a comprehensible claim to access exists — for example in an estate case or with your own devices and lost credentials.
Related.
Data recovery for businesses
Confidentiality, documented handover, proof of deletion.
Learn morePassware
Structured password search with a legitimate claim.
Learn moreEncrypted drives
What works with a key — and what does not without one.
Learn moreForensic extraction from a damaged smartphone
Which damage prevents extraction and what is then possible.
Learn moreChip-off in smartphone forensics
Possibilities and limits on encrypted devices.
Learn more
Data Recovery Professionals
A worldwide group of independent, owner-run data recovery companies. Members share methods from professional data recovery, forensics and software development — so on rare damage patterns the knowledge of the whole group stands behind your medium.
A case you would rather not discuss on the phone?
Then we start with the confidentiality agreement and talk afterwards. You reach us directly — no ticket system, no intermediary.
Wasserweg 8–10 · 60594 Frankfurt am Main
Jan Petermann
Founder & Managing Director
Contact for forensics & authorities