IT Forensics

Intentionally deleted or altered data can be recovered as evidence for police, prosecutors, experts, and also for private individuals. Information about the nature, timing, and motivation behind the manipulation can also be documented. We analyse data from hard drives, SSDs, smartphones and many other storage media.

What Is IT Forensics?

In the course of a forensic analysis, the exact deletion process of data is reconstructed in order to obtain precise information about an offense. The deleted or altered data is not merely recovered. Rather, IT forensics serves police, prosecutors, or other authorities in obtaining court-admissible information about the nature, timing, and scope of the deletion, overwriting, or alteration of files. This allows an offense to be attributed to a specific person and a potential sentence to be determined.

Our Service:

• Technical and professional consulting on forensic analysis
• Project management and coordination
• Collection of relevant data sources
• Acquisition of storage media
• Recovery of deleted or overwritten data
• Cooperation with law enforcement agencies / attorneys
• IT forensics for corporate management
• Clear preparation and presentation of analysis results

How Does an IT Forensic Analysis Work?

The process of a forensic data analysis always follows the individual requirements profile. In any case, the goal is not only to restore the state before the "incident" or offense (data recovery), but also to obtain information about the nature of the deletion or alteration of relevant data. The documentation of evidence must be coherent enough to hold up in court if necessary. Do you need certified data destruction instead?

Key Questions of IT Forensics:

• When was the data deleted?
• What data was deleted?
• Why was the data deleted?
• What methods were used to manipulate the data?