Digital Forensics

Mobile forensics for companies

A company phone holds messages, location history, credentials and documents, often more trade secrets than the associated computer. Which is why it is so frequently at the centre of an investigation.

Whether you call it mobile forensics, phone forensics or smartphone forensics, it means the same thing: securing and analysing smartphones and tablets to an evidentiary standard, whether they run iOS or Android.

A single mobile phone rests in a precise cradle on a dark examination surface, narrowly lit from below. The room around it stays dark.

The occasion

Typical reasons

01
Suspected leakage of trade secrets when employees leave
02
Loss or theft of a device with access to company data
03
Suspected surveillance software on the devices of exposed individuals
04
Reconstruction of communication as part of an internal investigation
05
Examining a device as an entry point into the corporate network

The scope

What is technically possible

The scope depends heavily on device, operating system version and encryption. A logical acquisition through the device interfaces is almost always possible; a full physical acquisition only in certain constellations. We say before we start what is achievable in your specific case and what is not. We do not make promises that depend on the device generation without checking first.

01
Acquisition with proof of integrity through checksums
02
Analysis of messages, call logs, calendars and contacts
03
Installed applications, their permissions and their stored data
04
Location data and network connections, as far as they were recorded
05
Recovery of deleted content, as far as technically reachable

Process

How an investigation works

First conversation

we clarify the question and the legal framework, for devices also used privately together with your legal department, data protection and works council.

Acquisition

the device is secured and the copy sealed with checksums. From then on we work only with the copy.

Analysis

we search along the agreed question, not through the whole device.

Report

you receive the results with method, tools used and complete documentation, written so that non-specialists can follow them.

Surveillance software

Suspected spyware

Devices used by management, development or sales are a rewarding target for surveillance software. Signs can include unusually high battery or data usage, unknown profiles or apps with conspicuous permissions. Only an investigation can say for sure. Until then the device should be neither reset nor updated, because that destroys exactly the traces that could confirm the suspicion.

Cloud

Not everything is on the device

Much of a smartphone's data is also or only stored in the cloud, such as backups, email and chat histories. That is why cloud forensics is often part of the investigation. If the device is part of an ongoing attack, the work starts with incident response.

The frame

When the device is also used privately

Where devices are also used privately, an investigation operates under tight legal limits. We settle the scope in advance with your legal department, the data protection officer and the works council, and confine the analysis to the agreed area. Private content we come across along the way does not enter the report.

Admissibility

Evidentiary weight

For a result to hold up in court or in employment proceedings, the chain from device to report has to be documented without gaps: who had access when, which tools were used, which checksums prove integrity. We work to that standard from the outset, because it cannot be established after the fact. For how this fits into the wider investigation, see Digital Forensics.

FAQ

Frequently asked questions

Do you examine iPhones and Android devices?

Yes, both, and tablets as well. How far the analysis goes depends on the model, operating system version and encryption. We tell you before the investigation starts.

Can we simply examine an employee's company phone?

Not just like that. Even on a purely corporate device it depends on your acceptable use agreement, and as soon as private use is permitted the frame becomes considerably tighter. We settle this before acquisition with your legal department, the data protection officer and the works council. An analysis without that clearance is, in case of doubt, not usable and creates a second problem alongside the first.

Can you recover deleted messages?

Sometimes. Whether it works depends on the device, the operating system version and how much has happened since the deletion. On modern encrypted devices the prospects are considerably poorer than they used to be. We try, but we do not promise it in advance.

What should we do with the device until you have it?

Do not switch it off, do not reset it, do not update it and do not let anyone browse around on it. Every one of those can overwrite traces. If the device is still connected and a remote wipe is a risk, talk to us before you take it off the network. The order matters here.

Will you see private messages in the process?

During technical acquisition that cannot always be separated; during analysis it can. We confine the analysis to the scope agreed in advance, and what is private does not appear in the report. The agreed scope is recorded in writing so it stays traceable later what was searched for.

How long does an investigation take?

Acquisition usually takes hours, analysis days depending on the question. A clearly bounded suspicion (the leakage of particular documents, say) is answered faster than an open search. So we scope the question beforehand.

Digital Forensics

Reputation takes years. Destruction takes seconds.

Talk to us before somebody else does. The first conversation is free and we reply the same business day.

Send an inquiry Call in an emergency