DIGITAL FORENSICS · IT SECURITY · COUNTER-SURVEILLANCE
Preserve digital evidence and provide traceable forensic analysis
Services
Examinations of devices, data and rooms
Thirteen specialist services covering digital systems and storage media, connected systems and technical protection. Each service page sets out the subject of the examination, the method and the technical limits.
AI-generatedIT forensicsComputers, servers, data storage media and log dataView service 
AI-generatedSmartphone forensicsiOS and Android devices, backups and app databasesView service 
AI-generatedSpyware examinationPermissions, profiles, indicators of compromise and network indicatorsView service 
AI-generatedMac forensicsAPFS, FileVault, Apple silicon and unified logsView service 
AI-generatedWindows forensicsNTFS, registry, event logs and execution tracesView service 
AI-generatedSmartwatch forensicsWearables, paired devices and manufacturer accountsView service How we work
A documented sequence, not a black box
Every instruction follows the same four steps. What can be established technically, and what cannot, is stated openly.
Step 1
Clarify the question
Before any examination begins we agree what is to be clarified, which devices or rooms are involved and where the limits of the instruction lie.
Step 2
Secure the data
Devices and storage media are acquired in a controlled manner. Handover, acquisition method and cryptographic hashes are recorded.
Step 3
Examine the copy
Analysis is carried out on the secured working copy wherever this is technically possible; unavoidable changes to running systems are documented with reasons. Automated results are reviewed manually.
Step 4
Expert report prepared by an expert
The expert prepares a clear and traceable expert report. It documents the assignment, methodology, examination steps, technical findings, professional assessment, results and limitations.
What you can rely on
Working principles
More than ten years of professional experience
The specialists at AQON INTELLIGENCE have more than ten years of experience with computers, mobile devices, vehicles and sensitive rooms. This is their main field of work, not a side activity.
Qualified experts
Examinations are carried out by specialists with forensic and measurement experience. Automated results are reviewed manually before any statement is made.
Documented acquisition and examination steps
Acquisition methods, cryptographic hashes, tool versions and analysis steps are recorded so that every finding remains verifiable.
Compliant with data-protection requirements and limited to the agreed purpose
Each instruction is limited to the agreed question. Only the data required to answer that question is examined.
Expert report prepared by an expert
Findings are set out in an expert report that names the assignment, the methods used, the technical results and the limits of what could be established.
Verifiable documentation
For court or authority proceedings, the examination is documented so that third parties can review it. Admissibility and evidential value are decided by the competent body.
FREQUENTLY ASKED QUESTIONS
Questions about our examinations
Computers, servers, storage media, mobile devices, wearables, drones, vehicle systems and audio recordings, as well as rooms, cabling and the radio environment during technical surveillance counter-measures. Every instruction is limited to an agreed question.
Device and data examinations take place in the permanent examination rooms at the registered office in Krefeld, Germany. Technical surveillance counter-measures and vehicle screening are carried out on site, because rooms, cabling and the radio environment can only be measured in place.
Whether an expert report is used in proceedings, and what evidential value it carries, is decided by the competent court or investigating authority. Our examinations are documented so that third parties can follow them: recorded handover, cryptographic hashes, described methods and a clear separation between technical finding and assessment. A binding assurance of later admissibility cannot be given.
Consultation and correspondence are available in German, English, Italian and Hungarian. Written reports are produced in German; an English version can be agreed.
Contact
Discuss your case in confidence
Tell us briefly which device, system or event is to be examined. Consultations and ongoing communication are available in German, English, Italian and Hungarian.
- Phone
- +49 221 99981 490