Hard Drives, Databases, ERP Systems & More

What We Forensically Examine

The complexity of modern IT infrastructures brings not only high performance but also new risks. Whether structured data in ERP systems, hidden areas on hard drives, or older backup tapes – wherever data is stored, traces can be left behind or deliberately deleted.

Computerforensic & more secures and analyzes your systems using methods that stand up in court – from database clusters and SSD storage to mail databases.

Hard Drives & Databases: Where Data Residues Become Evidence

Hard drives are a forensically critical storage medium – but full of technical specifics. Data is often not stored linearly but fragmented or in hidden areas (HPA/DCO). Many systems also contain file slack, RAM slack, or drive slack—spaces where unintended data residues reside.

We secure and analyze:

• HDDs, SSDs, HPA- & DCO-protected drives
• Data fragments in free clusters
• Wear-leveling issues with SSDs
• Hidden partitions & encrypted areas
• System states: timestamps of access, manipulation, or deletion

Important: Any manipulation of the storage medium can destroy evidence. Therefore: No changes without expert forensic analysis!

ERP Systems: Structured Yet Complex

ERP systems (e.g., SAP, Microsoft Dynamics, Odoo) form the digital backbone of many companies and are often the core of our forensic analyses.

Our services include:

• Extraction of structured data from relational systems
• Analysis using predictive coding & pattern matching
• Creation of audit trails for traceability
• Detection of manipulation & irregularities
• Development of customized analytical tools

We help you extract relevant clues from the flood of ERP data.

Backup Tapes: Forgotten Storage with Relevance

Data once stored on magnetic tapes is often forgotten but can be crucial for evidence preservation.

We analyze:

• Tape contents (incremental, differential, full backups)
• User access & system states at backup time
• Rights and password assignments in old backups
• Digital traces in archived logs and access records

Note: Data on physically erased tapes without prior digitization cannot be recovered – please consult us before deleting!

Mail Databases: Reconstructing Digital Communication

Emails often constitute the most important form of internal and external communication in companies. As forensic experts, we can extract valuable insights from mail databases – including deleted messages.

Our approach includes:

• Securing & analyzing PST, OST, MBOX, and others
• Reconstruction of deleted emails (file carving)
• Analysis of mail servers & gateway logs
• Evaluation of header data, metadata & timestamps
• Reconstruction of mail timelines & message flows

Email accounts are often underestimated treasure troves of evidence – especially in cases of data theft, internal disputes, or white-collar crime.

Why Choose Us?

✓ Court-admissible preservation methods (physical & logical)
✓ Analysis of hidden & encrypted storage areas
✓ Proprietary tools for data extraction from complex systems
✓ Complete discretion & GDPR compliance
✓ Personal consultation & legal support