IT Forensics · Private Individuals
How can I have an Android smartphone checked for unauthorised access or malware?
On Android devices, monitoring apps typically require far-reaching permissions: accessibility, device administrator, notification access and background location tracking. A security check focuses precisely on these – and on the accounts linked to the device.
Why this question is important for private individuals
A potential unauthorised access often involves highly personal data and can cause considerable anxiety. This is precisely why an objective investigation is important: not every anomaly constitutes an attack, but any concrete suspicion should be investigated using appropriate digital evidence.
Technical background
Many signs, such as high battery usage or a warm device, are non-specific. More reliable indicators include: apps without an icon, installations from outside the Play Store, unusual combinations of permissions, unauthorised Google sessions, or Play Protect being disabled.
Relevant evidence and data sources
- Installed packages, with installation source and time
- Access to accessibility features, device administration and notifications
- Android Usage Stats and battery usage statistics by app
- Google Account: Devices, sessions, security events
- Network traces (VPN profiles, private DNS, proxy settings)
Borders
- Depending on the model and version of Android, not all data can be read without root access.
- After resetting to factory settings, previous tracks are usually no longer present.
- Sophisticated spyware can minimise traces; a negative result applies only to the scope of the scan.
Possible results
- Surveillance app or suspicious permission detected
- Unauthorised account session detected
- No findings within the scope of the audit (specifying the limits)
Why LanCologne?
For private individuals, unauthorised access is often much more than just a technical problem. Smartphones and computers contain personal communications, photos, documents, login details and, in many cases, access to other online accounts.
Here’s how we do it
- Secure the appliance to the extent possible for that model.
- Comparison of installed packages against known indicators (including MVT-compatible IOC lists).
- Checking permissions and usage statistics for anomalies.
- Correlation with account activity and the incidents you have observed.
We take your concerns seriously – but we do not treat them as a diagnosis
A forensic investigation must also take into account the possibility that an unusual finding may have a normal technical cause. This protects the client from drawing false conclusions and makes a genuinely positive finding considerably more reliable.
Evidence preservation and security must go hand in hand
In the event of acute account misuse, it may be necessary to change passwords, terminate sessions or suspend an account. At the same time, such changes may affect the historical record. We therefore prioritise the preservation of evidence wherever reasonably possible, without artificially prolonging any ongoing damage.
Why choose LanCologne for a private IT forensic investigation?
Our role is not to confirm a client’s fears. We answer a technical question of fact. The underlying data, the methodology and the limitations of the findings are documented in such a way that the result remains comprehensible and, if necessary, can be assessed by a lawyer, a regulatory authority or another qualified IT forensic expert.
Legal framework
In the event of suspected unauthorised access, various criminal offences may be involved. Section 202a of the German Criminal Code (StGB) covers, subject to its conditions, the unauthorised obtaining of access to data—which is specifically protected against unauthorised access and not intended for the perpetrator—by circumventing the access security measures. Section 202b of the German Criminal Code (StGB) covers, subject to its conditions, the unauthorised interception of data not intended for the perpetrator from a non-public data transmission or electromagnetic radiation.
Data tampering (Section 303a of the German Criminal Code (StGB)) or computer sabotage (Section 303b StGB) may also be relevant, depending on the actual facts of the case. In the case of stalking, Section 238 of the German Criminal Code (StGB) takes into account, amongst other things, certain digital acts and expressly refers to offences under Sections 202a to 202c. However, the technical detection of unauthorised access or alteration does not automatically mean that all the elements of the offence are fulfilled or that a specific person is the perpetrator.
To ensure that evidence can be preserved at a later stage, it is important not to alter digital content unnecessarily. The Police Crime Prevention Service also recommends the prompt documentation of digital evidence in cases of online crime; in the case of hacked accounts, the focus is simultaneously on rapid damage limitation and evidence preservation. Both must be coordinated effectively in each specific case.
LanCologne does not make any criminal allegations and is not a substitute for the police or a solicitor. We can establish technical facts and document them in a verifiable manner on devices and data lawfully provided to us. Whether this gives rise to a criminal offence, a civil claim or any other legal consequence is assessed by the relevant authorities.
Frequently Asked Questions
How can I have an Android smartphone checked for unauthorised access or malware?
Should I reset my mobile?
Is an antivirus app enough?
Will my whole mobile phone be searched?
LanCologne – IT Forensics for Private Individuals
Do you have a digital enquiry? LanCologne can assist you with an objective, unbiased IT forensic investigation.