MOBILE FORENSICS
Detecting spyware on smartphones
This investigation is designed for a specific suspicion of surveillance: someone appears to know your messages, your location or your conversations. Unlike a general security check, it focuses specifically on surveillance software – ranging from commercial stalkerware to sophisticated spyware.
ORIENTATION
Which service is right for you?
- •Mobile Threat & Malware Check – low-threshold safety check / initial inspection
- •Detecting spyware on smartphones – a targeted investigation where there are specific grounds for suspicion of surveillance (this page)
- •Mobile Malware Analysis – technical forensic analysis of malware
- •Malware Assessment Report – expert documentation and assessment for the courts, employers or insurance companies
Technical background
Technical background
Stalkerware is usually installed via physical access and utilises extensive permissions (Android: Accessibility, Device Administrator; iOS: more commonly via compromised Apple IDs/iCloud or configuration profiles). Sophisticated spyware such as Pegasus, on the other hand, exploits security vulnerabilities and leaves only a few, often fleeting traces – which require specialised indicator lists to detect.
Traces and data sources
Relevant evidence and data sources
- •iOS: sysdiagnose, Unified Logs, Data Usage/Network Statistics, Configuration Profiles, iCloud device lists
- •Android: Permissions (Accessibility, Device Administrator), Installation sources, UsageStats
- •Account level: third-party devices and sessions in Apple ID, Google Account, Messenger web sessions
- •IOC alignment (including MVT-compatible indicators, amongst others)
Our approach
Here’s how we do it
- •Record specific grounds for suspicion and the relevant time period.
- •Securing the equipment at the maximum possible depth and checking accounts.
- •IOC and artefact checking; manual verification of all hits.
- •Report – available as an expert opinion on request.
Borders
Borders
- •Not all spyware leaves permanent traces (existing text).
- •Tracks may be lost after a reset or Update.
Result
Possible results
- •Monitoring software detected (type, time period)
- •Unauthorised access to the account rather than to the device
- •No findings within the scope of the audit
TYPICAL QUESTIONS
When is this analysis required?
- ✔Are there any signs of spyware?
- ✔Have any suspicious apps been installed?
- ✔Are there any anomalies in the system data?
- ✔Can any known IoCs be detected?
- ✔Is there any evidence of tampering?
LIMITATIONS & CONCLUSION
What you should know
Not all spyware leaves permanent, detectable traces. Modern malware can minimise traces or leave only a few clues behind after it has been uninstalled. Furthermore, operating system protection mechanisms and the available data set are crucial to the reliability of the findings.
Suspicions of spyware should not be based on mere conjecture. Only a structured IT forensic investigation can provide an objective assessment of the technical evidence available.
CUSTOMER REVIEWS
What our customers say
4.8 out of 5 stars on Trustpilot · 61 reviews
“The highest standards of professionalism, prompt service and excellent communication. They made the seemingly impossible a reality. This is what genuine customer service is all about – unrivalled in Germany!”
idalein
Verified review on Trustpilot
“Very helpful advice, excellent responsiveness and communication. My problem was completely resolved and the lost data was recovered. I’m very satisfied and, of course, relieved!”
Layla Pankratz
Verified review on Trustpilot
“My problem was sorted out professionally and quickly; everyone I spoke to was always friendly, and I can still get in touch if I have any questions – I’m very grateful for that!”
a woman from Cologne
Verified review on Trustpilot
Enquire now – free initial consultation
Do you suspect your smartphone might be infected with spyware? LanCologne can help you with an objective IT forensic investigation and a transparent technical assessment.
RELATED TOPICS
You might also be interested in
FREQUENTLY ASKED QUESTIONS
Frequently Asked Questions
Click on a question to see the answer.