MOBILE FORENSICS

Stalkerware on smartphones

The term ‘stalkerware’ refers to applications that can be used to secretly monitor activity on a smartphone. Depending on the type, communication data, locations, messages or other information may be recorded. However, whether stalkerware has actually been installed can only be determined through a structured IT forensic investigation.

Installed applications
App permissions
Administrator and user guides
Persistence mechanisms
System and application logs
Network and communication artefacts
Known Indicators of Compromise (IoCs)

TECHNICAL BACKGROUND

Technical Fundamentals

As part of an investigation, the following areas – amongst others – can be analysed, depending on the equipment and data source:

  • •Installed applications
  • •App permissions
  • •Administrator and user guides
  • •Persistence mechanisms
  • •System and application logs
  • •Network and communication artefacts
  • •Known Indicators of Compromise (IoCs)

OUR APPROACH

This is how your examination will be carried out

A transparent process – from the initial enquiry to the handover of the report.

1
Following a suitable forensic data backup, relevant system and application artefacts are analysed. Any anomalies are examined both automatically and manually and assessed within the overall technical context. The aim is to provide an objective assessment of the available evidence. Suspicious circumstances are clearly distinguished from verifiable technical findings.
2
LanCologne produces private expert reports for private individuals, companies and solicitors. Our reports have already been used in court proceedings. In some cases, we have been directly commissioned to produce IT forensic reports. Upon request, anonymised extracts from our client references can be provided.

TYPICAL QUESTIONS

When is this analysis required?

  • ✔Is any stalkerware installed?
  • ✔Have any unusual permissions been granted?
  • ✔Is there any evidence of hidden surveillance features?
  • ✔Can any suspicious communication patterns be identified?
  • ✔What technical traces can be detected?

LIMITATIONS & CONCLUSION

What you should know

Not all surveillance software leaves behind permanent, detectable traces. Deleted applications, operating system restrictions or unknown software versions can limit the conclusiveness of an investigation. These limitations are documented transparently.

Mere suspicion of stalkerware is no substitute for a technical investigation. Only a thorough IT forensic analysis can provide an objective assessment of the digital evidence available.

CUSTOMER REVIEWS

What our customers say

4.8 out of 5 stars on Trustpilot · 54 reviews

★★★★★

“The highest standards of professionalism, prompt service and excellent communication. They made the seemingly impossible a reality. This is what genuine customer service is all about – unrivalled in Germany!”

idalein

Verified review on Trustpilot

★★★★★

“Very helpful advice, excellent responsiveness and communication. My problem was completely resolved and the lost data was recovered. I’m very satisfied and, of course, relieved!”

Layla Pankratz

Verified review on Trustpilot

★★★★★

“My problem was sorted out professionally and quickly; everyone I spoke to was always friendly, and I can still get in touch if I have any questions – I’m very grateful for that!”

a woman from Cologne

Verified review on Trustpilot

Enquire now – free initial consultation

Do you suspect that your smartphone is being monitored without your consent? LanCologne can assist you with an objective IT forensic investigation and a transparent technical assessment.

RELATED TOPICS

You might also be interested in

FREQUENTLY ASKED QUESTIONS

Frequently Asked Questions

Click on a question to see the answer.

Can stalkerware always be detected?
No. The ability to verify this depends on the data set and the software used.
Is high battery usage proof of this?
No. There are numerous possible technical causes for this.
Are Android and iPhone being investigated?
Yes, provided that this is technically feasible and forms part of the contract.
Are deleted traces also taken into account?
Where technically feasible, relevant artefacts are also examined.
Can an expert report be drawn up?
Yes, provided that this is requested.