LAB-0001
Samsung recovery and reset trail
How a Samsung phone records a factory reset, which files hold the evidence, and how the same trail looks in a full file system extraction and in a bug report.
Read the articleSectraTEK Lab
Mobile device research, published openly.
We study how phones and tablets record their own history, from recovery logs to bug reports. Every article says what we found, how we found it, and what it does not prove.
- t0Reset confirmed in Settings
- t0 + 00:02Recovery run written to its history
- t0 + 00:03Data partition formatted
- t0 + 00:09First boot after the reset
- t0 + 04:30Another region code applied after a SIM change
Synthetic example A reset leaves a trail in several files. This is the shape of the trail studied in LAB-0001.
Latest research
Numbered reports with an evidence box, a way to reproduce each result, and a public corrections log.
LAB-0002
Android bug reports, category by category
What each part of an Android bug report holds, which parts change between versions, and where the same fact can be read from more than one place.
Read the articleReference collection
Synthetic teaching sets, each written by a script from a fixed seed, with reference answers that say what is in it.
- 7Synthetic datasets
- 32Technical reports
- 30Open-source contributions
- 21Research articles
What this site publishes today.
Open Source
Work that goes back to the tools examiners already use.
We contribute parsers and fixes to open-source mobile forensics projects, and link each finding to the parser that reads the artifact.
See our contributions
Ask the Lab
Ask a question about a mobile artifact.
We answer in public when the answer helps other examiners, and we say so plainly when we do not know. No files are accepted through this form.
Read answered questionsAbout the Lab
An in-house lab that publishes what it learns.
SectraTEK Lab is the in-house mobile threat detection and intelligence lab at SectraTEK. We publish our research openly, for education, under a Creative Commons licence. Articles are written by Daniel Addai, SectraTEK Lab.