About
About the Lab
SectraTEK Lab is the in-house mobile threat detection and intelligence lab at SectraTEK. We study how mobile devices record what happens to them, and we publish what we learn.
What the Lab does
Phones and tablets keep records of their own history: when they were reset, which software they ran, which networks and accessories they met. Those records change between device models and operating system versions, and the changes are rarely documented. We test devices, read what they leave behind, and write down what each record means and where it stops being reliable.
The work is research first. We publish it openly, for education, so that examiners, researchers and teachers can read it, check it and build on it. Articles carry the evidence, the way to reproduce each result and the limits of each claim. Where a finding depends on a parser in an open-source tool, we say which one and, where we can, improve it.
What the Lab is not
- It is not a product site. There are no sales pages, prices or demos here.
- It is not an incident response service and does not examine devices for the public. For forensic services, contact SectraTEK or Prudential Associates.
- It does not accept or publish case data. Every image and sample on this site comes from our own or consented test devices, or is synthetic.
- It does not prove anything about a particular device. A finding is an indicator. Each article states what it does not prove.
Who writes it
Daniel Kwaku Ntiamoah Addai, SectraTEK Lab
Daniel Kwaku Ntiamoah Addai leads SectraTEK Lab and writes its articles. Daniel is a digital forensics examiner and mobile security researcher with seven years in security operations, incident response, malware analysis and expert forensic work, and today is a senior digital forensics and incident response specialist at Prudential Associates and a co-founder of SectraTEK.
In research, Daniel is first author of two regular papers and one fast abstract accepted at QRS 2026, and a co-author of a study of the reliability of digital forensic evidence found by large language models (IEEE COMPSAC 2025; arXiv:2602.20202). Daniel directs the Lab Technical Reports (seven archived on Zenodo) and has 26 merged contributions to the open-source parsers iLEAPP and ALEAPP. Daniel holds an M.S. in Cyber Forensics and Counterterrorism and a B.S. in Computer Science.
What we publish, and where
- Research
- Numbered reports (LAB-0001 onward), each with an evidence box, a version history and a corrections log. Research index
- Datasets
- Reference images from test devices, released with the ground truth and hashes. Datasets
- Open source
- Parsers and fixes we contribute to public forensic tools. Open Source
- Challenges
- Practice cases built on reference images, with answers released after they close. Challenges
- Questions
- Public answers to examiners' questions. Ask the Lab
How we work
The method is the same for every article: record the device and build, take the evidence from a device or extraction in our research collection, write the claim in the narrowest words that fit, and have it reviewed before it goes public. The full standard is on the Methodology page. Mistakes are corrected in public; see Corrections.
To reach the Lab, see Contact.