SectraTEK Lab

SectraTEK Labhttps://lab.sectratek.com/2026-11-10T03:23:00ZStalkerware, explained: when the watcher is someone you knowhttps://lab.sectratek.com/research/lab-0012/2026-11-08T00:00:00Z

What stalkerware is, how it reaches a phone, what the public record says about how common it is and how sellers have been handled, what to do if you suspect it, and what a device examiner can and cannot conclude.

Daniel Addai, SectraTEK LabRenting surveillance: from a monthly app to a government contracthttps://lab.sectratek.com/research/lab-0013/2026-11-08T00:00:00Z

A plain account of the market for spying on other people, from consumer stalkerware to hack-for-hire crews to commercial spyware sold to governments, using public court, government and research records, and what a device examiner can and cannot conclude.

Daniel Addai, SectraTEK LabHow would you know a phone has been compromised?https://lab.sectratek.com/research/lab-0014/2026-11-08T00:00:00Z

Targeted spyware is built to be quiet. This article sets out what an ordinary person can notice, what public checking tools and notifications can and cannot show, what U.S. and international guidance advises, and what a device examiner can and cannot conclude.

Daniel Addai, SectraTEK LabWho spyware is aimed at: journalists, officials and the people around themhttps://lab.sectratek.com/research/lab-0015/2026-11-08T00:00:00Z

What the Pegasus Project list, later forensic cases and U.S. government actions show about who is targeted by commercial spyware, what a list of phone numbers can and cannot prove, and what a device examiner can and cannot conclude.

Daniel Addai, SectraTEK LabCommercial spyware is an industry, not a producthttps://lab.sectratek.com/research/lab-0016/2026-11-08T00:00:00Z

One U.S. court case shows how a spyware seller runs as a business. This article follows it through the market of sellers, the U.S. rules aimed at them, what happens when a seller falls, and what a device examiner can and cannot conclude about a phone.

Daniel Addai, SectraTEK LabHackers for hire: surveillance as a paid servicehttps://lab.sectratek.com/research/lab-0017/2026-11-08T00:00:00Z

Hacking-for-hire turns break-ins into something a paying party can order through intermediaries. This article follows one U.S. case from arrest to sentence, shows how the chain of roles works, and says what a device examiner can and cannot conclude.

Daniel Addai, SectraTEK LabWhy antivirus cannot clear a phone: lessons from Operation Triangulationhttps://lab.sectratek.com/research/lab-0018/2026-11-08T00:00:00Z

In 2023 a security company reported spyware on its own employees' iPhones, with traces back to 2019. This article uses the public record of that case to explain why a scan app cannot tell you a phone is clean, what forensic examination looks at, and what an examiner can and cannot conclude.

Daniel Addai, SectraTEK LabMalware, spyware and stalkerware: three words, three responseshttps://lab.sectratek.com/research/lab-0019/2026-11-08T00:00:00Z

The three words are used as if they meant the same thing, but they name different threats and call for different first steps. This article explains the terms, uses the public U.S. and global record for each, and says what a device examiner can and cannot conclude.

Daniel Addai, SectraTEK LabSuspecting is not knowinghttps://lab.sectratek.com/research/lab-0020/2026-11-08T00:00:00Z

What a spyware warning or a strange phone does and does not tell you, why the order of your first steps matters, who can help, and what a device examiner can and cannot conclude. Built on the public record of the El Faro case and on current guidance.

Daniel Addai, SectraTEK LabGovernment cyber tools and commercial spywarehttps://lab.sectratek.com/research/lab-0021/2026-11-08T00:00:00Z

Two ways a powerful hacking capability reaches the world, built in-house by a government or sold as a commercial product. The public record on Stuxnet, the leaked exploits behind WannaCry and NotPetya, Pegasus and the WhatsApp case, and what the difference means for risk and for a device examiner.

Daniel Addai, SectraTEK LabSame artifact, different Android versionshttps://lab.sectratek.com/research/lab-0003/2026-11-06T00:00:00Z

The same record on an Android phone can sit in a different file, folder or shape from one Android version to the next. A reader built for one layout can return an empty table on another. Four artifacts followed across versions, with what the wrong layout returns.

Daniel Addai, SectraTEK LabReading one artifact in three evidence sourceshttps://lab.sectratek.com/research/lab-0004/2026-11-06T00:00:00Z

The same fact about a phone, such as a restart, a permission use or a reset, can sit in a full file system extraction, an Android bug report and an iOS sysdiagnose. Each source holds a different record, reaches back a different distance and uses a different clock. An explorer shows what each can and cannot say.

Daniel Addai, SectraTEK LabWhat privacy settings leave behind on a devicehttps://lab.sectratek.com/research/lab-0005/2026-11-06T00:00:00Z

Where a phone keeps the current state of a privacy or security setting, whether it keeps a record of the change, and why a setting that is not found is not the same as a setting that is off.

Daniel Addai, SectraTEK LabLinking records across fileshttps://lab.sectratek.com/research/lab-0006/2026-11-06T00:00:00Z

One event on a phone leaves records in several databases, XML files and logs. What a link between them needs, how a finding changes when a store is missing, and an interactive linker with synthetic records.

Daniel Addai, SectraTEK LabWhat the Zelle app leaves on an iPhonehttps://lab.sectratek.com/research/lab-0007/2026-11-06T00:00:00Z

What the Zelle app is for, what the public record says about third-party misuse of the service, and what the Lab found in the app's folder on iPhone research images: a risk-check log, analytics records and settings, and no payment record.

Daniel Addai, SectraTEK LabWhat the OfferUp app leaves on an iPhonehttps://lab.sectratek.com/research/lab-0008/2026-11-06T00:00:00Z

OfferUp keeps listings, chat and meet-up arrangements on its service, not on the phone. What an iPhone does hold is account and app state, search areas, recent searches, feed identifiers, unsent drafts, timing and a small cache, and what each can and cannot show.

Daniel Addai, SectraTEK LabWhat the AnyDesk app leaves on an iPhonehttps://lab.sectratek.com/research/lab-0009/2026-11-06T00:00:00Z

The AnyDesk app for iPhone keeps a few text, configuration and log files and no database. This article explains why that is normal for a remote-access app, what the files still tell an examiner, and what they cannot say about a session or a scam.

Daniel Addai, SectraTEK LabWhat the Craigslist app leaves on an iPhonehttps://lab.sectratek.com/research/lab-0010/2026-11-06T00:00:00Z

What the Craigslist iPhone app keeps in its own container (searches, opened postings, favorites, cached postings), what it does not keep, what the public record says about misuse of online classifieds, and what a signed-out phone means for an examiner.

Daniel Addai, SectraTEK LabWhat the PayPal app leaves on an iPhonehttps://lab.sectratek.com/research/lab-0011/2026-11-06T00:00:00Z

A payment app keeps its transactions, contacts and balance on a server. This article shows what the PayPal iPhone app does leave on the phone in five research images, where the public record stands, and what an examiner can and cannot say from it.

Daniel Addai, SectraTEK LabGallery rows kept when the address table is gonehttps://lab.sectratek.com/open-source/aleapp-1779/2026-11-05T00:00:00Z

ALEAPP now keeps the Samsung Gallery image rows when the location view cannot be queried, and the notes say what a blank Address means.

Daniel Addai, SectraTEK LabBlocked numbers and Android Auto rejected carshttps://lab.sectratek.com/open-source/aleapp-1780/2026-11-05T00:00:00Z

ALEAPP now reads the Android block list and the rejected-cars table of Android Auto, and reads every Android user's Android Auto database instead of the first one.

Daniel Addai, SectraTEK LabBluetooth file transfers from btopp.dbhttps://lab.sectratek.com/open-source/aleapp-1781/2026-11-05T00:00:00Z

ALEAPP now reads the Bluetooth app's transfer table, btopp.db, and this post states how few populated copies we have seen.

Daniel Addai, SectraTEK LabReading every Android user's databasehttps://lab.sectratek.com/open-source/aleapp-1782/2026-11-05T00:00:00Z

Four ALEAPP artifacts now read one database for each Android user and add an Android User column, so a Secure Folder copy no longer hides the primary user.

Daniel Addai, SectraTEK LabSamsung Smart Switch transfer historyhttps://lab.sectratek.com/open-source/aleapp-1783/2026-11-05T00:00:00Z

ALEAPP now reads the notes Samsung Smart Switch keeps about phone-to-phone transfers: sessions, data categories, the other device's lists and the backup media index.

Daniel Addai, SectraTEK LabReading the Android Health Connect storehttps://lab.sectratek.com/open-source/aleapp-1784/2026-11-05T00:00:00Z

ALEAPP now reads the Android Health Connect store: apps, preferences, permission times, records and access logs, with a plain account of which artifacts were checked on real data.

Daniel Addai, SectraTEK LabReading WhatsApp Business stores in ALEAPPhttps://lab.sectratek.com/open-source/aleapp-1785/2026-11-05T00:00:00Z

Nine ALEAPP artifacts for the WhatsApp Business package folder, built on the existing WhatsApp code, with a plain statement of what has and has not been checked on real data.

Daniel Addai, SectraTEK LabReading App Ops history databases in ALEAPPhttps://lab.sectratek.com/open-source/aleapp-1786/2026-11-05T00:00:00Z

Two ALEAPP artifacts that read the Android App Ops history databases and the rows that exist only before the write-ahead log is applied, checked row by row on five extractions.

Daniel Addai, SectraTEK LabReading SIM slot logs and network lookupshttps://lab.sectratek.com/open-source/aleapp-1787/2026-11-05T00:00:00Z

Four ALEAPP artifacts for the phone app's SIM slot log, SIM subscriptions and telephony network lookups, each reporting values as stored with the unknowns named.

Daniel Addai, SectraTEK LabReading Android bug reports in a single passhttps://lab.sectratek.com/open-source/aleapp-1795/2026-11-05T00:00:00Z

ALEAPP did not read the main text of an Android bug report. This contribution adds a one-pass reader and four tables: device facts, a section index, installed packages and package times.

Daniel Addai, SectraTEK LabUsage, settings and boot history from bug reportshttps://lab.sectratek.com/open-source/aleapp-1796/2026-11-05T00:00:00Z

A bug report holds recent app usage, ended processes, settings and boot reasons, but ALEAPP did not read them. This contribution adds five tables with stated time rules.

Daniel Addai, SectraTEK LabBug report artifact groups and invented fixture valueshttps://lab.sectratek.com/open-source/aleapp-1809/2026-11-05T00:00:00Z

Nine bug report artifacts shared one category. This change groups them by question, adds device identifiers as printed in their own table, and replaces fixture numbers that also occur in real reports.

Daniel Addai, SectraTEK LabPermissions, usage, alarms and notifications from bug reportshttps://lab.sectratek.com/open-source/aleapp-1816/2026-11-05T00:00:00Z

An Android bug report holds permissions, app ops, usage, alarms, jobs and notifications in separate dumps. ALEAPP now reads them into 15 tables, each checked against the report text.

Daniel Addai, SectraTEK LabNetwork, radio and telephony state from bug reportshttps://lab.sectratek.com/open-source/aleapp-1817/2026-11-05T00:00:00Z

A bug report records Wi-Fi, network policy, Bluetooth, NFC, USB and telephony state in separate dumps. ALEAPP now reads them into 37 tables and shows which sections a build does not print.

Daniel Addai, SectraTEK LabAccounts, power, location and media from bug reportshttps://lab.sectratek.com/open-source/aleapp-1818/2026-11-05T00:00:00Z

A bug report records accounts, sync, backup, battery, processes, location, sensors, camera, audio and display state. ALEAPP now reads them into 59 tables and says how long each window reaches.

Daniel Addai, SectraTEK LabSecurity, storage, logs and crash records from bug reportshttps://lab.sectratek.com/open-source/aleapp-1819/2026-11-05T00:00:00Z

A bug report holds device policy, lock settings, storage, the system and kernel logs, crash records and restart reasons. ALEAPP now reads them into 38 tables and shows where each log window begins.

Daniel Addai, SectraTEK LabSamsung recovery history, read in fullhttps://lab.sectratek.com/open-source/aleapp-1834/2026-11-05T00:00:00Z

ALEAPP now reads all the Samsung recovery history files, shows the options as printed, and adds a bug report artifact for a log copy kept inside an extraction.

Daniel Addai, SectraTEK LabBoot reasons and setup flags, decodedhttps://lab.sectratek.com/open-source/aleapp-1835/2026-11-05T00:00:00Z

ALEAPP now decodes the boot reason entries of the Android property store and adds a Setup Flags artifact that gathers the setup settings, their history and the setup properties.

Daniel Addai, SectraTEK LabReading URL opens from the unified loghttps://lab.sectratek.com/open-source/ileapp-2311/2026-11-05T00:00:00Z

How iLEAPP now lists the unified log lines that record a link being opened, what they say, and why the URL itself is usually missing.

Daniel Addai, SectraTEK LabReading app containers from the container manager statehttps://lab.sectratek.com/open-source/ileapp-2509/2026-11-05T00:00:00Z

How a JSON state file replaced the container manager's text logs in a recent sysdiagnose, and the three iLEAPP artifacts that read it, with their checks and limits.

Daniel Addai, SectraTEK LabCamera and microphone sessions in the unified loghttps://lab.sectratek.com/open-source/ileapp-2517/2026-11-05T00:00:00Z

How iLEAPP now lists camera and microphone capture sessions from the unified log, and why a session line is a lead and not proof of recording.

Daniel Addai, SectraTEK LabPermission cache and location state dumpshttps://lab.sectratek.com/open-source/ileapp-2518/2026-11-05T00:00:00Z

How iLEAPP now reads the permission cache and location manager statedumps in the unified log, and why a dump is a snapshot and not an event.

Daniel Addai, SectraTEK LabPer-app runtime from the BatteryUI property listshttps://lab.sectratek.com/open-source/ileapp-2521/2026-11-05T00:00:00Z

How per-app foreground and background runtime in a sysdiagnose's BatteryUI files became three iLEAPP artifacts, how the unit was tested, and why the bucket width is shown as stored.

Daniel Addai, SectraTEK LabReading ManagedSettings stores in a sysdiagnosehttps://lab.sectratek.com/open-source/ileapp-2522/2026-11-05T00:00:00Z

Two iLEAPP artifacts that read the ManagedSettings stores in a sysdiagnose: one row per stored key and a directory of stores, for two sets of store names, and how we checked them.

Daniel Addai, SectraTEK LabReading the Screen Time store databaseshttps://lab.sectratek.com/open-source/ileapp-2573/2026-11-05T00:00:00Z

Eight iLEAPP artifacts for the Screen Time and remote-management stores: settings, blueprints, installed apps, usage, change history and deleted-row entries, and how we checked them.

Daniel Addai, SectraTEK LabThree parser fixes for empty and failed reportshttps://lab.sectratek.com/open-source/ileapp-2574/2026-11-05T00:00:00Z

Three iLEAPP fixes for an artifact that failed on an out-of-range date, one that returned nothing after a key was renamed, and one that read a database sidecar, and how we checked them.

Daniel Addai, SectraTEK LabReading sysdiagnose files with five new moduleshttps://lab.sectratek.com/open-source/ileapp-2575/2026-11-05T00:00:00Z

Ten iLEAPP artifacts for associated domains, managed-configuration events, Network Extension, iCloud Drive state and process task info in a sysdiagnose, with recounts and limits.

Daniel Addai, SectraTEK LabWhat Messages keeps after edits, unsends and deleteshttps://lab.sectratek.com/open-source/ileapp-2576/2026-11-05T00:00:00Z

Eight new iLEAPP tables that read reactions, edit history, unsent parts, inline replies, Recently Deleted entries, link previews and app messages from the Messages database, and how we checked them.

Daniel Addai, SectraTEK LabLockdown Mode, passkey, shortcut and VPN log lineshttps://lab.sectratek.com/open-source/ileapp-2577/2026-11-05T00:00:00Z

Four small iLEAPP artifacts for iOS unified log lines about Lockdown Mode, passkeys, background shortcuts and VPN state, and what each line does not say.

Daniel Addai, SectraTEK LabA container state parser for the sysdiagnose frameworkhttps://lab.sectratek.com/open-source/saf-262/2026-11-05T00:00:00Z

A parser for the container manager's JSON state file in the sysdiagnose framework, now in review: how it relates to the same reader in iLEAPP and how the two projects differ.

Daniel Addai, SectraTEK LabSamsung recovery and reset trailhttps://lab.sectratek.com/research/lab-0001/2026-10-27T00:00:00Z

How a Samsung phone records a factory reset, which files hold the evidence, and how the same trail looks in a full file system extraction and in a bug report.

Daniel Addai, SectraTEK LabAndroid bug reports, category by categoryhttps://lab.sectratek.com/research/lab-0002/2026-10-27T00:00:00Z

What each part of an Android bug report holds, which questions each category can answer, and how the contents differ between Android versions and manufacturers.

Daniel Addai, SectraTEK Lab