https://lab.sectratek.com/Original research on mobile devices, published openly.https://lab.sectratek.com/research/lab-0012/https://lab.sectratek.com/research/lab-0012/What stalkerware is, how it reaches a phone, what the public record says about how common it is and how sellers have been handled, what to do if you suspect it, and what a device examiner can and cannot conclude.https://lab.sectratek.com/research/lab-0013/https://lab.sectratek.com/research/lab-0013/A plain account of the market for spying on other people, from consumer stalkerware to hack-for-hire crews to commercial spyware sold to governments, using public court, government and research records, and what a device examiner can and cannot conclude.https://lab.sectratek.com/research/lab-0014/https://lab.sectratek.com/research/lab-0014/Targeted spyware is built to be quiet. This article sets out what an ordinary person can notice, what public checking tools and notifications can and cannot show, what U.S. and international guidance advises, and what a device examiner can and cannot conclude.https://lab.sectratek.com/research/lab-0015/https://lab.sectratek.com/research/lab-0015/What the Pegasus Project list, later forensic cases and U.S. government actions show about who is targeted by commercial spyware, what a list of phone numbers can and cannot prove, and what a device examiner can and cannot conclude.https://lab.sectratek.com/research/lab-0016/https://lab.sectratek.com/research/lab-0016/One U.S. court case shows how a spyware seller runs as a business. This article follows it through the market of sellers, the U.S. rules aimed at them, what happens when a seller falls, and what a device examiner can and cannot conclude about a phone.https://lab.sectratek.com/research/lab-0017/https://lab.sectratek.com/research/lab-0017/Hacking-for-hire turns break-ins into something a paying party can order through intermediaries. This article follows one U.S. case from arrest to sentence, shows how the chain of roles works, and says what a device examiner can and cannot conclude.https://lab.sectratek.com/research/lab-0018/https://lab.sectratek.com/research/lab-0018/In 2023 a security company reported spyware on its own employees' iPhones, with traces back to 2019. This article uses the public record of that case to explain why a scan app cannot tell you a phone is clean, what forensic examination looks at, and what an examiner can and cannot conclude.https://lab.sectratek.com/research/lab-0019/https://lab.sectratek.com/research/lab-0019/The three words are used as if they meant the same thing, but they name different threats and call for different first steps. This article explains the terms, uses the public U.S. and global record for each, and says what a device examiner can and cannot conclude.https://lab.sectratek.com/research/lab-0020/https://lab.sectratek.com/research/lab-0020/What a spyware warning or a strange phone does and does not tell you, why the order of your first steps matters, who can help, and what a device examiner can and cannot conclude. Built on the public record of the El Faro case and on current guidance.https://lab.sectratek.com/research/lab-0021/https://lab.sectratek.com/research/lab-0021/Two ways a powerful hacking capability reaches the world, built in-house by a government or sold as a commercial product. The public record on Stuxnet, the leaked exploits behind WannaCry and NotPetya, Pegasus and the WhatsApp case, and what the difference means for risk and for a device examiner.https://lab.sectratek.com/research/lab-0003/https://lab.sectratek.com/research/lab-0003/The same record on an Android phone can sit in a different file, folder or shape from one Android version to the next. A reader built for one layout can return an empty table on another. Four artifacts followed across versions, with what the wrong layout returns.https://lab.sectratek.com/research/lab-0004/https://lab.sectratek.com/research/lab-0004/The same fact about a phone, such as a restart, a permission use or a reset, can sit in a full file system extraction, an Android bug report and an iOS sysdiagnose. Each source holds a different record, reaches back a different distance and uses a different clock. An explorer shows what each can and cannot say.https://lab.sectratek.com/research/lab-0005/https://lab.sectratek.com/research/lab-0005/Where a phone keeps the current state of a privacy or security setting, whether it keeps a record of the change, and why a setting that is not found is not the same as a setting that is off.https://lab.sectratek.com/research/lab-0006/https://lab.sectratek.com/research/lab-0006/One event on a phone leaves records in several databases, XML files and logs. What a link between them needs, how a finding changes when a store is missing, and an interactive linker with synthetic records.https://lab.sectratek.com/research/lab-0007/https://lab.sectratek.com/research/lab-0007/What the Zelle app is for, what the public record says about third-party misuse of the service, and what the Lab found in the app's folder on iPhone research images: a risk-check log, analytics records and settings, and no payment record.https://lab.sectratek.com/research/lab-0008/https://lab.sectratek.com/research/lab-0008/OfferUp keeps listings, chat and meet-up arrangements on its service, not on the phone. What an iPhone does hold is account and app state, search areas, recent searches, feed identifiers, unsent drafts, timing and a small cache, and what each can and cannot show.https://lab.sectratek.com/research/lab-0009/https://lab.sectratek.com/research/lab-0009/The AnyDesk app for iPhone keeps a few text, configuration and log files and no database. This article explains why that is normal for a remote-access app, what the files still tell an examiner, and what they cannot say about a session or a scam.https://lab.sectratek.com/research/lab-0010/https://lab.sectratek.com/research/lab-0010/What the Craigslist iPhone app keeps in its own container (searches, opened postings, favorites, cached postings), what it does not keep, what the public record says about misuse of online classifieds, and what a signed-out phone means for an examiner.https://lab.sectratek.com/research/lab-0011/https://lab.sectratek.com/research/lab-0011/A payment app keeps its transactions, contacts and balance on a server. This article shows what the PayPal iPhone app does leave on the phone in five research images, where the public record stands, and what an examiner can and cannot say from it.https://lab.sectratek.com/open-source/aleapp-1779/https://lab.sectratek.com/open-source/aleapp-1779/ALEAPP now keeps the Samsung Gallery image rows when the location view cannot be queried, and the notes say what a blank Address means.https://lab.sectratek.com/open-source/aleapp-1780/https://lab.sectratek.com/open-source/aleapp-1780/ALEAPP now reads the Android block list and the rejected-cars table of Android Auto, and reads every Android user's Android Auto database instead of the first one.https://lab.sectratek.com/open-source/aleapp-1781/https://lab.sectratek.com/open-source/aleapp-1781/ALEAPP now reads the Bluetooth app's transfer table, btopp.db, and this post states how few populated copies we have seen.https://lab.sectratek.com/open-source/aleapp-1782/https://lab.sectratek.com/open-source/aleapp-1782/Four ALEAPP artifacts now read one database for each Android user and add an Android User column, so a Secure Folder copy no longer hides the primary user.https://lab.sectratek.com/open-source/aleapp-1783/https://lab.sectratek.com/open-source/aleapp-1783/ALEAPP now reads the notes Samsung Smart Switch keeps about phone-to-phone transfers: sessions, data categories, the other device's lists and the backup media index.https://lab.sectratek.com/open-source/aleapp-1784/https://lab.sectratek.com/open-source/aleapp-1784/ALEAPP now reads the Android Health Connect store: apps, preferences, permission times, records and access logs, with a plain account of which artifacts were checked on real data.https://lab.sectratek.com/open-source/aleapp-1785/https://lab.sectratek.com/open-source/aleapp-1785/Nine ALEAPP artifacts for the WhatsApp Business package folder, built on the existing WhatsApp code, with a plain statement of what has and has not been checked on real data.https://lab.sectratek.com/open-source/aleapp-1786/https://lab.sectratek.com/open-source/aleapp-1786/Two ALEAPP artifacts that read the Android App Ops history databases and the rows that exist only before the write-ahead log is applied, checked row by row on five extractions.https://lab.sectratek.com/open-source/aleapp-1787/https://lab.sectratek.com/open-source/aleapp-1787/Four ALEAPP artifacts for the phone app's SIM slot log, SIM subscriptions and telephony network lookups, each reporting values as stored with the unknowns named.https://lab.sectratek.com/open-source/aleapp-1795/https://lab.sectratek.com/open-source/aleapp-1795/ALEAPP did not read the main text of an Android bug report. This contribution adds a one-pass reader and four tables: device facts, a section index, installed packages and package times.https://lab.sectratek.com/open-source/aleapp-1796/https://lab.sectratek.com/open-source/aleapp-1796/A bug report holds recent app usage, ended processes, settings and boot reasons, but ALEAPP did not read them. This contribution adds five tables with stated time rules.https://lab.sectratek.com/open-source/aleapp-1809/https://lab.sectratek.com/open-source/aleapp-1809/Nine bug report artifacts shared one category. This change groups them by question, adds device identifiers as printed in their own table, and replaces fixture numbers that also occur in real reports.https://lab.sectratek.com/open-source/aleapp-1816/https://lab.sectratek.com/open-source/aleapp-1816/An Android bug report holds permissions, app ops, usage, alarms, jobs and notifications in separate dumps. ALEAPP now reads them into 15 tables, each checked against the report text.https://lab.sectratek.com/open-source/aleapp-1817/https://lab.sectratek.com/open-source/aleapp-1817/A bug report records Wi-Fi, network policy, Bluetooth, NFC, USB and telephony state in separate dumps. ALEAPP now reads them into 37 tables and shows which sections a build does not print.https://lab.sectratek.com/open-source/aleapp-1818/https://lab.sectratek.com/open-source/aleapp-1818/A bug report records accounts, sync, backup, battery, processes, location, sensors, camera, audio and display state. ALEAPP now reads them into 59 tables and says how long each window reaches.https://lab.sectratek.com/open-source/aleapp-1819/https://lab.sectratek.com/open-source/aleapp-1819/A bug report holds device policy, lock settings, storage, the system and kernel logs, crash records and restart reasons. ALEAPP now reads them into 38 tables and shows where each log window begins.https://lab.sectratek.com/open-source/aleapp-1834/https://lab.sectratek.com/open-source/aleapp-1834/ALEAPP now reads all the Samsung recovery history files, shows the options as printed, and adds a bug report artifact for a log copy kept inside an extraction.https://lab.sectratek.com/open-source/aleapp-1835/https://lab.sectratek.com/open-source/aleapp-1835/ALEAPP now decodes the boot reason entries of the Android property store and adds a Setup Flags artifact that gathers the setup settings, their history and the setup properties.https://lab.sectratek.com/open-source/ileapp-2311/https://lab.sectratek.com/open-source/ileapp-2311/How iLEAPP now lists the unified log lines that record a link being opened, what they say, and why the URL itself is usually missing.https://lab.sectratek.com/open-source/ileapp-2509/https://lab.sectratek.com/open-source/ileapp-2509/How a JSON state file replaced the container manager's text logs in a recent sysdiagnose, and the three iLEAPP artifacts that read it, with their checks and limits.https://lab.sectratek.com/open-source/ileapp-2517/https://lab.sectratek.com/open-source/ileapp-2517/How iLEAPP now lists camera and microphone capture sessions from the unified log, and why a session line is a lead and not proof of recording.https://lab.sectratek.com/open-source/ileapp-2518/https://lab.sectratek.com/open-source/ileapp-2518/How iLEAPP now reads the permission cache and location manager statedumps in the unified log, and why a dump is a snapshot and not an event.https://lab.sectratek.com/open-source/ileapp-2521/https://lab.sectratek.com/open-source/ileapp-2521/How per-app foreground and background runtime in a sysdiagnose's BatteryUI files became three iLEAPP artifacts, how the unit was tested, and why the bucket width is shown as stored.https://lab.sectratek.com/open-source/ileapp-2522/https://lab.sectratek.com/open-source/ileapp-2522/Two iLEAPP artifacts that read the ManagedSettings stores in a sysdiagnose: one row per stored key and a directory of stores, for two sets of store names, and how we checked them.https://lab.sectratek.com/open-source/ileapp-2573/https://lab.sectratek.com/open-source/ileapp-2573/Eight iLEAPP artifacts for the Screen Time and remote-management stores: settings, blueprints, installed apps, usage, change history and deleted-row entries, and how we checked them.https://lab.sectratek.com/open-source/ileapp-2574/https://lab.sectratek.com/open-source/ileapp-2574/Three iLEAPP fixes for an artifact that failed on an out-of-range date, one that returned nothing after a key was renamed, and one that read a database sidecar, and how we checked them.https://lab.sectratek.com/open-source/ileapp-2575/https://lab.sectratek.com/open-source/ileapp-2575/Ten iLEAPP artifacts for associated domains, managed-configuration events, Network Extension, iCloud Drive state and process task info in a sysdiagnose, with recounts and limits.https://lab.sectratek.com/open-source/ileapp-2576/https://lab.sectratek.com/open-source/ileapp-2576/Eight new iLEAPP tables that read reactions, edit history, unsent parts, inline replies, Recently Deleted entries, link previews and app messages from the Messages database, and how we checked them.https://lab.sectratek.com/open-source/ileapp-2577/https://lab.sectratek.com/open-source/ileapp-2577/Four small iLEAPP artifacts for iOS unified log lines about Lockdown Mode, passkeys, background shortcuts and VPN state, and what each line does not say.https://lab.sectratek.com/open-source/saf-262/https://lab.sectratek.com/open-source/saf-262/A parser for the container manager's JSON state file in the sysdiagnose framework, now in review: how it relates to the same reader in iLEAPP and how the two projects differ.https://lab.sectratek.com/research/lab-0001/https://lab.sectratek.com/research/lab-0001/How a Samsung phone records a factory reset, which files hold the evidence, and how the same trail looks in a full file system extraction and in a bug report.https://lab.sectratek.com/research/lab-0002/https://lab.sectratek.com/research/lab-0002/What each part of an Android bug report holds, which questions each category can answer, and how the contents differ between Android versions and manufacturers.