Research
Research
Numbered reports with an evidence box, a way to reproduce each result, and a public corrections log. Filter by topic, platform, evidence source and year.
Reset and recovery. How a device records its own resets, recovery runs and region changes, and what survives.
Bug reports. What an Android bug report holds, section by section, and what it cannot show.
Topic page planned
Version compare. The same artifact across OS versions and builds: what is stable, what moves.
Topic page planned
Evidence explorer. Reading one artifact in several evidence sources, with the files in view.
Topic page planned
Privacy and configuration. What privacy settings and configuration leave behind on a device.
Topic page planned
Artifact correlation. Linking records across files so that one event reads as one event.
Topic page planned
Spyware and surveillance. Stalkerware, commercial spyware and hack-for-hire, built on the public record, and what a device examiner can and cannot conclude.
Topic page planned
- LAB-0001
Samsung recovery and reset trail
How a Samsung phone records a factory reset, which files hold the evidence, and how the same trail looks in a full file system extraction and in a bug report.
Read the article - LAB-0002
Android bug reports, category by category
What each part of an Android bug report holds, which questions each category can answer, and how the contents differ between manufacturers and Android versions.
Read the article - LAB-0003
Same artifact, different Android versions
The same record on an Android phone can sit in a different file, folder or shape from one Android version to the next. A reader built for one layout can return an empty table on another. Four artifacts followed across versions, with what the wrong layout returns.
Read the article - LAB-0004
Reading one artifact in three evidence sources
The same fact about a phone, such as a restart, a permission use or a reset, can sit in a full file system extraction, an Android bug report and an iOS sysdiagnose. Each source holds a different record, reaches back a different distance and uses a different clock. An explorer shows what each can and cannot say.
Read the article - LAB-0005
What privacy settings leave behind on a device
Where a phone keeps the current state of a privacy or security setting, whether it keeps a record of the change, and why a setting that is not found is not the same as a setting that is off.
Read the article - LAB-0006
Linking records across files
One event on a phone leaves records in several databases, XML files and logs. What a link between them needs, how a finding changes when a store is missing, and an interactive linker with synthetic records.
Read the article - LAB-0007
What the Zelle app leaves on an iPhone
What the Zelle app is for, what the public record says about third-party misuse of the service, and what the Lab found in the app's folder on iPhone research images: a risk-check log, analytics records and settings, and no payment record.
Read the article - LAB-0008
What the OfferUp app leaves on an iPhone
OfferUp keeps listings, chat and meet-up arrangements on its service, not on the phone. What an iPhone does hold is account and app state, search areas, recent searches, feed identifiers, unsent drafts, timing and a small cache, and what each can and cannot show.
Read the article - LAB-0009
What the AnyDesk app leaves on an iPhone
The AnyDesk app for iPhone keeps a few text, configuration and log files and no database. This article explains why that is normal for a remote-access app, what the files still tell an examiner, and what they cannot say about a session or a scam.
Read the article - LAB-0010
What the Craigslist app leaves on an iPhone
What the Craigslist iPhone app keeps in its own container (searches, opened postings, favorites, cached postings), what it does not keep, what the public record says about misuse of online classifieds, and what a signed-out phone means for an examiner.
Read the article - LAB-0011
What the PayPal app leaves on an iPhone
A payment app keeps its transactions, contacts and balance on a server. This article shows what the PayPal iPhone app does leave on the phone in five research images, where the public record stands, and what an examiner can and cannot say from it.
Read the article - LAB-0012
Stalkerware, explained: when the watcher is someone you know
What stalkerware is, how it reaches a phone, what the public record says about how common it is and how sellers have been handled, what to do if you suspect it, and what a device examiner can and cannot conclude.
Read the article - LAB-0013
Renting surveillance: from a monthly app to a government contract
A plain account of the market for spying on other people, from consumer stalkerware to hack-for-hire crews to commercial spyware sold to governments, using public court, government and research records, and what a device examiner can and cannot conclude.
Read the article - LAB-0014
How would you know a phone has been compromised?
Targeted spyware is built to be quiet. This article sets out what an ordinary person can notice, what public checking tools and notifications can and cannot show, what U.S. and international guidance advises, and what a device examiner can and cannot conclude.
Read the article - LAB-0015
Who spyware is aimed at: journalists, officials and the people around them
What the Pegasus Project list, later forensic cases and U.S. government actions show about who is targeted by commercial spyware, what a list of phone numbers can and cannot prove, and what a device examiner can and cannot conclude.
Read the article - LAB-0016
Commercial spyware is an industry, not a product
One U.S. court case shows how a spyware seller runs as a business. This article follows it through the market of sellers, the U.S. rules aimed at them, what happens when a seller falls, and what a device examiner can and cannot conclude about a phone.
Read the article - LAB-0017
Hackers for hire: surveillance as a paid service
Hacking-for-hire turns break-ins into something a paying party can order through intermediaries. This article follows one U.S. case from arrest to sentence, shows how the chain of roles works, and says what a device examiner can and cannot conclude.
Read the article - LAB-0018
Why antivirus cannot clear a phone: lessons from Operation Triangulation
In 2023 a security company reported spyware on its own employees' iPhones, with traces back to 2019. This article uses the public record of that case to explain why a scan app cannot tell you a phone is clean, what forensic examination looks at, and what an examiner can and cannot conclude.
Read the article - LAB-0019
Malware, spyware and stalkerware: three words, three responses
The three words are used as if they meant the same thing, but they name different threats and call for different first steps. This article explains the terms, uses the public U.S. and global record for each, and says what a device examiner can and cannot conclude.
Read the article - LAB-0020
Suspecting is not knowing
What a spyware warning or a strange phone does and does not tell you, why the order of your first steps matters, who can help, and what a device examiner can and cannot conclude. Built on the public record of the El Faro case and on current guidance.
Read the article - LAB-0021
Government cyber tools and commercial spyware
Two ways a powerful hacking capability reaches the world, built in-house by a government or sold as a commercial product. The public record on Stuxnet, the leaked exploits behind WannaCry and NotPetya, Pegasus and the WhatsApp case, and what the difference means for risk and for a device examiner.
Read the article
No research matches these filters
Clear a filter, or search with fewer words.
New articles also arrive by feed.