SectraTEK Lab

Site map

Every public page of the Lab site.

Every public page of the Lab site.

Home

SectraTEK Lab /

About

About the Lab /about/

Accessibility

Accessibility /accessibility/

Ask

Ask the Lab /ask/
Answered questions /ask/archive/

Challenges

Challenges /challenges/
About you /challenges/about-you/
Read 56 synthetic recovery histories (DS-0004) /challenges/ds-0004/
Train and doubt a reset classifier (DS-0005) /challenges/ds-0005/
Separate stalkerware from look-alikes (DS-0006) /challenges/ds-0006/
Find the beacon in phone traffic (DS-0007) /challenges/ds-0007/
Read a Samsung reset trail (LAB-0001) /challenges/lab-0001/
Map an Android bug report (LAB-0002) /challenges/lab-0002/
Same artifact, different Android versions (LAB-0003) /challenges/lab-0003/
One question, three evidence sources (LAB-0004) /challenges/lab-0004/
What a missing setting means (LAB-0005) /challenges/lab-0005/
Link records across stores (LAB-0006) /challenges/lab-0006/

Citation

Citation guide /citation/

Contact

Contact /contact/

Corrections

Corrections /corrections/

Datasets

Datasets /datasets/
Factory-reset classifier set /datasets/factory-reset-classifier/
iPhone sysdiagnose-style set /datasets/iphone-sysdiagnose-set/
Synthetic network beacon flows /datasets/network-beacon-flows/
Synthetic Pixel-class full file system baseline /datasets/pixel-ffs-baseline/
Samsung reset and recovery: paired extractions /datasets/samsung-reset-pair/
Stalkerware permission profiles /datasets/stalkerware-permissions/
Synthetic recovery-history set /datasets/synthetic-wipe-set/

Disclosure

Disclosure policy /disclosure/

Feeds

Feeds /feeds/

Licences

Licences /licences/

Methodology

Methodology /methodology/

Open Source

Open Source /open-source/
Gallery rows kept when the address table is gone /open-source/aleapp-1779/
Blocked numbers and Android Auto rejected cars /open-source/aleapp-1780/
Bluetooth file transfers from btopp.db /open-source/aleapp-1781/
Reading every Android user's database /open-source/aleapp-1782/
Samsung Smart Switch transfer history /open-source/aleapp-1783/
Reading the Android Health Connect store /open-source/aleapp-1784/
Reading WhatsApp Business stores in ALEAPP /open-source/aleapp-1785/
Reading App Ops history databases in ALEAPP /open-source/aleapp-1786/
Reading SIM slot logs and network lookups /open-source/aleapp-1787/
Reading Android bug reports in a single pass /open-source/aleapp-1795/
Usage, settings and boot history from bug reports /open-source/aleapp-1796/
Bug report artifact groups and invented fixture values /open-source/aleapp-1809/
Permissions, usage, alarms and notifications from bug reports /open-source/aleapp-1816/
Network, radio and telephony state from bug reports /open-source/aleapp-1817/
Accounts, power, location and media from bug reports /open-source/aleapp-1818/
Security, storage, logs and crash records from bug reports /open-source/aleapp-1819/
Samsung recovery history, read in full /open-source/aleapp-1834/
Boot reasons and setup flags, decoded /open-source/aleapp-1835/
Reading URL opens from the unified log /open-source/ileapp-2311/
Reading app containers from the container manager state /open-source/ileapp-2509/
Camera and microphone sessions in the unified log /open-source/ileapp-2517/
Permission cache and location state dumps /open-source/ileapp-2518/
Per-app runtime from the BatteryUI property lists /open-source/ileapp-2521/
Reading ManagedSettings stores in a sysdiagnose /open-source/ileapp-2522/
Reading the Screen Time store databases /open-source/ileapp-2573/
Three parser fixes for empty and failed reports /open-source/ileapp-2574/
Reading sysdiagnose files with five new modules /open-source/ileapp-2575/
What Messages keeps after edits, unsends and deletes /open-source/ileapp-2576/
Lockdown Mode, passkey, shortcut and VPN log lines /open-source/ileapp-2577/
A container state parser for the sysdiagnose framework /open-source/saf-262/

Privacy

Privacy /privacy/

Research

Research /research/
Samsung recovery and reset trail /research/lab-0001/
Android bug reports, category by category /research/lab-0002/
Same artifact, different Android versions /research/lab-0003/
Reading one artifact in three evidence sources /research/lab-0004/
What privacy settings leave behind on a device /research/lab-0005/
Linking records across files /research/lab-0006/
What the Zelle app leaves on an iPhone /research/lab-0007/
What the OfferUp app leaves on an iPhone /research/lab-0008/
What the AnyDesk app leaves on an iPhone /research/lab-0009/
What the Craigslist app leaves on an iPhone /research/lab-0010/
What the PayPal app leaves on an iPhone /research/lab-0011/
Stalkerware, explained: when the watcher is someone you know /research/lab-0012/
Renting surveillance: from a monthly app to a government contract /research/lab-0013/
How would you know a phone has been compromised? /research/lab-0014/
Who spyware is aimed at: journalists, officials and the people around them /research/lab-0015/
Commercial spyware is an industry, not a product /research/lab-0016/
Hackers for hire: surveillance as a paid service /research/lab-0017/
Why antivirus cannot clear a phone: lessons from Operation Triangulation /research/lab-0018/
Malware, spyware and stalkerware: three words, three responses /research/lab-0019/
Suspecting is not knowing /research/lab-0020/
Government cyber tools and commercial spyware /research/lab-0021/
Lab Technical Reports /research/reports/
Making Silent Failures Visible: A Single-Pass Section Reader for Android Bug Reports /research/reports/lab-tr-0001/
Where Android Records Who Used What: App Ops History in Databases, XML Files and Bug Reports /research/reports/lab-tr-0003/
Informative but Individually Unreliable: An Empirical Study of Android Reset Indicators and Their Clocks /research/reports/lab-tr-0004/
Empty Is Not Absent: Silent Failure Modes in Open-Source Mobile Forensic Parsers on iOS 26 and Android 16 /research/reports/lab-tr-0006/
What iMessage Keeps After You Edit, Unsend, React or Delete: Database Evidence from Nine iPhone Databases on iOS 18 to 26 /research/reports/lab-tr-0008/
Screen Time on iOS 15 to 27: Mostly Empty Usage Tables and Counts That Change Without the Write-Ahead Log /research/reports/lab-tr-0009/
Log Compression and Archive Structure in the iOS 27.0 Sysdiagnose: An Early Observation Tested Against Ten Archives /research/reports/lab-tr-0011/
What the iOS Unified Log Says About Device Security Controls: Most Leave a Trace, Few Record a Change /research/reports/lab-tr-0012/
Residual Traces of Removed Messages in the iOS Unified Log: An Observational Study /research/reports/lab-tr-0013/
Parsing Apple Sysdiagnose, Unified Logs and Android Bug Reports: A Review of Public Research and Tools /research/reports/lab-tr-0015/
Where Device Security Settings Live on Disk: A Verified Path and Key Map for Unmanaged iPhones and Android Phones, and Pitfalls That Produce Silent Empty Reads /research/reports/lab-tr-0017/
Not Found Is Not Off: Evidence-State Accounting for Reconstructing Phone Security Settings from Full File Systems and Android Bug Reports /research/reports/lab-tr-0019/
Extracting Event Categories from Multi-Million-Line Mobile Logs with Predicate Rules: Design Rationale and a Repeatable Rule-Construction Method /research/reports/lab-tr-0020/
Retention Horizons of Volatile Stores in iOS and Android Extractions /research/reports/lab-tr-0021/
Most Ordinary Phones Trip a Naive Clock-Anomaly Check: Base Rates of Clock Anomalies in Unselected Mobile Extractions /research/reports/lab-tr-0022/
Zeroed Cells, Kept Pages, Pending Logs: What SQLite Leaves of a Deleted Row on 47 iOS and Android Devices /research/reports/lab-tr-0023/
How Much of a Full File System Extraction Is Needed? Measuring Over-Collection and Third-Party Data in iOS and Android Extractions /research/reports/lab-tr-0024/
Device-Life Boundary Indicators and the Classification of Restored Versus Native Records on Android /research/reports/lab-tr-0028/
Measuring the Answerability of Date-Bound Questions from Mobile Device Extractions /research/reports/lab-tr-0029/
Upper Bounds on Record Loss from Identifier Counters in Android Media and Message Stores /research/reports/lab-tr-0030/
The Footprint of Acquisition on an Android Phone: Footprint Classes, a Separation Rule, and Base Rates in Research Devices /research/reports/lab-tr-0031/
Resilience of Mobile Forensic Findings to the Loss of a Single Data Store /research/reports/lab-tr-0032/
Synthetic Android Phones That Match Measured Ones Feature by Feature but Not Across Stores: A Calibrated Generator and Benchmark /research/reports/lab-tr-0033/
What an Empty Result Licenses: A Sound Calculus of Absence Claims for Phone Evidence /research/reports/lab-tr-0034/
Where Removed Apps Leave Traces: A Per-Store Measurement on Android and iOS Phones /research/reports/lab-tr-0035/
The iPhone Inactivity Restart in a Research Corpus: Rare, Near 72 Hours, and Readable Only Briefly /research/reports/lab-tr-0036/
Silent Parser Failures Hide Findings and Invent Deletions Under Stated Decision Rules: A Fault-Injection Study on Synthetic Phones /research/reports/lab-tr-0037/
A Calculus of Temporal Uncertainty for Ordering Phone Timestamps over Clock Domains /research/reports/lab-tr-0038/
Can a Finding Be Traced to Its Bytes? Lineage Coverage of a Phone-Forensic Reconstruction /research/reports/lab-tr-0039/
Who Changed the Phone? When Acquirer-Induced Changes Can and Cannot Be Told Apart from the User’s Own /research/reports/lab-tr-0040/
Attributing Interior Gaps in Phone Logs to Restarts, Log Rotation and Clock Steps /research/reports/lab-tr-0041/
Reset and recovery /research/topic/reset-recovery/

Sitemap

Site map /sitemap/

Terms

Terms /terms/