Overview
Why the phone is such a valuable target
Your phone holds your messages, photos, location, calendar and usually the keys to every account you have. Nobody needs to get into your home to learn about you; access to your phone, or to the account it syncs with, is enough. That rarely takes a sophisticated attack. So when we begin an inspection we look not only at apps but at cloud accounts that may be shared or compromised.
How spyware gets onto a phone
- Stalkerware apps are commercial products someone with physical access can install in minutes. On Android they typically ask for broad permissions, accessibility services or device administrator rights, and hide their icon.
- Account and backup access: if someone knows your Apple or Google password, they can see photos, message backups and location without installing anything. This is often the easiest and most common route.
- Management profiles meant for corporate device management can, if installed with bad intent, redirect your traffic or grant broad control.
There is also advanced commercial spyware aimed at specific individuals. It is rarer, usually targets high-profile people and may leave very few traces.
What we examine
The inspection has two layers. First, we go through settings and accounts with you: installed apps and their permissions, accessibility services, device administrators, profiles, unknown-source installs, devices linked to your account, open sessions, location sharing and backups. This layer often produces the most concrete findings.
Second, we analyse backups and system logs from the device with forensic tools, looking for known spyware indicators, suspicious domains and unusual processes. Every indicator is explained, including what it does not prove. High battery use on its own is not a sign of spyware; plenty of ordinary apps do the same.
Personal safety comes first
If you suspect a partner, ex-partner or relative installed spyware, think about safety before technology. Removing it or suddenly changing passwords can alert that person and escalate their behaviour. We plan the timing of any clean-up around your safety.
- Contact us from a device that person cannot access, not the phone you suspect.
- Don’t delete anything or reset the phone before the inspection; evidence may be lost.
- If you are in immediate danger, call 112. For social support and referral in Turkey, the ALO 183 line is available.
After the inspection
We explain the findings in plain language and deliver a written report. If something is found, we plan step by step how to remove it, which accounts to secure in what order, and how to set up two-factor authentication. If the finding may be needed in legal proceedings, we document before cleaning; see our digital evidence and technical reporting service.
If nothing is found we say so clearly, together with what was examined, and we note that this does not mean the device will stay clean, nor that advanced spyware always leaves traces. Regular checks can be arranged for corporate phones.
01
Warning signs
- Your messages, location or photos are known to someone else
- A management profile, device administrator or accessibility permission you don't recognise
- An app you didn't install, or one with a hidden icon
- Alerts about sign-ins to your account from an unknown device
- Data or battery use that your own usage doesn't explain
02
Process
Secure first contact
We talk from a device other than the one you suspect, and assess your concern and your personal safety.
Handover and record
The phone is handed over only by its owner or lawful user, with explicit consent, and its state is recorded.
Settings, accounts and permissions
We review profiles, device administrators, accessibility permissions, linked accounts and signed-in devices.
Forensic data analysis
Backups and system logs from the device are analysed with forensic tools against known spyware indicators.
Outcome and safe plan
We explain the findings and plan clean-up, account security and timing around your safety.
03
What you receive
- Written report of what was examined, how, and what was found
- Screenshots and technical detail for any finding
- Personal recommendations on account security, two-factor authentication and device settings
04
Limitations
- Phones cannot be inspected remotely; we need the device in hand.
- We only examine devices you own or lawfully use, with your consent; we do not examine someone else's phone.
- Advanced commercial spyware can leave very few traces; finding no indicators is not absolute proof that a device is clean.
- We do not unlock devices without the passcode, and carrier-level interception cannot be detected by inspecting the phone.
05
Questions
Can you check my phone remotely?
No. Giving remote access to a service that promises a remote check creates a new risk. A reliable inspection needs the device in hand.
Should I delete the spyware straight away?
Talk to us or another specialist first. Removing it can alert whoever installed it and destroy evidence. If there is any personal safety risk, plan the timing together.
Is a factory reset enough?
A reset removes many apps, but if a compromised account stays the same the problem can return. It also wipes evidence before anyone has looked. We recommend inspection first, then clean-up and account security.
How long does an inspection take?
It depends on the device and the amount of data. The settings and account review is usually done the same day; detailed data analysis can take longer.