Glossary
The words we use, in plain language.
Definitions of the terms you meet in SectraTEK and in mobile threat examinations, written for examiners and for the people who read their reports.
Terms
A to Z.
A seed set of definitions. It grows with the briefs and the knowledge base.
- AI dossier
- The complete AI dossier is built from the same verified results in both editions, ready for the AI tool or analyst you choose.
- Audit ledger
- The application audit ledger records who did what and when, and verification shows a changed record.
- Capture file
- For a mobile traffic examination an existing capture file is chosen in the evidence browser (Select a capture file), referenced where it is stored, and analyzed without any network setup. SectraTEK does not upload or copy it.
- Demonstration case
- Every picture of the application on the website is a screenshot of the running application on a demonstration case on a test device, captioned Demonstration case. None is a customer result.
- Editions
- Lite keeps the results. Full keeps the case. SectraTEK Full and SectraTEK Lite are the two editions of SectraTEK.
- Evidence in place
- Evidence is referenced where it is stored. SectraTEK opens it read-only and does not copy it into the product; if the source changed after it was added, the examination is refused.
- Extraction
- A copy of the data on a device, made by a collection tool, that an examiner can analyze without touching the phone again.
- Finding
- The examiner confirms or rejects each finding. A decision applies to the result it was made on; if the result changes the decision is shown as superseded.
- Hash
- A short fingerprint of a file. If even one byte of the file changes, its hash changes, so a matching hash shows the file is the same. A SHA-256 hash of the evidence is recorded in the case before analysis starts, and a final check near the end confirms the evidence still matches.
- Indicator
- A known sign of malicious activity, such as an app identifier, a file fingerprint, a domain or an address. A match with an indicator is a reason to look closer.
- Insight lead
- Insight leads are starting points for corroboration, never verdicts. Leads are ranked so the strongest come first; the examiner decides.
- Quick Capture
- SectraTEK Quick Capture guides you step by step through collecting the files from an iPhone, an iPad or an Android phone.
- SectraTEK Intelligence
- SectraTEK Intelligence is our curated, dated corpus, built by SectraTEK Research; category-level figures (about 648,000 indicators, 976 family labels, spyware, exploit kits and stalkerware counts, indicator types with shares) are dated and measured on the shipping build.