An Android bug report tells you how a phone describes itself. An advanced acquisition asks more of the phone, and gets more back: a fuller picture of what is installed, a snapshot of what was running when the collection was made and, when it is part of the package, a record of which apps talked to the network. It is the step between a quick look and a full extraction, and it needs no lab. This article explains what SectraTEK reads in it, what it still cannot show, and how the examination ends in a report your client can use.
What an advanced Android acquisition is, and how it is obtained
An advanced Android acquisition is a guided, structured collection from an Android phone. Where a bug report is one diagnostic bundle, an acquisition gathers several kinds of material into one archive and records, as it goes, what it collected. It includes the embedded bug report and adds the app inventory and a snapshot of running processes.
It can reach you in two ways. An existing archive, for example one the owner collected with SectraTEK Quick Capture, can be examined straight away. Quick Capture guides the owner step by step through collecting the files from their own phone: it lists the five steps to turn on USB debugging and then detects the phone. Or an examiner can perform a live acquisition from a connected phone, after the examiner confirms authorization in the case.
Either way, the archive is referenced where it is stored, opened read-only and not copied into the product. A SHA-256 hash of the evidence is recorded in the case before analysis starts, and a final check near the end confirms the evidence still matches. Before its contents are trusted, the archive is checked against its own acquisition record. If a collection step failed on the phone, that step stays visible as a limitation instead of being reported as a success, and material from a failed step is not used.
That last point is a quiet strength. An examination built on a partly failed collection looks the same as one built on a complete collection, unless the software says otherwise. SectraTEK does.
What the evidence shows, and what it cannot
An advanced acquisition shows the installed software and its access in more detail than a bug report alone, a snapshot of the processes running at the time of collection, the system’s own logs and settings, and, when it is included, a record of network connections and the apps that owned them.
Honest limits come with each part.
The process snapshot is a single moment. An app that is not in the snapshot may still have been installed, and may have run before or after. The report treats the snapshot as evidence about the moment of collection, not about the weeks before it.
The network record, when present, is a sampled connection log, not a packet capture. It shows which apps reached which addresses, roughly when and how much. It does not contain traffic content, and a connection that opens and closes between two samples can be missed. The usage counters are the phone’s own accounting, and small or very recent transfers can be missing. We state this in the report because a reader who mistakes a sampled log for a full record will draw conclusions it cannot carry.
The acquisition is also not a full file system. There is no message content in it, SectraTEK’s document and attachment examination applies to backups and file systems rather than to this evidence, and settings that live only in the phone’s data stores are shown as not reconstructed, not as failures.
And the limit common to every device examination applies. Zero-day and memory-corruption attacks can leave few lasting traces, and a result with no findings is not proof that a device was never attacked.
The reason to look carefully at installed software is plain from the public reports. Google reported that its app scanning identified a very large number of new malicious apps outside Google Play in 2025[S1].
Kaspersky counted a rising number of banking-trojan installation packages in the same year, from its opt-in user base[S2].
Neither count says how many phones are affected. Both say that the question where did this app come from is worth asking.
Describe this figure
Schematic. On the left, what an advanced Android acquisition holds: the bug report with its logs and settings, a fuller inventory of installed apps, a snapshot of running processes, and an optional record of which apps reached the network. A full file system and message content are marked as not present. On the right, the five engines that read it.
What we look for
Here is what we look for in an advanced acquisition.
Installed apps, their origin and their access. SectraTEK brings each app together with the sensitive capabilities it can reach, including camera and microphone, and shows how the app was installed where the device recorded it. Every permission record is tied to its app, with its recorded state, and each app gets a Low, Medium or High review priority that tells you where to look first. With the fuller inventory, stock software is recognized more reliably than from a bug report alone, so the list stays on the apps that need review.
Background network activity. When the package includes the connection record, SectraTEK shows which apps reached the network and what they contacted. The check-in rhythm is highlighted so you can review it first, and SectraTEK never attributes a connection to an app without supporting evidence. Public addresses are compared with SectraTEK Intelligence, and the result states how many were compared, so a zero comes with its coverage.
Device security configuration. The recoverable configuration is reconstructed: screen lock, updates, developer and debugging options, privacy settings. Only settings the evidence establishes are assessed, and the score is read together with the evidence coverage.
Crash and system logs. The logs the phone retained are read and the dates they cover are reported.
Known-bad indicators. What the archive contains, such as apps, certificates, files, domains and addresses, is compared with SectraTEK Intelligence, and every exact match arrives with its family and context.
Vulnerability exposure. The Android release and Security Patch Level recovered from the evidence are compared with vendor security releases and known-exploitation context, with exposure and exploitation kept apart.
Five of the eight engines read this evidence. Insight turns the combined material into ranked leads, such as activity that does not fit the apps and identities the device records. Each lead carries the identifiers behind it and stays a starting point for corroboration.
Our approach
How SectraTEK approaches this
The Lab’s approach to an acquisition is to trust the record, then verify the record. The archive is checked against its own acquisition record. The device’s identity comes from the evidence, and conflicting values are kept with their provenance rather than silently overwritten. The examination makes no outside contact, which keeps results reproducible.
Each check reports whether it had the evidence to run, so a gap is never mistaken for a clean result. A tool finishing without error is not treated as complete analysis by itself: when expected coverage is missing, SectraTEK says so. SectraTEK reports what it compared and what matched; the examiner draws the conclusion and records it.
The limits are stated beside the results. A process snapshot is one moment, a sampled connection record can miss a short connection, and a result with no findings means no known indicators were found in the evidence provided. SectraTEK does not claim to detect any named threat.
Describe this figure
Flow in four steps: the archive is referenced in place, checked against its acquisition record and hashed; five engines read it and failed collection steps remain visible as limitations; results are rated Critical, High, Moderate, Low or No match; the AI-Dossier carries the findings, leads, intelligence matches, limits and the integrity record.
From findings to a report you can act on
The AI-Dossier carries the whole examination to the AI tool you choose: the findings with the examiner’s dispositions, Insight leads, threat intelligence matches, exposure and security configuration results, permission correlation, the processing record and the evidence integrity history. Evidence references stay with the AI-Dossier: every file in it is listed with its hash, and its instructions ask the report to tie each material statement to the records behind it. The AI-Dossier opens with a readable cover that names the evidence examined, what it can and cannot establish and the key figures of the case.
Ratings are words, so a page reads the same without color: Critical, the strongest evidence, where you start; High, strong evidence worth immediate review; Moderate, a signal worth a second look; Low, context or ordinary activity, noted for completeness; and No match, a neutral result shown with the coverage behind it.
The AI-Dossier asks for an executive report that a senior executive, general counsel or board member can read in minutes, with the technical depth placed behind it in appendices. The next steps follow the evidence. Remove or restrict an app whose access does not fit its purpose. Install the update a Security Patch Level calls for. Review a connection pattern that repeats without an explanation. And where a lead stays open after review, the report names what would settle it, usually a full file system, so the client sees exactly where this evidence ends.
Who it is for, and how it fits
An advanced acquisition suits labs and consultancies delivering device checks to their own customers, and corporate security teams who need more than a quick look at an Android phone but cannot, or do not need to, take it apart. Remote collection by the phone’s owner makes it the practical choice for people in other cities, and for fleets of devices that cannot be gathered in one place.
In the Android ladder it sits above the bug report and below the full file system. The same engines run on the same intelligence in SectraTEK Full and SectraTEK Lite, and the difference is the workspace around them: Lite keeps the results. Full keeps the case.
No findings means no known indicators were found in the evidence provided. For an advanced acquisition, the report tells the client what that evidence was, what each collection step produced and which steps did not.
Sources
Facts about third parties are attributed to the publisher named in the sentence. Each marker such as [S1] opens its row here.
| Marker | Publisher and title | Published | Accessed | Address |
|---|---|---|---|---|
| [S1] | Google Keeping the Google Play and Android app ecosystem safe in 2025 | blog.google | ||
| [S2] | Kaspersky (Securelist) Mobile malware evolution in 2025 | securelist.com |
The sources were last read on . If a fact here changes, the correction carries its date.