A client hands you an Android phone and asks a plain question: is anything on this handset acting against me? The screen shows what the phone chooses to show. The file system shows what it kept. A full-filesystem extraction is the closest a threat check gets to that second view, and it is the Android evidence on which SectraTEK has the most to read.
What this evidence is
A full-filesystem extraction is a copy of the files a phone stores, taken by your own acquisition process and handed to SectraTEK as a folder or an archive. SectraTEK reads iOS file system extractions, Android file system extractions and device backups, and it analyzes captures of mobile network traffic. This article is about the Android file system case.
The extraction is where the phone’s own record-keeping lives: the apps it installed and who installed them, the permissions it granted, how much data each app moved, what it logged and what crashed. The owner never sees most of it in a settings screen. An examiner can read all of it.
SectraTEK treats the extraction as evidence from the first second. It is referenced where it is stored, opened read-only and never copied into the product, and if the source changes after it was added, the examination is refused. A SHA-256 hash is recorded in the case before analysis starts, and a final check near the end confirms the evidence still matches. The examination runs on your own workstation and makes no outside contact, which keeps results reproducible.
Describe this figure
Two columns joined by an arrow. The left column lists six record families in an Android extraction: installed apps and installer, permissions, per-app network usage, retained logs and crash records, device settings and patch level, browsing records where present. The right column lists five things SectraTEK checks: known-bad indicators, access each app can reach, activity that fits no recorded app, vulnerability exposure and security configuration.
What we look for
The Lab does not read an extraction file by file. It reads it as a set of questions about one phone, and each question maps to a family of records.
Which apps are here, and how did they arrive? SectraTEK lists each app with its version, the channel that installed it and the times it was installed and updated, then brings it together with the sensitive capabilities it can reach. An app is ranked by the access it can reach, never by its name or popularity.
What could each app reach? Every permission record is tied to its app and shown with its recorded state, so the report can say what an app was able to reach and leave the question of whether it used that access to the examiner. That includes camera and microphone access: SectraTEK shows which apps hold it and, where the evidence records it, when it was used.
What did the apps do in the background? Where the extraction holds the phone’s usage records, SectraTEK shows which apps and services used the network in the background, not only the ones the owner was looking at.
What did the phone log? SectraTEK reads the system logs and crash reports the device retained, and reports the period they cover. Log-based checks always state which dates the evidence reaches, because a phone only keeps so much.
Where has the owner been sent? Where the extraction holds browsing records, SectraTEK reads them and states the period they cover.
How is the device set up? SectraTEK reconstructs the recoverable security and privacy configuration: screen lock, updates, developer and debugging options and privacy settings. Only settings the evidence establishes are assessed, and controls the evidence cannot establish are left out of the score rather than guessed.
Is the software itself exposed? SectraTEK compares the operating system and installed app versions recovered from the evidence with vendor security releases and known-exploitation context. Exposure and exploitation are separate fields, so a report can say precisely which is which.
Does anything match a known-bad indicator? SectraTEK compares the apps, certificates, files, domains and addresses it recovers with SectraTEK Intelligence and reports every exact match. Every indicator keeps its malware family and its campaign, so a match arrives with context.
Finally, the Insight engine looks across all of this for activity that does not fit the apps and identities the device records. The result is a ranked list of leads, each of which carries the identifiers and source paths behind it.
Our approach
How SectraTEK approaches this
SectraTEK has eight detection engines, and the Lab’s approach to an Android extraction rests on three disciplines that run through all of them.
The evidence comes first. Findings stay focused: ordinary activity is not raised, and what is raised comes with its reasons. A finding that cannot be traced back to the records behind it is not a finding the Lab will put in front of a client.
Coverage is declared. Each check reports whether it had the evidence to run. A check that could not run says so, so a gap is never mistaken for a clean result. A result with no match is reported with the coverage behind it, so you can state exactly what was compared.
The examiner decides. Leads are starting points for corroboration, never verdicts. The examiner confirms or rejects each finding, and a decision applies to the result it was made on.
Describe this figure
A five-step flow: evidence read in place with its hash recorded, examination by the engines, ranked leads with source paths, findings rated in words with the examiner deciding, and the AI-Dossier. Below, the rating words Critical, High, Moderate, Low and No match, and what the AI-Dossier carries: findings, leads, intelligence, limits and the integrity record.
What the evidence shows, and what it cannot
Android is the harder platform, and the Lab says so plainly. In the 2021 Pegasus Project, Amnesty International’s Security Lab examined 67 phones, 15 of them Android, and reported that Android does not log the kinds of information that work relied on, unlike iPhone[S1]. Three of those 15 Android phones still showed signs of targeting[S1].
That is why the limits belong in every Android report. An extraction records the phone’s state when it was taken, plus the history Android retained. It cannot show what was running afterward. Network usage records attribute data volumes to apps and networks; they do not list every remote endpoint. A saved Wi-Fi network shows configured connectivity, not that the phone was connected. Hardware-backed encryption, manufacturer changes, deleted data and gaps in the acquisition can all limit what is recovered, and SectraTEK reports a missing record as coverage, never as a negative finding.
Two further limits are worth stating in the standing words. A permission shows what an app was able to reach, not that it used it. And zero-day and memory-corruption attacks can leave few lasting traces on a device, so a result with no findings is not proof that a phone was never attacked. It means no known indicators were found in the evidence provided.
From findings to a report a client can act on
Findings only help a client if they can be read, checked and acted on. The AI-Dossier is built for that.
The AI-Dossier carries the whole examination to the AI tool you choose: the findings with the examiner’s dispositions, Insight leads, threat intelligence matches, exposure and security configuration results, permission correlation, the processing record and the evidence integrity history. Evidence references stay with the AI-Dossier: every file in it is listed with its hash, and its instructions ask the report to tie each material statement to the records behind it. The AI-Dossier opens with a readable cover that names the evidence examined, what it can and cannot establish and the key figures of the case.
Ratings are written as words: Critical is the strongest evidence and the place to start, High is strong evidence worth immediate review, Moderate is a signal worth a second look, Low is context or ordinary activity noted for completeness, and No match is a neutral result shown with the coverage behind it. A page reads the same without color.
The AI-Dossier asks for an executive report that a senior executive, general counsel or board member can read in minutes, with the technical depth placed behind it in appendices. In SectraTEK Full the examiner confirms or rejects each finding, and the decision travels with the finding into the dossier.
Who it is for, and how it fits
SectraTEK is for individuals and organizations who want a more thorough check of a phone for compromise than an on-device scan can give, and who cannot justify a full digital forensic examination. It sits between the two. Service providers, consultancies and labs can use it to deliver device-check services to their own customers, and corporate and enterprise security teams can triage a device before deciding whether a full examination is justified.
The full-filesystem extraction is one of several evidence routes in this series. A mobile traffic examination adds what the phone said to the network. An advanced Android acquisition is the route when you have the phone in hand and no extraction. An iPhone Quick Capture is the route when the owner has to collect for you. The engines and the report are the same across all of them, and the report says which evidence each statement rests on.
Both editions run the same engines on the same intelligence and deliver the same verified results. Lite keeps the results. Full keeps the case.
Sources
Facts about third parties are attributed to the publisher named in the sentence. Each marker such as [S1] opens its row here.
| Marker | Publisher and title | Published | Accessed | Address |
|---|---|---|---|---|
| [S1] | Organized Crime and Corruption Reporting Project (reporting on the Amnesty International Security Lab review) The Pegasus Project | Address not listed |
The sources were last read on . If a fact here changes, the correction carries its date.