An iPhone keeps far more about itself than it shows. Which apps it runs, which ones it trusts, how it reached the network last Tuesday, which sites it visited, and where its own software stumbled: all of it sits in the file system. When an examination calls for the deepest look, that is the evidence to start from. This is what SectraTEK finds in an iOS full-filesystem extraction, what even this evidence cannot tell you, and how a long examination becomes a report short enough to act on.
What a full file system is, and how it is obtained
A full-filesystem extraction is a copy of the files on a device, as complete as the extraction method allows. It is made with a specialist extraction process, usually in a lab and with the owner’s authorization, and it arrives as a folder or an archive. It is the evidence type that most closely resembles the phone.
SectraTEK reads iOS file system extractions where they are stored. The extraction is opened read-only and is not copied into the product, so even a large one does not need duplicating before the work begins. A SHA-256 hash of the evidence is recorded in the case before analysis starts, and a final check near the end confirms the evidence still matches. The device’s identity comes from the evidence itself, which is what lets later steps assess exposure on device evidence rather than on assumption.
What an extraction recovers depends on the device, its iOS version and the method used. SectraTEK works with what the extraction contains and says what it did not.
What the evidence shows, and what it cannot
Here is the strength: breadth. A full file system lets a single examination look at apps, permissions, configuration, usage history and browser records together, and tie them to one another. Seven of the eight detection engines read it. Only mobile traffic analysis, which belongs to network captures, does not.
Here are the limits, which we state as plainly as the strengths.
A file system records the device’s state at the moment of extraction, plus the history iOS retained. It cannot show what the phone did afterwards. Logs and usage records cover only the period the device kept, and SectraTEK’s log-based checks report that period, so you can state exactly which dates the evidence covers.
SectraTEK is also an examination for compromise, not a review of an owner’s conversations or photos. Its work is about the device’s software, its behavior and the files that arrive on it. A document it finds is listed, with its type and the conversation it belongs to, and is not read for what it says.
And the oldest limit remains. Zero-day and memory-corruption attacks can leave few lasting traces, and a result with no findings is not proof that a device was never attacked. Traces, when they exist, can be faint and old: Kaspersky reported the oldest traces of one iOS campaign it disclosed in 2023 as dating to 2019[S1].
That is why depth matters. The more history the evidence retained, the more there is to examine.
Describe this figure
Schematic. On the left, what a full file system holds: installed apps and where they came from, privacy permissions, configuration profiles and device settings, usage and network-use records, browser records, documents and attachments, and crash and system logs. On the right, the seven engines that read it and the limits: no conversation content, and state at extraction only.
What we look for
The Lab’s examination of a full file system follows the questions a careful client asks. Here is what we look for.
Apps, their origin and their access. SectraTEK brings every app together with the sensitive capabilities it can reach, including camera and microphone, shows how the app was installed where the device recorded it, and ties every permission record to its app with its recorded state. Priority follows the access an app can reach, never its name or popularity. The report keeps apart what an app was able to reach and what it did.
Configuration and posture. The examination reconstructs the recoverable security and privacy configuration: screen lock, updates, privacy settings and installed configuration profiles. Only settings the evidence establishes are assessed. Lockdown Mode and the number of trusted computers are reported as posture facts beside the configuration score, and evidence coverage is shown next to the score so the basis is always clear.
Documents and attachments. SectraTEK lists the documents and message attachments recorded in the evidence, with their types and the conversation they belong to. Where the evidence records how a file arrived, such as a message attachment or a download, the report shows that beside it. It does not open or analyze what a document says. A file that was deleted, or that the extraction did not recover, cannot be listed.
Browser records. Where the evidence contains the sites a device visited, SectraTEK compares them with SectraTEK Intelligence and states the period they cover.
Crash and system logs. The crash reports and system logs the device retained are read, and the dates they cover are reported.
Background network activity. SectraTEK shows which apps and services used the network, from the usage records in the evidence. These records attribute activity to apps. They do not give a complete list of everywhere a phone connected, and the report says so.
Known-bad indicators. Apps, certificates, files, domains and addresses are compared with SectraTEK Intelligence, and every exact match is reported with its family and context.
Vulnerability exposure. The operating system and app versions recovered from the evidence are compared with vendor security releases. CISA’s public catalog of known exploited vulnerabilities listed 95 Apple entries on October 21, 2026[S2]. Known exploitation is a narrower fact than exposure, and SectraTEK shows it as its own field, separate from exposure.
Leads and the owner’s own identifiers. Insight looks for activity that does not fit the apps and identities the device records, such as activity from apps that are no longer installed, and ranks what it finds. Findings review the apps and settings that deserve attention. An optional OSINT check, started by the examiner in an authorized examination, looks at the device owner’s own identifiers, with account presence and breach exposure always reported separately.
Our approach
How SectraTEK approaches this
The Lab’s discipline is the same for every evidence type, and a full file system tests it hardest, because there is so much to say and so much of it is ordinary. Most of what a phone does is ordinary. A good examination does not hide that.
So findings stay focused: ordinary activity is not raised, and what is raised comes with its reasons. Context-only matches are rated Low and labeled, so they inform your review without distracting from the evidence that matters.
The examination makes no outside contact, which keeps results reproducible. Each check reports whether it had the evidence to run, so a gap is never mistaken for a clean result. SectraTEK reports what it compared and what matched; the examiner draws the conclusion and records a decision on each finding: confirmed, rejected, needs corroboration or likely benign.
Describe this figure
Flow in four steps: the extraction is referenced in place and hashed; seven engines read it and each check states whether it had the evidence to run; results are rated Critical, High, Moderate, Low or No match; the AI-Dossier carries the findings, leads, intelligence matches, limits and the integrity record.
From findings to a report you can act on
The AI-Dossier carries the whole examination to the AI tool you choose: the findings with the examiner’s dispositions, Insight leads, threat intelligence matches, exposure and security configuration results, permission correlation, the processing record and the evidence integrity history. Evidence references stay with the AI-Dossier: every file in it is listed with its hash, and its instructions ask the report to tie each material statement to the records behind it. The AI-Dossier opens with a readable cover that names the evidence examined, what it can and cannot establish and the key figures of the case.
Ratings are words: Critical, the strongest evidence, where you start; High, strong evidence worth immediate review; Moderate, a signal worth a second look; Low, context or ordinary activity; and No match, a neutral result shown with its coverage. The strongest evidence is at the top of the review.
The AI-Dossier asks for an executive report that a senior executive, general counsel or board member can read in minutes, with the technical depth placed behind it in appendices. The depth of a full file system changes what the next step can be. A report may tell a client to update a phone that falls inside a published vulnerability scope. It may recommend removing an app whose access is out of proportion to its purpose. It may mark a configuration profile for review. And where a result is a Moderate or higher with a benign explanation still open, it says what would settle it. It also says what the examination could not establish, because a report that hides its limits is not one a client can rely on.
Who it is for, and how it fits
A full-filesystem examination is for labs that receive extractions and need results they can explain, consultancies that deliver device-check services to their own customers, and corporate security teams that need a defensible answer about a device that matters. It is the natural next step when a sysdiagnose or a backup leaves a lead open.
SectraTEK sits between the security apps you install on your own device and a comprehensive digital forensic examination: a more thorough check for compromise than an on-device scan, without the cost of a full examination. The same engines run on the same intelligence in SectraTEK Full and SectraTEK Lite, and the difference is the workspace around them: Lite keeps the results. Full keeps the case.
No findings means no known indicators were found in the evidence provided. With a full file system, that sentence comes with the widest possible account of what was provided.
Sources
Facts about third parties are attributed to the publisher named in the sentence. Each marker such as [S1] opens its row here.
| Marker | Publisher and title | Published | Accessed | Address |
|---|---|---|---|---|
| [S1] | Kaspersky (Securelist) Operation Triangulation: iOS devices targeted with previously unknown malware | securelist.com | ||
| [S2] | CISA Known Exploited Vulnerabilities Catalog | www.cisa.gov |
The sources were last read on . If a fact here changes, the correction carries its date.