What the phone said to the network, without reading a word of it

What this evidence is

A mobile traffic examination works on a preserved network capture: a recording of the connections a phone made over a stretch of time. If you already hold one, you choose the capture file in the evidence browser, and SectraTEK analyzes it without any network setup. It is referenced where it is stored and opened read-only, and SectraTEK does not upload or copy it. A SHA-256 hash of the capture is recorded in the case before analysis starts, and a final check near the end confirms it still matches.

A capture can also come from the owner. Quick Capture for iPhone includes an optional network capture step, and skipping it still produces the diagnostic file. Quick Capture is covered in a companion article in this series.

What the capture is not matters as much as what it is. It records the phone’s conversations with the network. It does not record what is on the phone, which apps are installed or what version the software is. It sees the doorway and the traffic that goes through it, not the room behind.

What we look for

When the Lab reads a capture, it asks five questions of every session. The answers to all five come from metadata, the information that surrounds a connection, because that is the information that stays readable when the content is encrypted.

Who? The destinations the phone contacted, assessed for what is known about them and compared with network intelligence. SectraTEK Intelligence includes network indicators, and every traffic capture is checked against them.

When, and how regularly? Rhythm is one of the most telling things a capture holds. A phone that checks in with the same destination at a steady interval, whether or not anyone is using it, produces a pattern that human activity rarely does. SectraTEK highlights regular check-in rhythm so that you can review it first.

How much? The volume sent and received per connection and per session, which separates a brief handshake from a sustained transfer.

What software? Encrypted connections carry fingerprints of the software that opened them. SectraTEK reads those fingerprints, and the certificates that came with them, to say what kind of software made a call.

How much could be checked? Interception checks report how many encrypted handshakes could be examined, so coverage is part of the result, and longer captures give a fuller picture of behavior.

Taken together, SectraTEK reads encrypted traffic for who, when, how regularly, how much and what software: the metadata that answers most questions, without decrypting content. The Analyzed Data screen sorts the capture into network categories such as connections, DNS activity, HTTP activity and TLS and certificates, with a count for each and a search box per category. SectraTEK also brings forward background network activity recorded in the capture, and it attributes a connection to an app only when the evidence supports it.

What the evidence shows, and what it cannot

Regular rhythm is a lead, not a verdict. The same pattern that marks a documented implant marks a weather widget. A 2019 teardown by Google’s Project Zero described one implant that asked its server for commands every 60 seconds over plain web traffic[S2]; the researchers also noted there was no visual indicator on the phone that it was running[S2]. That is exactly the kind of behavior a capture can expose and a screen cannot. But a steady check-in is also what a mail app or a messaging app does, and the 2021 measurement above shows how much ordinary background traffic a healthy phone produces[S1]. This is why SectraTEK keeps benign context in view and treats context-only matches as low.

The limits are specific, and the Lab states them in every report.

A capture covers only the period it recorded. Something that did not call out while the recorder ran leaves no trace in the capture. A longer capture gives a fuller picture, and a short one gives a snapshot.

Encrypted content stays encrypted. If a destination is unknown to the intelligence and the traffic looks ordinary, SectraTEK cannot tell the client what was said.

A traffic capture does not establish a device’s identity. Because the version of the operating system and the apps installed are not in the traffic, the checks that depend on them, such as vulnerability exposure and security configuration, need device evidence.

And a quiet capture is not a clean phone. When nothing qualifies, the network threat result reads No known threat match and shows the coverage behind it. No findings means no known indicators were found in the evidence provided. Surveillance that makes little network noise, or that waited for a moment the capture missed, can leave no mark here, and the report says so.

From findings to a report a client can act on

The AI-Dossier turns the session into something your AI can write a decision-maker’s report from. The AI-Dossier carries the whole examination to the AI tool you choose: the findings with the examiner’s dispositions, Insight leads, threat intelligence matches, exposure and security configuration results, permission correlation, the processing record and the evidence integrity history. Ratings are written as words: Critical, High, Moderate, Low and No match. A page reads the same without color.

For a network finding, the evidence is concrete: the destination, the channel it was observed on, how many times and when. The report that follows can say what is known about that destination and what ordinary activity could produce the same pattern, and name a practical next step: corroborate on the device, review the app that the owner expects to be responsible, or escalate to a deeper examination.

Evidence references stay with the AI-Dossier: every file in it is listed with its hash, and its instructions ask the report to tie each material statement to the records behind it. The AI-Dossier asks for an executive report that a senior executive, general counsel or board member can read in minutes, with the technical depth placed behind it in appendices. In SectraTEK Full, the examiner reviews and decides each finding. In SectraTEK Lite, the overview shows capture status, sessions, network records and the threat-intelligence ring, and the destinations and findings travel in the complete AI dossier.

Who it is for, and how it fits

A traffic examination fits the teams that need an answer fast and on a modest footing. SectraTEK is for individuals and organizations who want a more thorough check of a phone for compromise than an on-device scan can give, and who cannot justify a full digital forensic examination. Corporate and enterprise security teams can triage a device before deciding whether a full examination is justified, and service providers, consultancies and labs can offer a traffic check to their own customers.

It is also the natural partner of the device routes in this series. An Android full-filesystem examination shows what the phone kept about itself. A traffic capture shows what it did on the wire. Where the two agree, a finding becomes much easier to defend. Where only one speaks, the report says which, and the client knows what to ask for next.

Both editions run the same engines on the same intelligence and deliver the same verified results. Lite keeps the results. Full keeps the case.