Mobile Phone Spyware: Detection, Evidence Preservation and Forensic Analysis

What warning signs can and cannot prove and how an appropriately scoped examination works

By Navid Sobbi, Founder and CEO, NSI Global

ORIGINAL PUBLICATION: 14 February 2023  REVISION COMPLETED: 15 September 2026 AEST

IMPORTANT NOTICE  PERSONAL SAFETY AND EVIDENCE PRESERVATION

If suspected surveillance may become evidence in a court, police, workplace, regulatory or other authorised matter, avoid resetting, cleaning, updating, uninstalling or extensively exploring the phone before obtaining appropriate advice. These actions can change artefacts, remove relevant data or make later findings harder to interpret.

If another person could respond dangerously when access is interrupted, protect yourself before the device. Move to a safe location and use a different trusted phone or computer to seek help. Do not confront the suspected operator through a device that may be monitored.

Australia For immediate danger call 000. Family and domestic violence support is available from 1800RESPECT on 1800 737 732.
NSI Global The Australian contact number is 1300 000 NSI (674).

Mobile phone spyware forensic analysis is a structured examination of a device and the evidence connected to it. Its purpose is to identify relevant indicators, test plausible surveillance pathways, reconstruct activity where the available artefacts permit and explain the limits of the findings.

A useful examination is broader than running a security scan. The apparent surveillance may arise from software on the handset, access to an Apple or Google account, an active session on another device, an abused management feature, location sharing or another connected system. The scope should follow the credible risk rather than assume that the answer must be inside one phone.

Mobile Spyware Can Involve More Than a Malicious Application

The term mobile spyware is often used for any unexplained access to private communications, location or activity. In technical terms, several different pathways can produce similar effects.

This distinction changes the investigation. Examining only the handset could produce an incomplete answer when the relevant access sits in a cloud account or a linked device. Conversely, unusual account activity does not by itself prove that spyware was installed on the phone.

Warning Signs Are Reasons to Investigate Rather Than Proof

The symptoms commonly associated with spyware remain useful as observations, but they are not a diagnosis. Ordinary software faults, ageing batteries, weak reception, operating system activity and legitimate applications can produce the same behaviour.

Possible observations include:

1. Rapid battery drain or a phone becoming warm when it is not being actively used;
2. Unexpectedly high mobile data consumption;
3. Unfamiliar pop ups, unexplained application behaviour or settings that appear to change;
4. Slow performance, freezing, crashes or repeated restarts;
5. Applications, administrator privileges, accessibility permissions or management profiles the user does not recognise;
6. Unexpected sign in, account recovery, location sharing or device enrolment notifications; and
7. Another person appearing to know private information, conversations or movements that they should not know.

The last two categories may provide more useful investigative context than battery performance, but neither proves a particular method of access. Record what was observed, when it occurred and who may have had physical or account access. Avoid repeatedly opening suspicious applications or changing settings to test a theory.

The First Response Depends on the Required Outcome

Protective action and evidence preservation do not always point in the same direction. Removing an application or resetting a phone may help end one form of access, but it may also remove the evidence needed to explain what happened. Leaving a device operating may preserve state, yet it may be inappropriate where a person faces immediate danger or an organisation must contain an active compromise.

Before acting, identify the principal objective:

1. Immediate personal safety requires a safe location, a separate communications channel and assistance from emergency services or a recognised support organisation.
2. Potential legal or investigative evidence requires controlled handling, documentation and early advice before the device or associated accounts are changed.
3. Corporate incident containment requires authority from legal, security or incident response leaders and coordination between mobile, identity, email, cloud and endpoint evidence.
4. Routine prevention without a suspected incident permits normal security hardening, updates and account review using current platform guidance.

NSI Global’s first response guide for suspected spyware provides the detailed safety and preservation pathway. Separate white papers explain preventive controls for Android phones and iPhones.

What a Mobile Forensic Examination May Involve

The available process depends on lawful authority, device ownership, model, operating system, security state, encryption, condition and the question the examination must answer. A sound engagement defines those matters before technical work begins.

Authority Preservation and Custody

The examiner should establish who can authorise access, what accounts or services are within scope and whether litigation, police action, employment proceedings or regulatory review is reasonably foreseeable. The device’s identifiers, condition, displayed date and time, power state and prior handling should be documented. Transfers of possession should also be recorded.

Where preservation is required, relevant account, cloud, mobile device management, identity, email or network records may need separate action. A phone does not retain every useful event indefinitely, and third party records may be governed by shorter retention periods or formal access processes.

Proportionate Acquisition and Technical Examination

An examiner selects acquisition and analysis methods that are appropriate to the device and authority available. Depending on the matter, the examination may address:

1. Installed applications and associated data;
2. Permissions, accessibility services, administrator rights and management profiles;
3. System settings, security configuration and trusted connections;
4. Account identifiers, synchronisation settings and active session evidence;
5. Operating system, application, diagnostic and crash artefacts;
6. Browser, messaging, location and communication records relevant to the agreed questions;
7. File system and database artefacts, including recoverable deleted information where available;
8. Network destinations or known indicators that can be supported by the available evidence; and
9. Relationships between events across a defensible timeline.

No forensic platform provides identical support for every device model, operating system build, application version, acquisition method or artefact parser. One tool may acquire or decode information that another cannot. NSI Global therefore uses Cellebrite and other forensic tools so the examiner can select complementary methods and, where appropriate, compare results against another tool or independent evidence source. This breadth can improve evidential coverage and validation, but it does not guarantee access, recovery or detection in every matter. Tool output must still be interpreted in context.

Forensic acquisition does not guarantee access to every source or recovery of every deleted record. Encryption, operating system protections, elapsed time, continued use, previous resetting and the behaviour of the suspected surveillance method can all limit the evidence.

Correlation Beyond the Phone

A handset may show that an account was configured or an application was present without establishing who controlled it. Account logs may reveal a suspicious session without showing how credentials were obtained. Stronger conclusions often depend on comparing several independent sources.

For a corporate or executive matter, the relevant scope may extend to identity provider logs, email, cloud services, mobile device management, endpoint telemetry, authentication records, related computers and network evidence. NSI Global’s Digital Forensic Incident Response service is the appropriate pathway when a suspected mobile compromise forms part of a wider incident.

What the Findings Can Establish

The evidence may support different levels of conclusion. A report should state the level reached rather than force every matter into a yes or no answer.

Confirmed technical finding. Relevant software, configuration, activity or account access is identified and supported by artefacts that can be explained and validated.

Indicators requiring qualification. One or more observations are consistent with unauthorised monitoring, but the available material does not exclude other explanations or establish the complete pathway.

No reportable indicators identified within scope. The methods used did not reveal a relevant device, account or network indicator during the period and sources examined. This is not a guarantee that the phone or wider environment was free from surveillance.

A well prepared report separates observed facts from technical interpretation. It also records the commissioned questions, examined sources, methods, relevant dates and limitations so another qualified person can understand how the conclusions were reached.

The Meaning of a Negative or Inconclusive Result

A negative result should be read in context. It means that the examination did not identify reportable evidence using the agreed scope, available sources and applicable methods. Residual risk may remain where:

1. The suspected software was dormant, short lived or removed before acquisition;
2. An update, reset, cleaning tool or continued use changed relevant artefacts;
3. The activity occurred through an account, session or connected device outside scope;
4. Provider, enterprise or network records were unavailable or no longer retained;
5. Encryption or platform restrictions limited acquisition;
6. The relevant indicator was not known or could not be validated at the time of examination; or
7. The suspected conduct occurred outside the period covered by the available evidence.

The next decision may be to accept the residual risk, extend the investigation, preserve additional records, monitor for recurrence or proceed to controlled recovery. The report should give the client enough information to make that choice without claiming that an unobserved threat cannot exist.

Mercenary Spyware Requires a Different Threat Assessment

Pegasus and other mercenary spyware receive significant attention, but they should not be treated as the default explanation for every unexplained phone behaviour. Apple describes mercenary spyware attacks as exceptionally well resourced and directed at a very small number of people because of who they are or what they do. Its threat notifications are intended to warn users whom Apple believes may have been individually targeted.

Apple also states that its investigations cannot provide absolute certainty and that it does not attribute a notification to a specific attacker or region. A genuine threat notification should therefore be treated seriously without converting it into a conclusion that the operator, infection method or data destination is already known.

Lockdown Mode reduces the attack surface for the small group of users exposed to highly sophisticated threats. It is a protective control rather than a forensic test. Where a device may contain evidence, the timing of updates, configuration changes or remediation should be coordinated with the safety and evidentiary objectives.

Evidence for Legal and Investigative Use

Technical accuracy alone does not make a finding suitable for proceedings. The handling record, authority, acquisition method, validation and reporting process also matter. Where expert evidence may be required, the examiner should remain independent and express only opinions supported by the material examined.

NSI Global can prepare forensic reports, affidavits and expert evidence when the engagement and findings require them. The firm’s Expert Witness Testimony service explains this role, and Navid Sobbi’s published profile identifies his qualifications and court record. Whether any particular evidence is admissible or persuasive remains a matter for the relevant court or decision maker.

How NSI Global Supports an Appropriately Scoped Examination

NSI Global’s Forensic Spyware and Malware Detection service supports eligible corporate, legal, government and otherwise authorised matters involving mobile phones, computers, tablets and related evidence sources. The engagement may include device examination, preservation, analysis of relevant artefacts, correlation with associated records and reporting proportionate to the client’s purpose.

The initial consultation should define the suspected conduct, timeframe, device ownership, people with access, actions already taken and intended use of the findings. A narrow instruction may be suitable when the concern is limited to one device. A wider scope is necessary when the risk profile includes cloud accounts, corporate systems, other endpoints, connected devices or physical surveillance concerns.

NSI Global’s engagement conditions and lawful authority requirements apply. Sensitive private matters may need to be referred or instructed through a lawyer, police officer, case officer, government agency, insurer, recognised support organisation or other authorised representative.

For an eligible matter, use a separate trusted device to contact NSI Global. Call 1300 000 NSI (674) for the Australian offices or +971 (0)4 409 6824 for Dubai.

Frequently Asked Questions

Can Battery Drain Confirm That a Phone Has Spyware?

No. Battery drain, heat, high data use and poor performance have many ordinary causes. They can be recorded as context, but confirmation requires evidence that supports a particular surveillance pathway.

Can Forensic Analysis Detect Every Type of Mobile Spyware?

No. Results depend on the device, operating system, security state, available records, time elapsed, examination scope and the behaviour of the suspected tool. A responsible examiner describes those limits.

Should I Factory Reset a Suspected Phone?

Not when the phone may be needed as evidence, unless immediate safety or authorised incident containment requires action. A reset can remove or change relevant artefacts. Obtain situation specific advice and use a separate trusted device for sensitive communications.

Can an Examination Identify Who Installed the Spyware?

Sometimes the evidence may support conclusions about access, timing, accounts or software. Attribution to a particular person requires sufficient corroborating evidence and cannot be promised from the handset alone.

Can Forensics Show Where Stolen Data Was Sent?

Network, application or account artefacts may identify a destination or service in some cases. Logs may be incomplete, encrypted, deleted or outside the device, so a destination cannot always be established.

What Does It Mean When No Spyware Is Found?

It means no reportable indicator was identified within the completed examination. It does not exclude surveillance through sources outside scope or methods that left insufficient recoverable evidence.

Sources and Further Reading

1. NSI Global guide to spyware safety and evidence preservation
2. NSI Global Forensic Spyware and Malware Detection
3. Apple threat notifications and protection against mercenary spyware
4. Apple Lockdown Mode
5. Google guidance for a compromised Google Account
6. 1800RESPECT device safety guidance
7. Australian eSafety Commissioner domestic violence guidance