The client swears her ex knows everything: where she went, who she spoke to, what she wrote. She has already restored her phone twice. The feeling is still there, and the evidence of who was watching is gone.
Spyware, mirrored accounts, sessions left open on another device and hidden trackers: what is a real sign, what is myth, and how the forensic examination works.
People who feel watched want the surveillance to stop at once. They delete the strange app, restore the phone, pull the tracker out of the car. Each of these moves ends the spying and erases the evidence of who installed it.
The lawyer receives the suspicion mixed with myth. A battery that drains fast and a phone that runs hot prove nothing. And a lot of surveillance needs no software at all: a WhatsApp session left open on another computer, or a cloud backup with a known password, is enough.
The right technique reverses the order: preserve, examine, remove. The expert report says whether there is surveillance, how it works, since when and, when the traces allow it, who is on the other side. It also says when the suspicion does not hold up.
Pick as many courses as you like: they are kept and arrive ticked on the registration form.
A person suspected there was spyware on their phones and computers, but did not hand over the passwords. The devices were kept in a Faraday box, with simulated internet, for five to ten days, to catch connections to a command server. The expert report recorded what the observation showed and set out, in a chapter of its own, the limit imposed by the missing passwords.
A company found a mini computer connected to its internal network, with its own 4G modem. The examination showed it had scanned more than a thousand machines and accessed folders with a network credential. Remote access keys, Wi-Fi networks and the examination of the SIM card were used to point to the author. IT staff had handled the device, and the fingerprints were lost.
An executive realises someone knows where she has been. A sweep of the car finds a Bluetooth tracker under the seat. The examination records where and how it was installed, preserves the device and documents the serial number, the basis for asking the manufacturer, through the courts, for the linked account.
A client is sure there is spyware on her phone. The examination finds none, but it does find a messaging session open on an unknown computer, linked months earlier. The surveillance was real; the means was different.
In pairs, with the fictitious account of a client who feels watched and five "signs", participants use the Suspicion screening for 10 minutes: they classify each sign (no value, worth examining, urgent) and list what the client does until preservation. The instructor discusses the classifications.
Laws and rulings discussed
CP, arts. 147-A and 154-A (Brazilian Penal Code) · Law 11,340/2006, art. 7º, II (Maria da Penha Act) · Law 9,296/1996, art. 10 (Brazilian Interception Act) · Brazilian Federal Constitution, art. 5º, LVI · Law 15,211/2025, art. 19, § 1º (ECA Digital, Brazil's Digital Child and Adolescent Statute)
See also
Digital Counter-Espionage → Forensic Extraction from Mobile Phones and Devices → Forensic Services in Family and Succession → For Individuals → See all courses →