The question "am I being watched?" comes from the person who distrusts their own phone and from the company that found a strange device on its network. The forensic work replaces suspicion with an examination, and the examination with a report.
Whoever suspects espionage wants to end it immediately. They delete the strange app, factory-reset the phone, rip out the device found behind the cabinet. Each of those actions ends the surveillance and erases the evidence of who installed it.
Digital counter-espionage reverses the order: first preserve, then examine, remove last. The examination follows the method of computer forensics: copy, hash and chain of custody. The report says whether there is surveillance, how it works, since when and, when the traces allow, who is on the other end.
The unit serves companies and, with reservations, individuals. There are three fronts: spyware, sweeps for bugs and trackers, and devices implanted in the corporate network.
Spyware (stalkerware) is the app installed without the owner's knowledge to copy messages, record calls, switch on the microphone or report location. The installer is usually someone close: spouse, former partner, business partner. In companies, suspicion falls on executives' devices when strategic information leaks.
The examination looks for hidden or disguised apps, accessibility and administrator permissions, configuration profiles and installed certificates. The report records when each item came in and what it allowed.
Not all espionage needs a program. A WhatsApp session open on another computer, a forwarding rule in the e-mail, the cloud backup accessed with a known password or shared location do the same job. The examination checks the devices linked to each account.
The device stays switched on inside a Faraday cage, an enclosure that blocks any radio signal, with internet simulated by the laboratory, and the examination watches for days every connection it tries to make. That is how one catches the program that sends data to a command server, even when it does not appear in the app list.
Installation, accounts used, data sent and destination become a dated timeline. When the trail leads to a server or an account, the report indicates which records to request from the providers to reach the person responsible.
Technical surveillance countermeasures (TSCM) is the sweep of a space for bugs, cameras and trackers. The laboratory has equipment for detecting radio-frequency signals and for locating Bluetooth trackers such as AirTag and SmartTag. The sweep covers offices, meeting rooms, homes and vehicles.
Radio-frequency detection finds the device that transmits: a bug with a mobile SIM, a camera that sends images over Wi-Fi, a transmitter hidden in an everyday object.
Coin-sized trackers, hidden in the car, the handbag or the suitcase, report where the person goes. The search locates the tracker by the signal it emits.
The sweep finds; the examination explains. The device found is preserved and examined: what it captured, where it sent it, with which SIM or account and since when. The same expert answers for both stages.
A recorder that only stores does not transmit, and radio-frequency detection does not pick it up. That is why physical inspection is part of the sweep, and the report states what was swept and with what reach.
A mini-computer hidden behind a printer, connected to the internal network and with its own mobile modem, opens a door the firewall does not see. Once the device is found, three questions matter: what it did, what it saw and who put it there.
The examination copies the device's storage and reconstructs its activity: network scans, credentials used, folders accessed, data copied. It examines the SIM (the numbers that identify the card and the line, ICCID and IMSI, plus messages and contacts), the Wi-Fi networks the device had stored and the remote access keys. These are traces that help point to who prepared the device.
The most common mistake happens in the first hour: IT unplugs the device, takes it to a desk and switches it on to "see what it is". That alters data and destroys physical traces. On finding a strange device, photograph it in place, restrict access to the location and call in the forensic expert. Switching it off or isolating it is a technical decision. The custody record is issued within 24 hours.
Companies request the examination of their own devices and premises. Individuals are also served, with screening before a proposal. The screening checks whether the devices belong to the person asking, whether they will be able to provide the passwords and what they expect from the report. Without passwords, the examination is still possible, with narrower reach and a limit stated in the report. Some suspicions are not confirmed, and the screening says so frankly.
The laboratory does not examine third parties' devices without their authorisation or a court order, does not break into accounts and does not monitor people.
The conduct the examination reveals usually has a name in the law: unauthorised access to a computing device (CP, Brazilian Penal Code, art. 154-A), stalking that invades privacy (CP, art. 147-A), constant surveillance as a form of psychological violence against women (Law 11,340/2006, the Maria da Penha Act, art. 7º, II) and environmental eavesdropping without court authorisation (Law 9,296/1996, the Brazilian Wiretapping Act, art. 10). The report describes the technical fact; the legal characterisation is for the lawyer and the court.
A person suspected spyware and room bugging on their phones and computers. They did not provide the passwords, which prevented a full extraction.
The examination carried out dynamic analysis: the devices stayed switched on inside a Faraday cage, with simulated internet, for five to ten days, to catch any connection to a command server.
The report recorded what the observation showed and stated, in a dedicated chapter, the limit imposed by the missing passwords.
A company found a mini-computer connected to its internal network, with its own 4G modem and an operating system designed for penetration testing.
The examination showed that the device had scanned more than a thousand machines and accessed shared folders with a network credential. The remote access keys and the Wi-Fi networks configured on the device, together with the examination of the SIM, were used to point to the author.
The report also recorded what was lost: IT had handled the device, and collecting fingerprints became impossible.
An executive notices that someone knows where she has been. A sweep of the car finds a Bluetooth tracker under the seat. The examination records the location and the manner of installation, preserves the device and documents the serial number, the basis for requesting from the manufacturer, through legal channels, the data of the linked account.
See also
Forensic Extraction from Mobile Phones and Devices → Computer Forensics and Digital Investigation → Digital Authorship and Subscriber Data Disclosure → Corporate Investigations and Compliance → Family and Succession → For Individuals →
Before deciding, it is worth seeing what has already come through this laboratory: cases described without identifying the parties, in the format of challenge, method and result.
The intruder's control channel was written into smart contracts. The examination decoded what he had deleted and handed the authorities concrete routes to identification.
See the case Negative proofThe official examination had concluded that he took part. The re-examination showed the links were false positives, and the accused person was cleared.
See the case