My phone has been hacked: what to do, and how to prove it
A full forensic examination of an iPhone or Android: spyware, remote access, compromised accounts. Timestamped findings and a report you can put before a court.
The signs
What made you suspect something
None of these signs proves a compromise on its own — and their absence proves nothing either. Only the technical examination settles it.
Battery and heat
Battery life collapses without any change in how you use the phone; the device runs warm while idle.
Mobile data
Unusual consumption, outbound traffic at night, unfamiliar apps active in the background.
Accounts and sign-ins
Sign-in alerts from another device, codes you did not request, active sessions you do not recognise.
They know everything
Someone knows your movements, your messages or your appointments without you telling them.
Worth knowing: consumer apps that promise to « detect spies » see almost nothing, and some make things worse by modifying the device. A forensic examination works on a copy, not on the phone you are still using.
The examination
What we actually look for
The device is copied first, then examined on that copy. The original stays untouched — which is what makes the findings verifiable.
01
Spyware
Commercial stalkerware, hidden apps, persistent background services, abused accessibility permissions.
02
Profiles and remote management
Configuration profiles, MDM enrolment, installed certificates, jailbreak or root, an imposed VPN.
03
Accounts and sessions
Devices linked to the Apple or Google account, backups to another account, location sharing, open sessions.
04
System traces
Execution logs, installation history, network artefacts, timestamps — to reconstruct a timeline.
05
Deleted content
Erased messages, calls, photos or contacts, as far as the storage and encryption still allow.
06
The report
Findings, method, SHA-256 hashes and chain of custody. Written to be read by a judge or an insurer.
In the meantime: preserve the evidence
Avoid at all costs
- Resetting the device or restoring it to factory settings.
- Uninstalling the suspect app — it takes its traces with it.
- Updating the operating system before the copy is made.
- Changing your passwords from the suspect phone.
Do this instead
- Note the date and time of every fact you observe.
- Keep messages, screenshots and emails, unaltered.
- Secure your accounts from another, trusted device.
- Call us before touching anything if you are unsure.
How it runs
How a phone examination works
-
1
First conversation
You tell us what happened, we ask the right questions and say whether an examination makes sense.
-
2
Handing over the device
At the office in Lasne or by appointment. Written record of handover and sealing.
-
3
Copy and examination
Extraction, SHA-256 hash, then examination on the copy. Your phone is returned to you.
-
4
Report and debrief
Handover of the signed report, a spoken explanation, and support for your lawyer if needed.
Frequently asked
Frequently asked questions about phone examinations
Do you need my passcode?
For a device that belongs to you, yes: it allows a far more complete extraction. We never examine someone else's device without a legal basis.
Will I lose my data?
No. The examination is carried out on a copy. Your device is returned in the state in which you handed it over.
Can you identify who is spying on me?
Sometimes: the configuring account, timestamps, technical addresses. We write down what the traces establish, and equally what they do not.
What if the examination finds nothing?
That is a result, and it is written as one. A report concluding that there is no compromise is often exactly what you need.
Have your phone examined
First conversation free and confidential. We will tell you plainly whether an examination is useful in your case.
- Professional secrecy
- Quote before any work
- Court-registered expert