Suppose you have a stalker and this person has access to professional advice.

Suppose your Android phone was hacked by means of physical access, i.e. known unlock pattern or stolen password note, with malicious software either commercial or of unknown customisation grade.

Suppose anti-virus scans are clean.

Suppose there is no data on whether the Play Protect had been turned off or the "Downloading from untrusted source" had been enabled.

Suppose there aren't any Running Services or hidden Apps that can be identified as masked stalkerware apps with the help of Google.

Suppose the phone is not rooted. But the scope of infection of system partitions is unknown.

What would be some methods to detect the hack? For example, will forensic investigation of device images be of use? Will the Mobile Verification Toolkit be able to detect something more than the anti-virus scans? Is there anything else?

Most tutorials only list the most known DIY and/or GUI based malware detection techniques.

  • We can't offer suggestions for products or services. We can talk about techniques.
    – schroeder
    Nov 12, 2023 at 18:24
  • Please do. Or if you know any good articles etc.?
    – LiamNiam
    Nov 12, 2023 at 18:26
  • Yes, a forensic investigation of the device would be more likely to detect a sophisticated infection more than simple anti-virus.
    – schroeder
    Nov 12, 2023 at 18:27
  • Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer.
    – Community Bot
    Nov 12, 2023 at 19:52
  • So you ask us to identify an attack that is at present not public knowledge, and no software tools can detect? Sorry, we can't. It needs forensic investigation, not a question on a Q&A site.
    – vidarlo
    Nov 12, 2023 at 22:27


You must log in to answer this question.

Browse other questions tagged .