All articles·8 min read·April 24, 2026

Worried your spouse is cheating, and the signs are all on their phone?

If you are reading this, you have probably already noticed something: a phone that never leaves their hand, a password that quietly changed, an account you used to share.

This guide explains what those digital signs actually mean, what you can document yourself without crossing a legal line, and how a lawful, attorney-directed forensic investigation turns suspicion into evidence a court will consider.

Start with the access rules below, because getting this wrong can sink your case before it begins.

Forensic signs that warrant investigation

Phone behavior changes. Phone always face-down. Notifications turned off in your presence. New password or biometric replacing one you previously knew.
App layout shifts. Hidden folders, dating apps disguised as utilities (Calculator+, Vault, KeepSafe), or "second space" / "private space" features on Samsung/OnePlus.
Two-phone behavior. A second phone, work-only phone, or pre-paid burner you have not seen before.
Browser history that does not match the laptop. Phone history scrubbed regularly while the laptop has months of history.
Financial pattern shifts. Cash withdrawals you cannot account for, Venmo to unknown handles, hotel charges during business trips, gift card purchases.
Calendar and travel changes. Increased "work travel" with vague venues, conferences that do not appear in any public registry, lost business expense receipts.
Social-media disengagement. Suddenly unfollowed, hidden, or muted on their public accounts. Stories suddenly closed to "Close Friends" only.
Apple Family / Google Family changes. They removed themselves from shared family location, shared photos, or shared payment methods.

What you can preserve from your own observation

Things you legally can document without invading their accounts:

Photos of charges on shared accounts you have legitimate access to
Screenshots of public social-media activity
Your own observations, dated, in a contemporaneous journal
Photos of physical items found in shared spaces (receipts, gifts, items not belonging to either of you)
Your own iCloud Family or Google Family location history of the shared family devices, if you've always had access
Phone bills (if joint) showing call/text patterns

What NOT to do

Do not install monitoring software. Even on a "shared" device, this violates wiretapping laws in most US states and the federal Wiretap Act if it captures live communications.
Do not log into their accounts. Even if you know the password. Authorization, not knowledge of the password, is the legal test.
Do not factory-reset or "clean up" devices. If a divorce filing comes, opposing counsel will run forensic analysis. Anti-forensic activity creates a stronger spoliation case against you than the affair would have created against them.
Do not confront them with the digital evidence. Once they know what you know, they will wipe it. Talk to your attorney first.

What a forensic engagement actually does

Once you have an attorney engaged, the path forward is usually a combination of:

Forensic phone extraction of devices you have legal authority over (community-property in many states; varies by jurisdiction)
Subpoena-driven discovery means your attorney serves preservation letters and subpoenas to platforms (Apple, Google, dating apps, banks). Spoliation between preservation letter and production becomes a sanctions case.
OSINT and asset tracing covers public-record research on the third party, shared Venmo/Zelle data, hotel and airline rewards programs.
Expert testimony means that at trial, a court-qualified forensic examiner authenticates the evidence under FRE 901/902.

Cases we run

Digital forensics for divorce and family law is engaged through your attorney under attorney-work-product privilege. We do not work directly for spouses without counsel; the legal exposure is too high. When a matter needs licensed field work, we coordinate it through infidelity investigation coordination with a licensed Florida private investigator, never covert monitoring.

This article is general information, not legal advice. Talk to a licensed attorney about your specific situation.

Related services

Self-serve forensic tool

Want professional help with a discreet infidelity investigation?

$995 once. Lifetime license

Run SleuthX yourself. Every tool unlocked, no subscription.

Start in the app Book a triage call

Quinnlan Varcoe

Founder & CEO

GIAC-certified · 9 industry certifications

With operational experience across Fortune 50 security programs and the defense industrial base, Quinnlan founded SleuthX in 2022 to provide clients with the caliber of expertise typically reserved for the largest enterprises. Her work in threat intelligence and digital forensics has earned the trust of 26,000+ cybersecurity professionals who follow her analysis.

“26,000 professionals follow my work because I say what others won't — and I can back it up technically.”

Fortune 50 BackgroundDefense IndustryThreat IntelligenceDigital PrivacyIncident Response

Suspected infidelity: frequent questions

Is it legal to look through my spouse's phone or accounts?

Usually not, even if you live together and even if you are still married. Accessing a spouse's accounts without permission can violate the federal Stored Communications Act and analogous state laws. Evidence collected through unauthorized access can be excluded at trial, and the spouse who accessed it can face civil liability or criminal charges. Authorization, not knowledge of the password, is the legal test. Talk to a divorce attorney before doing anything beyond observing your shared environment.

What digital signs warrant a forensic investigation?

Phone always face-down with notifications muted, a new password or biometric replacing one previously known, hidden folders or dating apps disguised as utilities like Calculator+ or Vault, second-phone behavior, browser history scrubbed on phone but intact on the laptop, financial pattern shifts including unexplained cash and gift-card purchases, increased work travel with vague venues, and removal from Apple Family or Google Family location sharing. None of these alone proves anything. A pattern across several is what most divorce attorneys consider before authorizing forensic work.

What can I document myself without breaking the law?

Photos of charges on shared accounts you have legitimate access to, screenshots of public social media activity, your own observations recorded in a contemporaneous dated journal, photos of physical items found in shared spaces such as receipts and gifts, your own iCloud Family or Google Family location history of shared family devices when you have always had access, and joint phone bills showing call and text patterns. Anything that requires logging into the spouse's accounts, even with a known password, is the line you do not cross.

What should I absolutely not do?

Do not install monitoring software on the spouse's device, even one you call shared. That can violate federal and state wiretapping laws if it captures live communications. Do not log into the spouse's accounts. Do not factory-reset or clean up devices. Anti-forensic activity creates a stronger spoliation case against you than the affair would have created against them. Do not confront the spouse with the digital evidence before counsel is engaged. Once they know what you know, they will wipe it, and the case becomes harder.

Why call a divorce attorney before a forensic investigator?

Because the engagement structure that protects the evidence is attorney-driven. When the attorney retains the forensic examiner under attorney-work-product privilege, findings remain protected through discovery in a way they would not be if you retained the examiner directly. The attorney also issues preservation letters and subpoenas that compel the other side and third-party platforms to preserve and produce. Forensic work without counsel routinely produces evidence the court will not consider, which is the worst possible outcome.

What can a forensic engagement actually find?

On devices you have legal authority over, often community property in many states though it varies by jurisdiction, a forensic phone extraction can recover messages, app data, photos, location history, and deleted artifacts. Subpoena-driven discovery to platforms like Apple, Google, dating apps, and banks expands the picture. OSINT and asset tracing can corroborate. The deliverable is a written report and, if needed, expert testimony at trial authenticating the evidence under the rules of evidence. What forensics cannot do is replace counsel or guarantee a finding.

Is hiring a forensic examiner discreet?

Yes, when the engagement runs through counsel under attorney-work-product privilege. Communication routes through the attorney, billing routes through the attorney, and findings are written for counsel rather than for the client directly. That structure is the norm in family-law forensic work for exactly this reason. We do not work directly for spouses without counsel because the legal exposure on both sides is too high, and the evidence produced outside that structure is rarely useful in court.