Stalkerware Detection on iPhone and Android

Updated July 2026 · Reviewed by Quinnlan Varcoe, digital forensics examiner. If this phone may be monitored, browse and sign up from a safer device, because activity here can be visible to monitoring software. The Quick Exit button above works on every page.

What this service does

Worried there is spyware on your phone? A forensic examiner checks your iPhone or Android for stalkerware, hidden tracking apps, rogue device-management profiles, and AirTags or GPS trackers. You get a written report of what was found and what was checked. If something is found, nothing on the phone changes until you have a safety plan and decide the timing.

We examine only a device you own. Before we start, you sign a form stating that you own it. Other legal authority, such as a court order, is covered in our terms.

What makes forensic work different from an antivirus scan is the order it keeps: preserve, then examine, then report. A scanner can sometimes find monitoring software. Removing it first, or resetting the phone, usually destroys the record of when it arrived and how it was set up. The sections below walk that order.

Before you remove anything, preserve it

If you think an abusive partner installed it, plan before you remove it. Pulling stalkerware can alert the person who put it there, so for intimate-partner situations the safest first step is often a call with a domestic-violence advocate. See domestic violence digital forensics. The Coalition Against Stalkerware puts it plainly: deleting stalkerware also deletes the evidence, and removal can be detected by the person who installed it. NNEDV’s Safety Net project adds the practical corollary. Proving mobile spyware usually takes a forensic professional, and it takes the device before anyone has cleaned it.

The costliest mistake we see is well-meaning: the factory reset. It is the advice most articles give, and it is the single most evidence-destructive act available. It erases when the software arrived, how it was configured, and where it reported. If there is any chance you will want a protective order, a police report, or a custody filing, the device (or a forensic image of it) needs to be preserved un-reset first. Preservation doesn’t commit you to anything; it keeps every later option open, including the option to simply move on.

When removal is the right call and the timing is safe, the step-by-step is its own guide: how to remove stalkerware, step by step, with per-OS instructions and the preserve-first sequencing built in. After removal, privacy hardening closes the exposure that let it in.

What the records on the phone and the account can show

“Who did this?” is usually the question that matters most, for a protective order, for a police report, or just to know. An examination can show what was installed and when, and which accounts signed in. It often cannot show who was behind it, and we will not tell you it can. These are the records we look at:

It may not be an implant, but account-level access

The peer-reviewed finding most “spyware check” services skip: the Cornell Tech study of spyware in intimate partner violence found that most real-world “my phone is being monitored” cases involve no spyware app at all, especially on iPhone. They are account-level access. Someone who knows the Apple ID or Google password reads synced messages, photos, and location from their own device. Apple’s Safety Check exists precisely because the sharing surfaces are the exposure.

This changes what gets checked and what you change afterwards. No device scan, ours or anyone’s, can clear your accounts, which is why no honest examination ends with “you are safe”; it ends with what was found, what was checked, and what that does and doesn’t rule out. And if the access was account-level, what you change is your passwords and sharing settings, in a safe order, not an app. That order is walked through in what to do if someone has access to your phone.

What to hand police if you want this investigated

Officers see stalkerware rarely enough that the report often goes nowhere without preparation. What moves a case is handing over a package they can act on:

• The named product. “Monitoring software” is a shrug; “this specific app, installed on this date” is a case.
• The preserved, un-reset device (or a forensic image of it). This is the physical evidence, in the state that still proves something.
• An incident log with dates the phone was out of your hands, dates they knew things they shouldn’t have, screenshots with timestamps.
• A written examiner report tying together what was found, how, and what it means, in language a detective and a prosecutor can use.

Two companion guides cover the handoff itself: how to report digital evidence to law enforcement (who to report to, in what order) and the court-readiness checklist for digital evidence (what your documentation needs to contain).

Not every monitored phone is the same case

Most of this page assumes an intimate partner and a safety risk. That is the hardest version and the one where wrong moves cost the most, and it is why the domestic-violence resources above lead. But the same forensic questions show up in calmer postures. If the monitoring belongs to a relationship dispute headed for attorneys rather than advocates, that path is infidelity investigation coordination. It covers evidence on your own devices and accounts, coordinated lawfully for a divorce or custody matter. And if what worries you is nation-state spyware such as Pegasus and its relatives, you are looking at a different threat class from consumer stalkerware, with different checks: what Pegasus and zero-click attacks actually are.

Engagements are confidential. Some service tracks are offered at a fixed fee; complex investigations are billed hourly with a clear scope, milestone updates, and a cap agreed up front. Quinn (Founder and CEO) oversees every engagement and reviews every case before findings leave the practice; the practitioner team executes the technical work under her methodology.

• A direct line to Quinn, the founder, not a sales pipeline.
• Worked in-house by the examiner who scoped it.
• Explainable findings you can verify, with the methodology shown.

What this means for you

• Written scope before any work. You see a written scope covering deliverables, timeline, and price, and you approve it before we begin. You are never billed for work you did not authorize.
• We commit to findings, not outcomes. We tell you up front what the evidence can and cannot establish. Recovery, attribution, and prosecution are decided by banks, platforms, insurers, and courts. We produce the record they act on, and we put that distinction in writing.
• Every case is investigated, not just scanned. A credentialed examiner reviews every case before findings leave the practice. You get a documented investigation with the hashes, method and tool versions recorded, not a single automated scan and a one-line answer.
• We will tell you if you do not need us. If a free or simpler step would resolve your situation, whether a police report, an IC3 filing, or a platform's own recovery flow, we point you there first.

How an engagement begins

1. Confidential consultation. NDA-protected. 30-60 minutes. Direct conversation, no sales process.
2. Scoped engagement. Written proposal with defined deliverables and pricing, fixed fee where it applies, hourly with milestone caps for open-ended investigations.
3. Examination and findings. The report records the hash values, the method, the tools and their versions, and the exhibits. Written report you can act on.

Why this work matters

Stalkerware detection means finding monitoring software on an iPhone or Android and documenting it before anything on the phone changes. It is forensic work, not an antivirus scan. Quinn holds 9 active certifications across GIAC.