Independent technical examination of iOS and Android devices, connected accounts and known credential exposures. Methodical, documented and discreet — with a clearly structured technical report.
Examination of unlocked, client-owned devices.
Defined scope, chain-of-custody records and a repeatable procedure.
Evidence manifest and cryptographic hash values where applicable.
Devices are shipped to Zagreb following the instructions issued on case acceptance.
Each service has a scope defined in advance, a documented methodology and a written technical report that keeps observations separate from interpretation.
Examination of available iOS or Android system, application, configuration and security artefacts: relevant diagnostic records, installed-app provenance, profiles, VPN and mobile-device-management configuration, permission state and available indicators, with incident-timeline correlation. Technical availability depends on device model, OS version, access state and acquisition method.
A review of up to 3 client-controlled accounts: authentication events, active sessions, trusted and connected devices, recovery channels, forwarding rules where relevant, MFA configuration, third-party access and OAuth grants, and location-sharing configuration. Reauthentication remains customer-guided.
Checks of up to 3 client-controlled identifiers (email addresses or phone numbers) against legally accessible known breach and credential-exposure sources, including exposed-data categories and remediation priority where that information is available. An exposure record does not in itself prove device compromise.
One device, up to 3 connected accounts and credential-exposure analysis combined into a single defined case with a consolidated report.
The examination is built in layers: device state and security configuration, system and application artefacts, diagnostic records, and access metadata for connected user accounts. Observations are then correlated into an incident timeline.
The technical availability of each layer depends on the device model, operating-system version, access state and the authorised acquisition method used. Anything that could not be established is recorded as a limitation of the examination, not as a finding.
The launch toolset includes licensed iMazing Business/CLI and Certo alongside the open-source MVT and AndroidQF. Naming a tool implies no vendor approval, endorsement, partnership or guaranteed detection.
Four stages that apply to every case, whatever the scope. The procedure is documented, repeatable and limited to devices and accounts covered by lawful authority.
We confirm lawful authority, device ownership, the requested examination scope, the relevant period and the evidence-preservation requirements.
We document intake and device state, perform the technically appropriate authorised acquisition or export, maintain chain-of-custody records, and create an evidence manifest with cryptographic hash values where relevant.
We examine available system and application artefacts, diagnostic records, configuration and profile state, account-access metadata and applicable indicators. Timestamps, event sequences and cross-source observations are correlated.
Verified findings, anomalies requiring contextual validation, inconclusive observations and limitations are presented separately, together with an incident timeline, the methodology, evidential references and proportionate remediation recommendations.
No formal laboratory accreditation is implied.
The report is the deliverable of every case. It is written in Croatian or English and delivered through a secure expiring download, with the access code sent separately.
The technical report may support consultation with counsel, the police or a court. Legal admissibility and the outcome of any proceedings cannot be guaranteed. An independent reviewer and certified translation are quoted separately.
This guidance applies from the moment you become suspicious until the device is packed. If your immediate safety requires something different, safety takes priority.
A reset permanently removes the artefacts the examination relies on.
Removing an app also removes the records that could document it.
Major updates change and discard diagnostic records.
If a password must be changed immediately, do it from a separate trusted device.
A conversation before the examination usually leads to traces being deleted and can increase the risk to you.
Shut the device down fully before packing it according to the instructions you receive when the case is accepted.
Prices are fixed and apply per case. A purchase is conditional on case acceptance; if we decline a case, everything paid is refunded in full.
Targeted artefact examination and an incident timeline for one unlocked, client-owned device.
Up to 3 client-controlled accounts: sessions, trusted devices, recovery channels and OAuth grants.
Up to 3 client-controlled identifiers checked against known breach and exposure sources.
Device, up to 3 connected accounts and credential-exposure analysis in one case.
Displayed consumer prices are final.
The assessment takes 5 to 7 minutes and is a prerequisite for every case. You see a preliminary indicator level before we ask for any contact details. The level does not change eligibility or price and does not express a probability of compromise.
Start the initial assessmentWe can establish whether verifiable technical indicators exist and document them. Their absence within the available dataset is not proof that nothing happened, and their presence does not necessarily mean malicious action. We do not give percentages or probabilities, and we do not attribute responsibility.
The agreed price remains payable because the examination itself is the service, and the report documents what was examined, what was classified as inconclusive and which limitations applied. If usable acquisition is technically impossible, we charge up to €190 for the documented attempt and refund the remainder.
Unlocked, client-owned devices. Company-owned devices only with formal written authority. Minors require guardian consent plus age-appropriate child assent, and shared or family devices require the consent of all affected adults. An NDA is available on request.
The device is shipped to Zagreb using the instructions you receive when the case is accepted, or brought in by appointment only after the assessment. We do not offer a walk-in service or remote forensic extraction. Return shipping is included where stated in the final offer.
Signum Cyber conducts specialist examinations of iOS and Android devices, connected user accounts and known credential exposures. The review covers relevant system and application artefacts, security configuration, access records and incident-timeline correlation, followed by a clearly structured technical report.
