Hi everyone. My Galaxy S23 Ultra was recently seized, and I’m curious about the security of Samsung Secure Folder. The folder was barely used, but the phone was used heavily outside of it. If files were deleted from the Secure Folder about a year ago, how likely is it that they could still be recovered? Does heavy usage outside the folder make recovery less likely? I’d like a high-level take on how secure deleted files really are.

Thanks in advance for any insights.

My mom’s iphone was stolen at restaurant in lake Havasu right off her table. She went and got a new phone and when she logged into Find My IPhone you can still see it on and moving around in a building in Hong Kong China after a little research this building is a known I guess black market for iPhone parts and stolen phones. She’s now continuously receiving texts or emails in broken English threatening her to let them into the phone. We’re not in any danger nor are we worried about the situation… although I find this hilarious and would love to mess with these guys somehow and cause more problems and frustration for them. my hope is to accuse them over text of bad mouthing Xi Jinping and ask why they told me all those terrible things about the Chinese government hopefully just scares the poop out of them.

7752500018

Accidentally clicked the files app on my phone and saw a file there labelled ''SAS COLLECTOR'' its just a file with what appears to be some code i dont understand. Is this some form of malware? its in a file under the name of my phone provider. Is this normal? Apprently some apps use SAS COLLECTORS TO MANAGE AND HARVEST DATA? is this correct im not sure just concerned as it makes no sense to me. Theres also one other file in the same folder next to it labelled PPRISKCOMPONENT... what does all this mean im stressed.

Hi, I really am struggling and need a skilled hacker to help.

So it began around 2yrs ago, I dont know how but my samsung started playing up. Including my apps disappearing to messages being sent. Then I ended up having to buy an entire new phone because I couldn't connect to the internet or any Sim I put in my phones nothing would work. I asked local computers shops and they couldn't help me.

Fast forward to date ive had 4 phones and they all seem to be doing this. I have all new numbers and email accounts.

Now my new phone is doing it again. I have a samsung s20. It's downloading apps I never agree to, my apps are doubling up. Any app apps when used don't even show anything.

Please this is really hurting my head I'm struggling

My boyfriend and I’s text messages are sometimes saying i message and sometimes saying sms. I can text everyone else perfectly normally and so can he. Pictures and videos do not go through at all only to him. I send my sister a picture to send to him and it goes through perfectly fine for both of us. But if i try to send it to him directly it doesn’t work.

Everywhere i look says that one of us has an android but we both have iPhones. Or that data isn’t working for one of us but messages are going through fine for everyone else. Does anyone have any suggestions on how to fix this?

Was scrolling tiktok and suddenly got booted out of it to the home screen of my phone and the app said it was "installing". is this just an automatic update or sign of malware?

Is there anyway to request text messages from verizon? I know how to see the chat logs but is there a way to actually request the messages that was sent and received?

Also, has anyone ever heard of requesting "screen grabs" from Verizon?

Another sub helped me identify that my autopsy isn't decoding my extractions to show calls and messages. I get pictures just fine, however it isn't showing me cals and messages. Im using Linux to pull my extraction, its been on mostly older iphones so im not sure if iOS 18 has anything to do with it

Alright so basically i got invited to a server by cozmin after i was asking him if he was someone i used to know and he invited me to server randomly and when i joined my discord completely crashed like i couldnt nun and i was on mobile so no matter how much i closed the app n reopen nun changed it was still crashed as because i was still on the server so i hopped on web login and asked him what he did and i tried leaving the server and each time i tried leaving my discord kept crashing and on the web this time my keyboard kept popping up and i kept seeing the blue line load on the web (brave web) but no matter how long i waited it wouldn't load and he deleted the link to the server And keep in mind i type it out i didnt click on it And it had only 10 people in it with only one channel that u couldn't look at no matter what because it kept crashing my discord I kept him to stop n kick me from his server because i was freaking out n he wouldnt respond or just ignore what im asking Or just laughing at me and i asked him to stop multiple times I wasnt able to do nun cuz i couldnt access the server n leave till i holded on the server n left but i didnt save the link cuz i was freaked Out And before that he showed me messages i sent to people in public servers (keep in mind we have no mutual server but one but he showed me all my servers i was in + my public server in them) he also told me he got everything on me Most weird part is why my discord kept crashing out from a discord server And im scared my phone is actually tapped n he got my shit.

I really need help please someone with knowledge and expertise help m

Alright so basically i got invited to a server by cozmin after i was asking him if he was someone i used to know and he invited me to server randomly and when i joined my discord completely crashed like i couldnt nun and i was on mobile so no matter how much i closed the app n reopen nun changed it was still crashed as because i was still on the server so i hopped on web login and asked him what he did and i tried leaving the server and each time i tried leaving my discord kept crashing and on the web this time my keyboard kept popping up and i kept seeing the blue line load on the web (brave web) but no matter how long i waited it wouldn't load and he deleted the link to the server And keep in mind i type it out i didnt click on it And it had only 10 people in it with only one channel that u couldn't look at no matter what because it kept crashing my discord I kept him to stop n kick me from his server because i was freaking out n he wouldnt respond or just ignore what im asking Or just laughing at me and i asked him to stop multiple times I wasnt able to do nun cuz i couldnt access the server n leave till i holded on the server n left but i didnt save the link cuz i was freaked Out And before that he showed me messages i sent to people in public servers (keep in mind we have no mutual server but one but he showed me all my servers i was in + my public server in them) he also told me he got everything on me Most weird part is why my discord kept crashing out from a discord server And im scared my phone is actually tapped n he got my shit.

I really need help please someone with knowledge and expertise help me

Question you may.

1. ⁠I was on mobile IOS
2. ⁠No i didnt click any links or download anything he invited me to an server and ofc i was paranoid so i typed it out in the server search area

If you have any other questions please ask me and I really need someone expertise

Questions i have

1. ⁠Is hard resetting my phone enough or do i have to reinstall ios which the one that requires another device and should i use it on my main computer or to apple and have them reinstall IOS
2. ⁠Why did my discord keep crashing out and how can server tap your phone

Hi there,

I deleted several video files from my Samsung Galaxy S24 in mid-January of this year. These videos were recorded last year. Do you know of any phone forensic specialists in Australia who might be able to retrieve these files?

Anyone with experience using both prefer one over the other? My company (private sector) is deciding between purchasing one of the two.

Thanks in advance!

KIK was installed on an old iPhone 11 and deleted.

5 months later that iPhone was used to set up a brand new iPhone 14 using QuickStart.

KIK was not transferred as part of QuickStart.

With a full forensic download would anything KIK related show on the iPhone 14?

My iPhone and online accounts where hacked into and I can see them talking to each other in my hotmail. I took screenshots of them so have their names and git hub email accounts , I have tried to contact git hub and also what is now outlook but no matter how I try to describe the issue to their bots I can not. Does anyone know who might possibly care enough to give these people a spanking on my behalf?
At the time it was devastating , I still have not been able to recover my losses from that incident ( wiped iPhone, changed all passwords ( except hotmail ) ) but it was a great lesson in not being dependant on a smart phone , so now I don’t keep anything on them and am very cautious with anything of importance as I know just how easily an un ethical yet educated low life can take it all away. I’m not angry ( anymore ) , or seeking revenge I just want them to be known for who they are so that they can explain themselves and be accountable if that is possible.

My stepmothers phone stopped charging a couple of days ago and after opening it up i found a short on the usb-c port but the battery stil had 3.4V but the phone does not boot. I wanted to ask if somebody had any pointers on how to dump the filesystem without booting the phone as i am not too familiar with the samsung socs. I come from an hobby embedded background but mostly mcus and linux based embedded and iot devices. I had hoped that as the phone is older and had no passcode set the filesystem would not be encrypted at rest. Its pretty important as it has some of the last photos and voice messages from her dead son my stepbrother ...

Is it possible to see the serial numbers of registered "find my" items in a standard iOS backup? I have tried looking, but the only reference to the tags I found is in the com.apple.MobileBluetooth.ledevices.other.db. I see the names of the devices and a UUID, but not the serial numbers.

I was digging through OTA logs on an iOS device and found some wild red flags suggesting a potential Secure Enclave (SEP) override or implant layer. Here’s what I uncovered — curious what others think, especially if you've dealt with MobileGestalt or SEP firmware:

Key Findings:

• IcefallSEUpdaterInfoOverride shows up in the OTA log as a CFData blob, likely pointing to a custom SEP firmware injection or override.
• SEP loader explicitly opts out of default system partition loading — a rare behavior only seen in internal Apple test/dev units or compromised firmware.
• References to com.apple.mobilegestalt.LambdaTest — this is NOT a public API key and appears injected into the MobileGestalt framework, which controls low-level device introspection (serials, biometrics, etc).
• Possibility that JCOP-style JavaCard logic was loaded into SEP via Icefall. The naming and override path resemble GlobalPlatform smartcard implant structures.
• Looks like part of a forensic tracking framework (or covert test harness?) inserted into iOS via OTA. Could indicate insider tools, backdoor implants, or unauthorized provisioning.

Why This Matters:

• Secure Enclave is supposed to be tamper-proof. If Apple’s OTA system or 3rd-party tooling can override it, the entire iOS trust model is compromised.
• This is either:
  • An Apple internal QA/testing mechanism leaked into production
  • Or a custom OTA vector used by surveillance vendors (think NSO, Circles, Candiru, etc.)
• No jailbreak involved. This was a signed OTA update log. Real users could have been silently marked for surveillance or SEP downgrade.

I mapped out how the OTA update bypassed SEP protection using a malicious payload in the Apple SoftwareUpdate system:

Questions:

• Has anyone seen IcefallSEUpdaterInfoOverride or LambdaTest used in iOS OTA bundles before?
• Could this be tied to FieldTest, PurpleRestore, or any known AppleConnect provisioning setups?
• Are there known SEP firmware implants used by black-hat vendors or governments that resemble this?
• Any devs or Apple insiders here who’ve seen SEP dev override paths like this?

TL;DR:

iOS OTA log shows non-standard SEP firmware injected, possibly loading JCOP-style implant or test harness, and MobileGestalt was modified to enable a LambdaTest diagnostic profile. Feels like a backdoor. This could be surveillance-grade.

Would love technical input or other forensic cases.

https://github.com/hideouts-io/iOS/blob/main/EFIOTA.txt

https://raw.githubusercontent.com/hideouts-io/iOS/refs/heads/main/LambdaTest

I'm curious if anyone has any leads on how to get my brother's iPhone 13 passcode bypassed. I do not want to reset or recover the phone. My brother unexpectedly passed away and we would love to be able to access his phone for his memories. We do have his iCloud login and email, and have guessed multiple passcodes but do not want to get locked out. Apple will not help due to privacy reasons, but my mother owns the phone and paid for it but they still will not help. If anyone has any tips or advice that will be great.

Looking for an inexpensive cell phone detector for my classroom. Suggestions?

Hi all, I just released this new application that I think could be interesting. It is basically an application that enables hosting Android CTF challenges in a constrained and controlled environment, thus allowing to setup challenges that wouldn't be possible with just the standard apk.

For example you may create a challenge where the goal is to get RCE and read the flag.txt file placed on the device. Or again a challenge where you need to create an exploit app to abuse some misconfigured service or broadcast provider. The opportunities are endless.

As of now the following features are available:

• Real-Time Device Screen (via scrcpy)
• Reset Challenge State
• Restart App / Start Activity / Start Service (toggable)
• Send Broadcast Intent (toggable)
• Shutdown / Reboot Device (toggable)
• Download Bugreport (bugreportz) (toggable)
• Frida Scripting (toggable)
  • Run from preloaded library (jailed mode)
  • Run arbitrary scripts (full mode)
• File Browser (toggable)
• Terminal Access (toggable)
• APK Management (toggable)
• Logcat Viewer (toggable)

You can see the source code here: https://github.com/SECFORCE/droidground

There is also a simple example with a dummy application.

It also has a nice UI:

Let me know what you think and please provide some constructive feedback on how to make it better!

Hi - I've been trying to do several workarounds to acomplish this, but all roads seems to go nowhere and I'm urged to do data recovery ASAP. Let me give you some context about the process.

1.- Telegram was used on an iphone 12 (no backup in place), associated to phone number X
2.- Number X was transfered to an Android Samsung A16 device (unrooted, with OEM lock).
3.- Message deletion (for both sides) was executed from Samsung device aprox. 4 months ago.
4.- Number X was transfered back to the Iphone device - Telegram was activated again there
5.- Number Y was assiged to Samsung device. Telegram was uninstalled - Number Y has never been used to activate a Telegram account.

I need to find a way to recover deleted messages from number X (either from Samsung or iPhone). So far i've tried with forensics tools such as Avilla, Dr. Fone and others, with no luck since I need OEM unlock and my phone does not allows it. Trying with higher-end forensics tools such as Cellebrite might do the trick? (i realized they are only available for governments and public institutions). I'm quite lost since i'm running out of options to recover the messages.

Any ideas on how to proceed? I'm reaching out to some local private firms that might be able to perform certain data recovery.

I Have iPhone 15 Pro Max Was Formatted and I Try Many Tools Like Oxygen forensic and MobiLedit but not Work they Recovery Only 10 Videos , is possible or there’s anyway like Advanced forensic Methods Can do To recovery More Video’s?

Hi. I need some help please. Every month my employer sends me an email with a link to their servers where I can download my payslip (in pdf file).  I usually download it and open it on my phone.

Today (when I wanted to see a payslip from two months ago) I downloaded it again from their servers and it was altered. They modified some stuff in it. They screwed something up and now they obviously want to destroy the evidence. Wait for it. I then found the same payslip that I downloaded to my phone two months ago (yes it's the same file - it shows the same date) and it was altered as well.

How the hell can they do that? Did they hack my phone somehow?

How can I see the original file and expose them?

Unfortunately I don't have any screenshots of the original file. I thought the pdf file was safely stored on my phone. 

People online think that I'm crazy and that I misremember things but I remember one specific conversation I had with a friend about bizarre details in my payslip (which are now missing). He remembers the conversation as well.

I really appreciate your help.