Mobile Sensor
The Mobile Sensor runs on the device under investigation and records what the operating system makes available to it, then hands that record to the Lab Station as evidence.
Two platforms
Apple and Google expose very different amounts of information to an installed application. Rather than describe a capability that only holds on one platform, here is the honest shape of each.
Android
Inventories applications and their permissions, records name resolution including the answers, assesses device security posture, and matches indicators on the handset itself.
iOS
Records the connections a device makes and the names it asks for, and signs that record using the device's hardware secure element. It does not inventory applications, read permissions, assess posture, or match indicators on the device.
Where the handset cannot see something, an independent network observation often can. For an iOS investigation we would generally treat Guardian observation as necessary rather than complementary — and we would rather say that than imply the two platforms deliver the same picture.
Some of these differences are Apple platform constraints that no engineering on our side would change. Others are gaps in our own iOS sensor, which is at an earlier stage than the Android one. The distinction matters when you are reasoning about what an absence of findings means, so it is stated per row.
| Observation | Android | iOS |
|---|---|---|
| Installed application inventory | Full inventory, with install source, signing details and usage timeline | Not available — iOS provides no mechanism for it |
| Permissions held by applications | Recorded, including which are granted and which are sensitive | Not available |
| Device security posture | Lock-screen state, VPN and proxy configuration, indications of rooting | Not available |
| Name resolution — queries | Recorded | Recorded |
| Name resolution — answers | Recorded | Not currently recorded — a gap in our iOS sensor, not a platform restriction |
| Network flows | Recorded, with directional byte counts | Recorded, with directional byte counts and per-flow packet counts |
| Encrypted-session fingerprinting | Recorded in the fuller collection mode | Not available |
| Per-application attribution | Partial | Not available — an Apple platform constraint |
| Indicator matching on the device | Supported, against signed indicator packages | Not available — matching happens at the Lab Station |
| Export integrity | Export carries a per-file hash manifest | Export is signed on the device using its hardware secure element |
| Unattended collection | Continues automatically once a session is started | Not supported — every session is started and stopped on the device |
Workflow
The sensor works offline on the handset and hands its findings to the Lab Station as a discrete, checkable export.
On the device under investigation, within the authorisation covering it.
Recorded locally. No network connection is required.
A record of what was observed and the conditions it was observed under, carrying the integrity material appropriate to its platform.
The Lab Station checks the export, records the result against the evidence, and correlates it against Guardian observations covering the same period.
The limits
A pilot includes Mobile Sensors alongside a Guardian and a Lab Station, so you can see how device-side and network observation correlate on real hardware.