Spyware that erases itself still leaves a mess
Modern mercenary spyware is built to be invisible. It runs without an icon, without a notification, often without writing anything permanent to disk at all. Several families are designed to vanish entirely when the phone reboots. If the operators are careful, the implant deletes its own working files, unregisters its own processes, and leaves the device looking untouched.
And yet Pegasus infections keep getting confirmed — years after the fact, sometimes on phones the operators believed they had cleaned. The reason is something forensic analysts call residue.
An implant can clean its own room. It cannot rewrite the building’s records.
Here is the thing that makes detection possible at all: spyware has to do something. It has to run as a process. It has to send data out. It has to survive long enough to be useful. Every one of those actions is observed and recorded by a part of the operating system that the implant does not control.
Think of someone who breaks into an office at night. They can wipe the desk, straighten the chairs, and take their coffee cup with them. What they cannot do is reach into the building’s electricity meter and remove the two hours of unexplained consumption, or edit the lift’s maintenance log, or un-trigger the motion sensor in the corridor. Those records were made about them, by systems they never touched.
Residue is that second category. Not the traces the implant left, but the traces the phone made.
Where the traces actually live
Accounting records. Both iOS and Android keep running totals of how much data each process has sent and received — iOS in a database called DataUsage.sqlite, Android through its network statistics service. These exist for mundane reasons: your phone needs them to show you which apps are eating your data plan. But an implant exfiltrating photographs and message archives generates real traffic, and that traffic gets billed to something. In several documented Pegasus cases the give-away was an unfamiliar process name sitting in that table with a suspicious volume of upload attached to it, long after every trace of the executable itself was gone.
Crash reports. Exploits are not reliable. A zero-click chain has to defeat memory protections on a device it cannot see in advance, and when it fails it tends to fail loudly — a messaging process or a web-rendering process dies in an unusual way and the operating system dutifully records the crash for Apple’s or Google’s engineers. Amnesty International’s Security Lab has repeatedly confirmed infections by finding the wreckage of failed attempts sitting in analytics logs next to the successful one.
Reboot records. This is my favourite, because it is so ordinary. When you shut an iPhone down, the system asks every running process to exit. Anything that refuses gets logged, by path, with a timestamp, in a file called Shutdown.log. In January 2024 Kaspersky published research showing that infected phones showed malicious processes stalling shutdown repeatedly — more than four such notices, against the two or three a normal phone produces — from telltale locations under /private/var/db/. The implant was hiding from everything except the routine housekeeping of turning the phone off.
Absences and timestamps. Deleting a file does not delete the fact that a directory changed. Logs that roll over leave gaps where entries should be. A sequence of events with a hole in it is itself information.
Why cleanup makes things worse, not better
There is an asymmetry here that works in the defender’s favour.
To remove residue properly, an implant would have to compromise the logging and accounting subsystems too — not just hide from them, but rewrite what they had already written. That is substantially more code, running with more privilege, touching more of the system, for longer. Every line of it is another opportunity to crash, another artefact, another thing that can be caught.
So sophisticated operators mostly don’t. They accept that residue exists and bet on nobody ever looking. For most targets that bet pays off, which is exactly why it is worth looking.
What residue proves — and what it does not
This is the part that responsible write-ups skip, so let me be direct about it.
Residue is circumstantial. A crash in a messaging process is not evidence of an attack; phones crash constantly for boring reasons. An app with high upload volume is not a spy; it might be a backup client. Individual artefacts mean very little. What means something is a pattern — the right kind of crash, at the right time, alongside a connection to infrastructure already known to belong to a spyware vendor, on the phone of someone with a plausible reason to be targeted. Confirmation almost always comes from combining several weak signals, and usually from a human analyst rather than an automated verdict.
Absence of residue proves nothing at all. The Shutdown.log method only works if the phone was rebooted while infected. Analytics logs roll over and are gone. Some implants genuinely are careful. And the newest attack of all — the one nobody has documented yet — by definition leaves traces nobody knows to look for. “We found nothing” means we found nothing. It does not mean your phone is clean, and anyone who tells you otherwise is selling something.
If you want to check your own phone
The serious tool for this is free. MVT (Mobile Verification Toolkit), built and maintained by Amnesty International’s Security Lab, is open source and examines exactly the artefacts described above against public indicators of compromise. It was the tool used to confirm many of the original Pegasus Project cases.
It is a command-line tool and it expects you to make an encrypted backup of your phone first. That puts it out of comfortable reach for a lot of the people who most need it, which is a real problem and not one we should pretend away. If you are technical, or you know someone who is, it is the honest place to start. On iOS, generating a sysdiagnose from Settings and preserving it is a small, useful habit even if you never analyse it — it captures state that will otherwise be overwritten.
Access Now’s Digital Security Helpline supports civil society, journalists and human rights defenders directly and will not charge you.
Where we fit
SireShield watches one narrow slice of this on Android, continuously, on the device.
It reads the per-app network totals Android already keeps and cross-references them against apps holding surveillance-grade access — the ability to read your screen, read your notifications, or resist being uninstalled. An app with that combination and a real volume of upload is worth a second look. There is a floor on the volume, deliberately, so ordinary syncing does not generate noise, and the evidence we record is rounded to coarse megabytes because we do not need — and do not want — a precise record of your traffic.
What it is not: a forensic laboratory. It does not analyse iOS system logs, it does not reconstruct an infection timeline, and it does not attribute anything to a vendor. It looks for one shape of anomaly and tells a human when it sees one.
And when it finds nothing, it says it found nothing. It does not tell you that you’re clean, because a phone-based tool has no way to know that. Everything above is the reason why.
SireShield is operated by CodeSire Private Limited. Access is by invitation — apply here.