Why no app is enough on its own
The phone is a house. The app lives inside it; the cable holds the service
keys.
Picture the phone as a house, and Android as the landlady. The app is a tenant: it
sees the rooms the landlady lets it into, and it sees them every day. But some
doors Android keeps shut to every tenant, the honest ones included —
not to hide anything, but because an app able to open them would be dangerous in
anyone's hands.
A computer connected by cable is not a tenant: it is the engineer who arrives with
the service keys. It comes in through the doors that stay shut to whoever lives
inside. And behind those three doors is almost everything needed to move from
"there are signals" to "here is what it is, and here is
the proof".
That is why the app alone is not the finished product, and anyone telling you
otherwise is not telling you the truth.
First closed door
Who is talking to whom
The list of open connections is held by the heart of the system, and apps are
denied it — verified on a real phone, not inferred from a manual. Over the
cable it can be read in full.
Second closed door
The diary of what went wrong
System logs record the crashes and the errors: Android does not let an ordinary
app read them. Over the cable they open, and that is often where the trace is
still sitting.
Third closed door
The real traffic, not the bill
The app knows how much each program transmitted. Over the cable the
traffic is captured and you read who it was really talking to, certificate
in hand.
And more
The tool from Amnesty International
From the computer we run MVT, the forensic tool Amnesty International published
to look for Pegasus and Predator, against the current public indicators.