fatcousin

if you are in immediate danger

this page is not where you start. contact crisis support first — then return here for technical proof on synthetic reference data only.

  • US suicide & crisis lifeline: 988
  • US national DV hotline: 1-800-799-7233
// reference investigation

sarah-mobile-stalkerware — iOS + android proof

two synthetic scenarios for the same case type: sarah-ios (covert pairing record + supervised config profile on iPhone 14) and sarah-android (sideloaded Family Locator Pro with accessibility, notification, and device-admin abuse on Pixel 7). no real victim imagery — ASCII-style device sketches only.

what this proves

  • all eight stalkerware-sweep primary engines produce deterministic, fixture-locked output — verified by npm run check:flagship (24/24 fleet · 3 iOS + 5 android goldens).
  • every output is generated 100% locally in your browser — no upload, no server-side processing of your evidence.
  • EscrowBag on iOS pairing plists, sideloaded stalkerware permissions on android, and burner-app residue surface without uploading a survivor's device.

sarah-ios — primary engines

Synthetic iPhone 14 / iOS 17.4 scenario. An abuser had brief physical access, installed a supervised configuration profile via lockdown pairing (EscrowBag present), then unpaired. Profile persists and exfiltrates location/screen-time data to a synthetic MDM endpoint. No real victim.

sarah-android — primary engines

Synthetic Pixel 7 / Android 14 scenario. Abuser sideloaded Family Locator Pro — renamed, icon-hidden stalkerware with accessibility, notification listener, device admin, and background location exfil. Includes burner-app residue. No real victim.

build the case binder

each scenario runs its primary engines on the synthetic evidence zip and opens a self-contained html binder. build both for a complete mobile stalkerware reference packet.

sarah-ios binder

runs all 8 primary engines locally on the synthetic evidence zip · opens a self-contained html binder · no upload

sarah-android binder

runs all 8 primary engines locally on the synthetic evidence zip · opens a self-contained html binder · no upload

download the synthetic evidence

MIT-licensed, fully synthetic. no real device screenshots or victim identifiers.

sarah-ios evidence zip →sarah-ios goldens zip →sarah-android evidence zip →sarah-android goldens zip →run this kit in your browser →

iOS seed: sarah-ios:v1 · android seed: sarah-android:v1

investigation guide

safety-first methodology for advocates and survivors — crisis hotline lede, evidence volatility, and the full tool path.

read the stalkerware methodology →

after the playbook

run each primary locally — or export findings from both binders — then drop every csv/json into fatcousin-multi-tool-super-timeline-correlator. one timestamp-sorted timeline across EscrowBag iOS pairing, MDM profile install, sideloaded android permissions, and burner-app residue — still zero upload.

ready