Legal Scope

Legal scope

What APEX collects by default, what needs a mandate, what it never does. The mandate reference you give is recorded in the manifest and stated in the procès-verbal. Whether a given operation is covered by your legal framework is for you and the magistrate to decide; APEX only enforces that content is not collected without an explicit reference.

By default (no mandate)

The phone's state and its apps: identifiers, accounts (names only), installed and removed apps and when, permissions and their use, processes, network connections and traffic per app, settings, users and profiles, system logs, Wi-Fi network names, Bluetooth devices, file listings (names, sizes, dates). Notifications are captured redacted (which app, when; no text).

Only with --mandate <reference>

• SMS and MMS with attachments, call log, contacts, calendar.
• WhatsApp and Signal backups found on shared storage.
• From an extraction: messaging databases and app data (WhatsApp, Signal, Telegram, Messenger, Instagram, Snapchat, Gmail, browser history, Google Maps, keyboard, wallets). See Communications and app data.
• --notification-content: notification texts, which include message previews.
• device capture: the conversation on screen (the mandate reference is required on the command line).

Only when asked

• --storage: shared storage (photos, videos, downloads, messaging media).
• --backup: Android backup of the apps that allow it, confirmed on the phone.

Never

• Wi-Fi passwords, saved passwords, authentication tokens.
• Lock-screen bypass, rooting, exploits. A locked phone goes to a lab; APEX reads the lab's extraction with import.
• Entering the phone's code: the owner or the examiner does it.
• Any network call during acquisition or analysis. Only seal goes online, and sends a hash.

The APEX agent

The agent gets only the permissions of the acquisition's scope: device state without a mandate; contacts, call log, calendar, SMS and photo positions only with --mandate; notifications only with --notification-content. It has no network permission and is removed at the end. Its install, the permissions actually granted and its removal are recorded automatically.

Changes to the phone

Enabling developer options and USB debugging, airplane mode, turning on an app's backup, confirming a backup: these are made by the examiner. Declare each with --phone-change "HH:MM what": it is recorded in the manifest and listed in the PV. What APEX itself writes on the phone is listed on device acquire.