Our Services
investigations
Elkenson investigates how software is built and operated, the companies and infrastructure it depends on, and how those relationships change. Our work connects technical evidence with regional, linguistic, legal, and commercial research to answer questions about security, access, markets, and control. An investigation can begin with a mobile app, a connected device, an operating system, or a wider software ecosystem. It may concern a tool someone relies on for sensitive work, a business trying to understand its suppliers, or a policymaker assessing how a technology is governed.
Software leaves evidence of decisions that are difficult to see from the outside. A new integration can bring another company into a service. An update can change its dependencies. A change of ownership can leave parts of the old system in place. Examining those details helps explain the relationships behind a product and the consequences of relying on it.
What we investigate
Mobile Apps & Supply chains
We conduct in-depth app investigations, examining their components, behavior, and the country context in which they are developed and used. We can investigate a single app in detail or study an app ecosystem, comparing products, developers, and historical releases.
Our work goes beyond a software bill of materials (SBOM) or an automated scan. We examine individual components to determine their origin, supplier, integration, and what they enable within the app. We check developers’ descriptions and supplier disclosures against the software itself. Code inspection and controlled testing help establish whether those descriptions match the implementation and observed behavior.
The investigation can extend to the services and devices the software connects to, including backend, communications, advertising, and payment providers. We trace their ownership and relationships through parent companies and intermediaries. Regional, linguistic, legal, and commercial research helps explain why certain features are present, how they support the operator’s activities, and the implications for users, especially when software carries those functions and relationships across borders.
-
We inspect app packages, executable code, native libraries, embedded software development kits (SDKs), permissions, and configuration files. This includes extracting domains, URLs, API routes, identifiers, and interface text, then examining how the relevant components connect. We trace functionality through the code to investigate data collection, location services, identity checks, notifications, payments, and other features relevant to the question. We then investigate each component's origin and implementation: which organization supplies it, what the underlying service offers, and which capabilities the app actually incorporates.
-
Commercial packing and obfuscation can conceal executable code or make it difficult to interpret. We investigate these protections as part of the app analysis, using unpacking, Android DEX recovery, native-library analysis, and runtime inspection to recover and examine relevant material. Where names and recognizable signatures have been altered, code-similarity analysis can help identify components and related implementations.
-
We run apps under controlled conditions to examine what happens during particular actions, permission changes, and stages of use. Network and protocol analysis can identify contacted services and examine available communications.
For questions requiring deeper access, we can use runtime instrumentation, eBPF tracing, live patching, and memory forensics to observe code execution, inspect data handled in memory, and test specific behavior. We develop custom tools and experiments where standard tools do not provide the evidence needed. Testing helps distinguish a component’s advertised capabilities, functionality present in the code, and behavior confirmed during the investigation.
-
We compare releases to trace changes in components, permissions, services, and functionality. Across larger app collections, code similarity, statistical analysis, and machine-learning methods can help identify recurring implementations, unusual changes, and patterns across an ecosystem. Individual findings can then be selected for closer technical investigation.
Methods:
View an example of an app investigation: Study Abroad e-Link…
What an investigation can support
01
Software choices in sensitive fields
Professionals in sensitive fields and government personnel may need to know whether their phones, apps, and other devices are tracking their location or activity in ways that could affect their work and personal lives. An investigation could examine how those systems handle information, which external services they communicate with, and the companies that operate them. We would assess who could access that information and what it could reveal about their movements, contacts, or daily routines. Findings could help them compare options and identify ways to reduce the exposure of confidential or sensitive information.
02
Business and market intelligence
A business may need to assess the software its staff relies on, examine a product’s dependencies after an acquisition, or understand how platform restrictions affect a regional market.
We examine software components and service connections alongside corporate records to identify the companies involved and trace changes in those relationships. This can include identifying shared suppliers across competing products, examining reliance on external infrastructure, and tracing developments in a regional market.
03
Policy and software supply chain safety
Policymakers need to understand where foreign software creates security risks or dependencies that existing oversight may miss. An investigation can establish the technical facts needed to assess those risks and decide which protections are warranted. The findings can help policymakers establish whether safeguards are reducing the risks they target, where supplier restrictions leave gaps, and what prevents independent auditing. This evidence can inform procurement requirements and ongoing scrutiny as software continues to change.
Packers, embedded services, and third-party dependencies can obscure what an app is actually doing. Read our research on how these layers affect visibility and software supply chain risk. Learn more…
Learn what’s really inside an app
Learn what’s really inside an app
Learn what’s really inside an app
Capabilities
Elkenson combines custom tools, deep technical analysis, large-scale research, and contextual analysis to address complex questions about software, technology, markets, supply chains, and risk.
Custom Built Tools
We develop custom instrumentation, collection systems, analysis pipelines, and research tools around the problem being investigated. This allows us to work with unusual software, proprietary formats, difficult datasets, and research questions that require more than standard commercial tooling.
Deep Technical Analysis
We can examine obscured or packed code, native components, runtime behavior, network communications, embedded dependencies, and other implementation details that may not be apparent from documentation or surface-level inspection. The objective is to establish what a system actually contains and does, not simply what it reports or claims.
Analysis at Scale
Elkenson builds workflows that can examine large software populations, historical releases, dependency relationships, infrastructure, and other associated datasets. This makes it possible to identify recurring technical characteristics, compare organizations or ecosystems, and distinguish isolated findings from systematic patterns.
Longitudinal & Contextual Analysis
We use historical versions, repeated observations, and contextual research to understand how dependencies, infrastructure, ownership, regulation, and market structure evolve over time. By connecting technical changes with their broader corporate, geographic, and regulatory context, we can identify significant shifts, assess whether they are temporary or persistent, and translate technical findings into evidence that supports policy, procurement, oversight, security assessment, and strategic decision-making.
Capabilities
1. purpose-built tooling
We develop custom instrumentation, collection systems, analysis pipelines, and research tools around the problem being investigated. This allows us to work with unusual software, proprietary formats, difficult datasets, and research questions that require more than standard commercial tooling.
2. Deep Technical investigation
We can examine obscured or packaged code, native components, runtime behavior, network communications, embedded dependencies, and other implementation details that may not be apparent from documentation or surface-level inspection. The objective is to establish what a system actually contains and does, not simply what it reports or claims.
3. Analysis at Scale
Elkenson builds workflows that can examine large software populations, historical releases, dependency relationships, infrastructure, and other associated datasets. This makes it possible to identify recurring technical characteristics, compare organizations or ecosystems, and distinguish isolated findings from systematic patterns.
4. Longitudinal & Contextual research
We use historical versions, repeated observations, and contextual research to understand how dependencies, infrastructure, ownership, regulation, and market structure evolve over time. By connecting technical changes with their broader corporate, geographic, and regulatory context, we can identify significant shifts, assess whether they are temporary or persistent, and translate technical findings into evidence that supports policy, procurement, oversight, security assessment, and strategic decision-making.
Let’s Get started
If you're interested in working with us, complete the form with a few details about your project, and a member of our team will get back to you as soon as possible.
We look forward to working together.
