What digital signs warrant a forensic investigation?

Phone always face-down with notifications muted, a new password or biometric replacing one previously known, hidden folders or dating apps disguised as utilities like Calculator+ or Vault, second-phone behavior, browser history scrubbed on phone but intact on the laptop, financial pattern shifts including unexplained cash and gift-card purchases, increased work travel with vague venues, and removal from Apple Family or Google Family location sharing. None of these alone proves anything. A pattern across several is what most divorce attorneys consider before authorizing forensic work.

What can I document myself without breaking the law?

Photos of charges on shared accounts you have legitimate access to, screenshots of public social media activity, your own observations recorded in a contemporaneous dated journal, photos of physical items found in shared spaces such as receipts and gifts, your own iCloud Family or Google Family location history of shared family devices when you have always had access, and joint phone bills showing call and text patterns. Anything that requires logging into the spouse's accounts, even with a known password, is the line you do not cross.

What should I absolutely not do?

Do not install monitoring software on the spouse's device, even one you call shared. That can violate federal and state wiretapping laws if it captures live communications. Do not log into the spouse's accounts. Do not factory-reset or clean up devices. Anti-forensic activity creates a stronger spoliation case against you than the affair would have created against them. Do not confront the spouse with the digital evidence before counsel is engaged. Once they know what you know, they will wipe it, and the case becomes harder.

Why call a divorce attorney before a forensic investigator?

Because the engagement structure that protects the evidence is attorney-driven. When the attorney retains the forensic examiner under attorney-work-product privilege, findings remain protected through discovery in a way they would not be if you retained the examiner directly. The attorney also issues preservation letters and subpoenas that compel the other side and third-party platforms to preserve and produce. Forensic work without counsel routinely produces evidence the court will not consider, which is the worst possible outcome.

What can a forensic engagement actually find?

On devices you have legal authority over, often community property in many states though it varies by jurisdiction, a forensic phone extraction can recover messages, app data, photos, location history, and deleted artifacts. Subpoena-driven discovery to platforms like Apple, Google, dating apps, and banks expands the picture. OSINT and asset tracing can corroborate. The deliverable is a written report and, if needed, expert testimony at trial authenticating the evidence under the rules of evidence. What forensics cannot do is replace counsel or guarantee a finding.

Is hiring a forensic examiner discreet?

Yes, when the engagement runs through counsel under attorney-work-product privilege. Communication routes through the attorney, billing routes through the attorney, and findings are written for counsel rather than for the client directly. That structure is the norm in family-law forensic work for exactly this reason. We do not work directly for spouses without counsel because the legal exposure on both sides is too high, and the evidence produced outside that structure is rarely useful in court.

Is Your Spouse Cheating Digitally? Forensic Signs to Look For

All articles·8 min read·April 24, 2026

Read the legal note first

Accessing a spouse's accounts without permission can violate the federal Stored Communications Act and analogous state laws — even if you live together and even if you are still married. Evidence collected through unauthorized access can be excluded at trial, and you can be sued or charged criminally. This article describes what we look at when retained, how to recognize signs in your own observable behavior, and what to preserve from your own devices and accounts. Talk to a divorce attorney before doing anything else.

Forensic signs that warrant investigation

Phone behavior changes. Phone always face-down. Notifications turned off in your presence. New password or biometric replacing one you previously knew.
App layout shifts. Hidden folders, dating apps disguised as utilities (Calculator+, Vault, KeepSafe), or "second space" / "private space" features on Samsung/OnePlus.
Two-phone behavior. A second phone, work-only phone, or pre-paid burner you have not seen before.
Browser history that does not match the laptop. Phone history scrubbed regularly while the laptop has months of history.
Financial pattern shifts. Cash withdrawals you cannot account for, Venmo to unknown handles, hotel charges during business trips, gift card purchases.
Calendar and travel changes. Increased "work travel" with vague venues, conferences that do not appear in any public registry, lost business expense receipts.
Social-media disengagement. Suddenly unfollowed, hidden, or muted on their public accounts. Stories suddenly closed to "Close Friends" only.
Apple Family / Google Family changes. They removed themselves from shared family location, shared photos, or shared payment methods.

What you can preserve from your own observation

Things you legally can document without invading their accounts:

Photos of charges on shared accounts you have legitimate access to
Screenshots of public social-media activity
Your own observations, dated, in a contemporaneous journal
Photos of physical items found in shared spaces (receipts, gifts, items not belonging to either of you)
Your own iCloud Family or Google Family location history of the shared family devices, if you've always had access
Phone bills (if joint) showing call/text patterns

What NOT to do

Do not install monitoring software. Even on a "shared" device, this violates wiretapping laws in most US states and the federal Wiretap Act if it captures live communications.
Do not log into their accounts. Even if you know the password.Authorization, not knowledge of the password, is the legal test.
Do not factory-reset or "clean up" devices. If a divorce filing comes, opposing counsel will run forensic analysis. Anti-forensic activity creates a strongerspoliation case against you than the affair would have created against them.
Do not confront them with the digital evidence. Once they know what you know, they will wipe it. Talk to your attorney first.

What a forensic engagement actually does

Once you have an attorney engaged, the path forward is usually a combination of:

Forensic phone extraction of devices you have legal authority over (community-property in many states; varies by jurisdiction)
Subpoena-driven discovery — your attorney serves preservation letters and subpoenas to platforms (Apple, Google, dating apps, banks). Spoliation between preservation letter and production becomes a sanctions case.
OSINT and asset tracing — public-record research on the third party, shared Venmo/Zelle data, hotel and airline rewards programs.
Expert testimony — at trial, a court-qualified forensic examiner authenticates the evidence under FRE 901/902.

Cases we run

Digital forensics for divorce and family law — engaged through your attorney under attorney-work-product privilege. We do not work directly for spouses without counsel; the legal exposure is too high.