Your Apple account
is being watched.
Now you can watch back.

The SHA-256 Vault Daemon is included in the package. For users requiring a complete, unbreakable evidentiary chain, the optional LaunchDaemon installer unlocks several capabilities unavailable to a standard terminal script: root-level execution, tamper-proof hash sealing in a user-inaccessible vault, automatic restart on crash, and persistence across logout and reboot — running continuously whether or not anyone is logged in.

v4.0 — Legal-Ready Auditing
The vault installer now generates a timestamped Hardening Report automatically on installation — and on demand at any time via generate_report.sh. Each report documents daemon status, vault integrity, live forensic statistics, and asserts the evidentiary basis under Federal Rules of Evidence 902(13) and 902(14). The report is sealed in the root vault and its SHA-256 hash is appended to the master chain of custody at the exact moment of generation. Run it before any court filing, discovery response, or supplemental submission.

Forensic Account Monitor is purpose-built for executives and high-value targets who require an independent security perimeter — including scenarios where the threat originates from inside their own IT infrastructure.

Unlike enterprise MDM solutions that route telemetry through managed servers, this tool reads Apple's native system daemons directly on the monitored device and writes output locally. There is no cloud dependency, no managed endpoint, and no third-party data handling. The monitoring chain cannot be intercepted, altered, or disabled by a network-level administrator.

For Corporate Deployment
The complete source code is open and auditable. We recommend having your IT security department review and approve the script before deployment. Once approved, it can be installed on executive devices as an independent audit layer that operates entirely outside the managed IT perimeter — providing a ground-truth record that cannot be influenced by the infrastructure it is monitoring.

Forensic Account Monitor is most useful for typical targets of crowdsourcing campaigns — individuals and professionals whose positions, work, or beliefs make them targets of coordinated swarming tactics.

Government and Law Enforcement Personnel
ICE and Border Patrol agents, judges, politicians, and public health officials are frequent targets of organized harassment campaigns that use proximity-based surveillance to track movements and monitor communications.

Whistleblowers and Dissidents
Corporate whistleblowers and political dissidents face well-resourced adversaries with the organizational capacity to deploy the kind of MDM-based fleet infrastructure this tool is specifically designed to detect.

Activists and Journalists
Those who investigate extremist groups, cults, or organized crime are routinely subjected to swarming tactics. This tool documents those operations in real time using Apple's own self-authenticating system logs — producing evidence that is admissible in federal court.

Celebrities and Public Figures
High-profile individuals — entertainers, athletes, executives, and social media personalities — are increasingly targeted by coordinated proximity-based surveillance operations. Their public schedules, recognizable locations, and high-value personal data make them prime targets for the kind of organized, technology-enabled stalking this tool is specifically designed to detect and document.

This tool was developed and deployed by Thomas D. Kraemer after discovering an empty ltk.plist — a nefarious file used to keep Apple’s Auto Unlock feature open — which led to the identification of a DDM running in the background of his device with no visible profile. Further investigation revealed the DDM had been used to crowdsource unauthorized access to his Apple ID across a violent criminal network. Over a 40+-day monitoring window, the tool captured over 1,700 distinct MAC addresses authenticating as owner of his Apple ID account under a single cloned IDS token (BBzlfMIo), deployed by an unauthorized Declarative Device Management organizational account.