Your Apple account
is being watched.
Now you can watch back.

Forensic Account Monitor is purpose-built for executives and high-value targets who require an independent security perimeter — including scenarios where the threat originates from inside their own IT infrastructure.

Unlike enterprise MDM solutions that route telemetry through managed servers, this tool reads Apple's native system daemons directly on the monitored device and writes output locally. There is no cloud dependency, no managed endpoint, and no third-party data handling. The monitoring chain cannot be intercepted, altered, or disabled by a network-level administrator.

Forensic Account Monitor is most useful for typical targets of crowdsourcing campaigns — individuals and professionals whose positions, work, or beliefs make them targets of coordinated swarming tactics.

Corporate Deployment
Once approved by your IT department, law partners, and accounting partners, corporate executives can use it as an independent audit layer that operates entirely outside the managed IT perimeter — providing a ground-truth record in the event your IT department is collecting unauthorized data or has provided unauthorized access to your device.

Government and Law Enforcement Personnel
ICE and Border Patrol agents, judges, politicians, and public health officials are frequent targets of organized harassment campaigns that use proximity-based surveillance to track movements and monitor communications.

Whistleblowers and Dissidents
Corporate whistleblowers and political dissidents face well-resourced adversaries with the organizational capacity to deploy the kind of MDM-based fleet infrastructure this tool is specifically designed to detect.

Activists and Journalists
Those who investigate extremist groups, cults, or organized crime are routinely subjected to swarming tactics. This tool documents those operations in real time using Apple's own self-authenticating system logs — producing evidence that is admissible in federal court.

Celebrities and Public Figures
High-profile individuals — entertainers, athletes, executives, and social media personalities — are increasingly targeted by coordinated proximity-based surveillance operations. Their public schedules, recognizable locations, and high-value personal data make them prime targets for the kind of organized, technology-enabled stalking this tool is specifically designed to detect and document.

SHA-256 Vault Daemon
The SHA-256 Vault Daemon provides a complete, unbreakable evidentiary chain. The optional LaunchDaemon installer unlocks several capabilities unavailable to a standard terminal script: root-level execution, tamper-proof hash sealing in a user-inaccessible vault, automatic restart on crash, and persistence across logout and reboot — running continuously whether or not anyone is logged in.

Legal-Ready Audits
The vault installer generates a timestamped Hardening Report automatically on installation — and on demand at any time via generate_report.sh. Each report documents daemon status, vault integrity, live forensic statistics, and asserts the evidentiary basis under Federal Rules of Evidence 902(13) and 902(14). The report is sealed in the root vault and its SHA-256 hash is appended to the master chain of custody at the exact moment of generation. Run it before any court filing, discovery response, or supplemental submission.

This tool was developed and deployed by Thomas D. Kraemer after discovering an empty ltk.plist — a nefarious file used to keep Apple's Auto Unlock feature open — which led to the identification of a DDM running in the background of his device with no visible profile. Further investigation revealed the DDM had been used to crowdsource unauthorized access to his Apple ID across a violent criminal network. Over a 40+-day monitoring window, the tool captured over 1,700 distinct MAC addresses authenticating as owner of his Apple ID account under a single cloned IDS token (BBzlfMIo), deployed by an unauthorized Declarative Device Management organizational account.