ZeroTrace Companion
Tracking
Multi-vantage device tracking and movement reconstruction — see where a device has been observed, how strong, and when.
The tracking view focuses on movement of devices through space and time. For a known device (or any device you select), tracking shows when and where the device has been observed, how strong the signal was, and how that signal changed.
It is the right view for surveillance-detection, presence verification, and movement-pattern analysis.
What tracking shows
Tracking is most useful when you have either:
- Multiple AirLeak vantages — captures from multiple physical locations, where Companion can correlate which AirLeak saw the device when.
- A long single-location capture — where the device's RSSI changes over time can be interpreted as movement towards / away from the AirLeak.
For a single AirLeak in a single short capture, tracking degrades to "RSSI over time for this device" — still useful but less powerful.
Per-device tracking
Pick a known device. The tracking view shows:
| Section | What it shows |
|---|---|
| RSSI over time | A line chart of signal strength for this device, across all sessions |
| Channel pattern | Which channels the device has been observed on, with timing |
| Vantage attribution | Which AirLeak saw the device, when (when you have multi-vantage data) |
| Movement events | Detected movement events — entered range, left range, signal climbed, signal dropped |
| Session-by-session timeline | Each capture session as a row, showing observation periods |
Movement events
The view detects coarse movement events from the RSSI pattern:
| Event | Means |
|---|---|
| Entered range | Device first observed in a session |
| Left range | Device last observed in a session, more than N minutes before session end |
| Approached | Sustained climb in RSSI |
| Receded | Sustained drop in RSSI |
| Stationary | RSSI variance below threshold for an extended window |
These are heuristics, not GPS. RSSI varies with body absorption, multi-path, channel, antenna orientation, and environmental noise — all of which produce signal changes that look like movement but aren't. Treat the events as candidates for further interpretation.
RSSI-based movement tracking is approximate. A device on a desk that someone walks past gets "approached" and "receded" events that have nothing to do with the device moving. For confirmed movement, ideally combine with multi-vantage data or visual confirmation.
Multi-vantage tracking
If you have captured the same device from multiple AirLeak locations (or imported sessions from a teammate's AirLeak), the view shows which device saw it and when:
- Vantage timeline — per-AirLeak rows showing when each vantage saw the device.
- Hand-off events — when a vantage's RSSI was decreasing while another vantage's RSSI was increasing (suggests the device moved from one vantage's coverage to another).
For physical surveillance-detection or coverage validation, multi-vantage tracking is the most informative configuration.
Session timeline
The session-by-session view shows each session as a row, with the device's observation periods drawn as bars. Useful for spotting:
- Frequency of presence — how often is this device around.
- Duration of presence — short visits or long stays.
- Pattern of presence — daily commute? weekly meeting? random?
A device that appears every weekday morning between 09:00 and 09:30 and then again 17:30 to 18:00 has a clear pattern. A device that appears once and never again has a different one.
Per-event drill down
Click any session row in the timeline to expand into the per-session events for that device. Useful when one specific session's data shows interesting behaviour and you want the full event detail.
Filtering and search
The tracking view's controls:
- Date range — restrict to a specific time window.
- Session subset — only certain sessions.
- Vantage subset — only certain AirLeak devices (multi-vantage setups).
- Minimum RSSI — exclude weak / fringe observations.
Exporting a tracking profile
For a device, the per-device tracking export produces:
- JSON — full structured tracking data, every observation with timestamp, RSSI, channel, vantage.
- CSV — table-shaped, suitable for spreadsheet analysis.
- PDF — formatted tracking report with charts and timeline.
The PDF is the standard deliverable shape for an investigation that includes tracking findings.
What tracking does not do
- Triangulate location. Even with multiple vantages, the toolkit does not compute (X, Y) positions. Triangulation requires careful calibration the toolkit deliberately does not assume.
- Predict future movement. No machine-learning, no "where will this device be next." The view is descriptive only.
- Distinguish device-moving from antenna-moving. If you move the AirLeak between sessions, every device's tracking history will look like movement.
Privacy and ethics
Tracking accumulates observations of a real device's presence in real space over time. The privacy implications are obvious; the legal implications vary by jurisdiction. Use the tracking view within your authorised scope. The toolkit gives you the capability to track; the decision about whether to track is yours and is regulated.
For investigative work with sensitive subjects, treat tracking exports as PII — encrypt at rest, control access, and purge after the operational need ends.