Skip to content

ZeroTrace Companion

Tutorial — hunt for an AirTag

"Is there an AirTag near me?" — a confirmed yes/no with location-narrowing detail in fifteen minutes.

AirTags are small Bluetooth trackers Apple makes. They're also one of the most-asked-about classes of unwanted-tracking device. This tutorial walks through using Companion + AirLeak to confirm whether an AirTag is in your space and, if so, narrow down where.

Setup

  1. Plug the AirLeak into your laptop. Battery powered or USB powered both work; for hunting an AirTag you want to be mobile.
  2. Open Companion. Connect to the AirLeak.
  3. Set the mode to BLE only — AirTags are BLE devices, no Wi-Fi capture needed for this task.

Step 1 — Configure the alert rule

Settings → AirLeak → Alerts. Add rule:

  • Type: AirTag detected.
  • Severity: medium.
  • Sound: on (you want to hear it fire).

Save. Now whenever the AirLeak observes any AirTag, an alert fires.

Step 2 — Start a session

Ctrl+N. Label it descriptively: "airtag-sweep-living-room-2026-05-07".

The session is now recording. Even if no AirTag is in range, the session captures all BLE traffic, which you can review later.

Step 3 — Confirm "no AirTag" or get an alert

Wait 30 seconds with the AirLeak in the centre of the space. Three outcomes:

  • No alert — no AirTag is currently broadcasting in your space at strong signal. (Note: AirTags rotate identifiers and can go silent for periods; "no alert in 30 seconds" is a strong signal but not absolute.)
  • Alert fires — an AirTag is in range. Continue to step 4.
  • Multiple alerts — multiple AirTags are in range. Each one is a separate device.

If no alert fires after 30 seconds, run the device around the space — different rooms, different floors, outdoors. The signal range of an AirTag is roughly 30-50 metres but heavily blocked by walls.

If you want a thorough sweep with no alert, plan for 5-10 minutes of moving the AirLeak through the space.

AirTags rotate their MAC and their broadcast ID periodically (Apple's privacy mechanism). One AirTag can appear as multiple library entries unless Companion successfully merges them. The AirTag-detection alert fires per-broadcast — multiple alerts in a row may be the same physical AirTag.

Step 4 — When the alert fires, identify the AirTag

The alert toast shows the AirTag's MAC and signal strength. Click it; the alert detail opens.

In the device detail:

  • Apple model is "AirTag" or similar.
  • RSSI is the current signal strength (closer to 0 = stronger).
  • First seen is the moment the alert fired.
  • Channel is the BLE advertising channel.

Record the MAC. You'll narrow location next.

Step 5 — Narrow location with RSSI

Switch to the live view. Find the AirTag's row. Watch the RSSI column update in real time.

Walk slowly through the space, paying attention to RSSI changes:

  • Closer to the AirTag → RSSI rises (less negative).
  • Further from the AirTag → RSSI falls.

After a minute of movement, you should be able to localise the AirTag to a room or a small area. Multi-floor environments are harder; walls absorb signal heavily.

For final localisation:

  • Cup the AirLeak with your hands to attenuate signal from one direction.
  • Rotate slowly — the direction of strongest signal indicates the AirTag's general location.
  • Compare RSSI across multiple rooms — the strongest reading wins.

This is approximate. RSSI is heavily affected by body position, walls, antennas, and randomness. Treat it as "hot/cold" guidance, not GPS.

Step 6 — Document your findings

Once you've localised (or given up):

  1. Pin the AirTag's library entry with a friendly name ("unknown-airtag-found-in-livingroom").
  2. Add notes to the session ("found at 14:32 in the bookshelf area, RSSI peaked at -48").
  3. Stop the session.

Step 7 — If you found one

If the AirTag is one you didn't put there, what to do is a separate question:

  • For yourself: identify whether it's a roommate's, a partner's, or genuinely unknown. Apple's "Items" app or your phone's "Find My" can tell you the owner if you're using an iPhone (the AirTag will alert you). Companion gives you the detection; identifying whose AirTag is harder and platform-specific.
  • For unwanted-tracking concerns: your local laws and your local resources are the right place to start. Apple's documentation describes how to disable an AirTag and what the legal recourse looks like in major jurisdictions.

The toolkit's role ends at "is it there." The decision about what to do is yours.

Step 8 — If you found nothing

Negative finding is also a useful finding. Document it:

  • "Sweep of [space] on [date], no AirTag detected during 10 minutes of mobile capture in [list of rooms]."
  • The session itself is the audit trail.

For ongoing monitoring, leave the AirLeak running with the alert rule active. Any future AirTag entering the space fires an alert.

AirTags broadcast on a schedule — you might catch nothing in a brief sweep but find one in a longer capture. Twenty-four hours of background capture in your home is a thorough check; an hour in your car after a long drive is a reasonable spot-check after a journey.

Beyond AirTags

The same workflow applies to other tracker classes:

  • Tile / Chipolo — different BLE patterns; rules can be configured.
  • Generic BLE trackers — many small BLE devices; the insights view shows the device-class distribution.
  • Bluetooth headsets / earbuds — usually attached to a person, useful for "is anyone in this empty room."

The principle is the same: configure an alert rule, run a capture, narrow with RSSI, document.

What you have at the end

  • A confirmed yes / no on whether an AirTag is in your space.
  • If yes: a localised position (room-level accuracy).
  • A documented session as evidence.
  • An ongoing alert rule for future captures.

Where to go next

  • Alerts — for configuring more sophisticated rules.
  • Tracking — for following a device across multiple sessions.
  • Library — for managing accumulated known-trackers across time.

Command Palette

Search for a command to run...