Hidden Camera Sweep Checklist

The checklist runs a search in the order physical security people use: write down what you are protecting and who had access, then check sightlines, the usual hiding objects, two-way mirrors, an optical pass for lens glints, a magnetic pass for mounts, microphones and ultrasonic beacons, Bluetooth trackers, vehicle wiring, the router's client list and every cable.

• Room type hides steps that do not apply: no bed in a meeting room, no shower in a car. Five types are built in: hotel or rental room, own home, bathroom or changing room, office or meeting room, and vehicle.
• Tick an item once checked. Press the flag button when something there looks wrong; a flag counts as checked and opens a private note. The info button shows why the step matters.
• Not possible here marks a phase you cannot run, such as the network phase without router access or the magnetic pass on an iPhone. It is listed under Not covered yet.
• Several steps open a sibling tool: the lens finder, the magnetic field detector, the ultrasonic beacon detector, the MAC lookup and the camera probe.
• Keyboard: Tab moves between items, Space ticks, Enter on a phase heading opens it, and Escape clears the search box.

Why sightlines come before objects. A camera is placed to see a target. The places that cover the bed, desk or door are few; the places a camera could sit are many. Searching by sightline walks the short list.

Mirrors. A nail touching its reflection suggests a front-surface coating, but thin front-surface and thick decorative glass break that test both ways. The deciding check is the light test: lights off, hands cupped on the glass, torch through it. A room behind shows; a wall returns nothing.

Each flaggable item carries an evidence weight by method. 3 (direct): a camera or DVR vendor on the router, a host that answers as a camera, light through a mirror, a phone tracker alert. 2 (visual): a lens glint, a suspect object, an unexplained client, a cable to nowhere. 1 (pointer): a magnetic spike, a warm object, the fingernail test, a flush mirror, an ultrasonic tone.

• Strong lead (red): any weight 3 flag.
• Several leads (amber): flags whose weights add to 3 or more.
• Weak lead (amber): flags adding to less than 3.
• No flags (blue): nothing flagged yet, which is a record of where you looked.

If you find something: photograph it in place with the location in frame, note the time, keep original files. Moving it destroys placement evidence and may destroy prints and recordings. In a rental, workplace, changing room or bathroom this is usually a crime. If you are not safe, leave first and report from elsewhere.