Methods and systems for identifying a compromised device through its unmanaged profile

A computing device comprising:

• a processor;
• a memory;
• a device analysis application stored in the memory and containing processor-executable instructions that, when executed by the processor, cause the processor determine whether a mobile device has been compromised, wherein the mobile device has internal storage that includes a managed portion of memory and an unmanaged portion of memory, the mobile device having a managed profile and an unmanaged profile, wherein the managed profile includes files stored in the managed portion of memory and the unmanaged profile includes stored in the unmanaged portion of memory, and wherein the managed profile is governed by a device policy set by a remote administrator, wherein the processor-executable instructions are to cause the processor to:
• obtain file tree structure information for the unmanaged profile of the mobile device, wherein the file tree structure information details at least a portion of a tree-based structure of folders and files in the unmanaged portion of memory,
• determine from the file tree structure information for the unmanaged profile that the mobile device is compromised, and
• based on the determination that the mobile device has been compromised, take an action,
• wherein determining from the file tree structure information for the unmanaged profile that the mobile device has been compromised includes determining that the file tree structure information for the unmanaged profile includes information regarding files within the managed profile.

A non-transitory computer-readable storage medium storing processor-executable instructions to determine whether a mobile device has been compromised, the mobile device having an internal storage that includes a managed portion of memory and an unmanaged portion of memory, the mobile device having a managed profile and an unmanaged profile, wherein the managed profile includes files stored in the managed portion of memory and the unmanaged profile includes files stored in the unmanaged portion of memory, and wherein the managed profile is governed by a device policy set by a remote administrator, wherein the processor-executable instructions, when executed by a processor a remote server, are to cause the processor to:

• obtain file tree structure information for the unmanaged profile of the mobile device, wherein the file tree structure information details at least a portion of a tree-based structure of folders and files in the unmanaged portion of memory,
• determine from the file tree structure information for the unmanaged profile that the mobile device is compromised, and
• based on the determination that the mobile device has been compromised, take an action,
• wherein determining from the file tree structure information for the unmanaged profile that the mobile device has been compromised includes determining that the file tree structure information for the unmanaged profile includes information regarding files within the managed profile.