How to set up a PiRogue toolkit for detecting stalkerware
What you’ll need
Before starting, gather these items (all available at most electronics shops):
- Raspberry Pi 4 (2GB RAM is enough)
- Official power supply (micro-USB)
- 32GB micro SD card (Class 10 speed)
- Ethernet cable (any basic one will do)
- A spare monitor/TV with HDMI port (to set up initially)
Budget note: Some charities like WESNET in Australia provide discounted kits – check local domestic violence support networks.
Step 1: Preparing the PiRogue software
Downloading the system
- On any computer, go to PiRogue’s official website
- Click “Downloads” and choose the latest version for Raspberry Pi 4
- Save the file (it will end in
.img.xz
) – this contains the entire operating system
Flashing the SD card
- Install Balena Etcher (free software) from etcher.io
- Insert your micro SD card into the computer (using an adapter if needed)
- Open Etcher, select the PiRogue image you downloaded, choose your SD card, and click “Flash!”
- Wait until it says “Flash Complete” (about 10 minutes)
Step 2: Setting up the hardware
- Insert the SD card into the Raspberry Pi’s slot (underneath)
- Connect the Ethernet cable from your Pi to the shelter’s router
- Plug in the HDMI to a monitor/TV
- Connect the power supply last – the Pi will turn on automatically
First boot tip: The system takes about 5 minutes to start up. A rainbow screen is normal at first.
Step 3: Initial configuration
When prompted, log in with:
- Username:
pi
- Password:
raspberry
(you’ll change this later)
- Username:
Follow the on-screen prompts to:
- Set a new secure password (write this down somewhere safe)
- Confirm your timezone (important for accurate logs)
- Allow non-superusers to capture traffic (type “Y” then Enter)
The system will update itself – wait until it reboots (about 15 minutes)
Step 4: Connecting devices to check
For phones
- On the PiRogue’s screen, note the WiFi network name (e.g., “PiRogue-123”) and password
- On the survivor’s phone:
- Go to WiFi settings
- Connect to the PiRogue network (ignore any “no internet” warnings)
- Use the phone normally for 5 minutes – the PiRogue will analyse traffic in the background
For computers
- Connect the computer to the PiRogue via Ethernet cable
- Open any browser and visit the dashboard at:
https://pirogue.local/dashboard
- Username:
admin
- Password: Check the PiRogue screen for the auto-generated one
- Username:
Step 5: Reading the results
The dashboard shows simple traffic lights:
- Green: No stalkerware detected
- Yellow: Suspicious activity (e.g., unknown location tracking)
- Red: Confirmed stalkerware (e.g., Cerberus, FlexiSpy)
What to do if red appears:
- Note the malware name shown
- Immediately disconnect the device
- Contact your local tech safety partner (listed at stopstalkerware.org)
Safety and maintenance
After each use:
- Power off the PiRogue properly (type
sudo shutdown now
on its screen) - Wipe the SD card, for example by using DiskGenius on Windows: Formatting an SD card only removes file references—data can still be recovered with tools like PhotoRec 7. Wiping overwrites the data, making it unrecoverable. This is critical for:
- Removing traces of stalkerware or malware.
- Protecting survivor privacy if reusing cards.
- Ensuring clean setups for PiRogue’s forensic tools
- Verify the card after wiping: Reinsert it → Check if it shows as “empty” in File Explorer.
- Power off the PiRogue properly (type
Monthly checks:
- Re-flash the SD card with the latest PiRogue version (updates include new stalkerware detection rules)
For sensitive cases:
- Use in a separate room from the survivor’s living quarters
- Document findings for legal evidence (take screenshots of the dashboard)
Getting help
- Join PiRogue’s Discord server (https://discord.gg/pts-project) for real-time support
- EU Tech Safety Helpline: https://www.accessnow.org/help/ (24/7 support in multiple languages)
- UK shelters can contact Women’s Aid tech safety clinic (+44 0808 802 0300)
- For immediate danger, always prioritise physical safety over digital checks
Notes
This setup takes under an hour and costs less than €80. It’s a powerful way to help survivors regain digital safety.
This tool doesn’t replace professional forensic analysis, but it’s a good first check when survivors bring devices to your shelter. The whole setup takes about 45 minutes and costs under £70 – a small price for helping someone regain their digital privacy.