Root concerns Android privileges; jailbreak concerns modifications to restrictions on Apple's platform. They can create similar risks, but their detection surfaces and legitimate usage contexts differ.
Evaluation approach
Checks should not depend on a single file or process name. Assess platform state, application interference and transaction behavior together.
Application example
Do not classify a managed test device as an ordinary production-user event. Restrict laboratory exceptions to separate packages and accounts.
Limits and considerations
An adverse indicator may provide strong evidence. The absence of an indicator does not prove that the environment is unmodified.
The distance between an indicator and a conclusion
Root or jailbreak detection can rely on files, behavior or platform evidence. Failing to observe an indicator does not prove that no modification occurred. Vendor-specific changes and unsupported versions can also affect results.
A test report should identify the operating system, distribution build and observed control result instead of merely saying risky device. Include normal-user samples in the same assessment. This helps determine whether a claimed high detection rate comes at the cost of false blocks.
Checks and decisions
- Test platforms separately
- Define an indeterminate result
- Limit the transaction impact
Sources
The primary references above provide the technical basis. Example workflows and evaluation suggestions are this publication’s explanations, not independent test results for a particular product.