1. A method comprising: instrumenting, by a static instrumentation engine within software executed by a processor, an application of a handheld computing device with one or more monitoring functions, at least one of the one or more monitoring functions operating in a run time environment during virtual execution of the instrumented application; tracking, by the one or more monitoring functions, movement of data associated with the application, the data being at least partially identified by a storage location; determining whether movement of the data from a first storage location to a second storage location is suspicious; and reporting suspicious movement of the data.