Find spyware traces in mobile backups with this forensic utility
Determining whether a smartphone is infected with spyware requires finding clues in vast amounts of data. This tool automatically detects intrusion traces in backup files from Android and iOS devices, simplifying the analysis process. Developed by the Amnesty International Security Lab, this collection of utilities serves as a research tool for digital forensic experts and investigators.
v3 Integration and Changes
The recent integration of the v3 branch into main introduced changes that are incompatible with existing scripts. If you relied on MVT output in other scripts, their operation may have stopped, so caution is required. These changes are detailed in issue #757 of the repository.
Limitations of Public Indicator Scans
The tool scans devices using intrusion indicators (IOCs) published by Amnesty International and other research groups. However, public indicators alone cannot confirm that a device is safe. This is because recent forensic traces might be missed or false positives could occur, providing a false sense of security. Reliable forensic support and triage require access to non-public indicators and threat intelligence, which is provided through the Amnesty International Security Lab or Access Now's digital security helpline.
Installation and Command Structure
You can install the tool in a Python environment using the pip3 install mvt command, and installation via uv is also supported. The tool provides three commands: mvt-ios, mvt-android, and mvt for handling common commands. Each platform command analyzes acquired data from the respective device, while the mvt command handles version checks, shell completion script generation, plugin management, and indicator downloads. To see debug output, run commands with the --verbose option.
A Tool for Forensic Experts
This tool is intended for technicians and investigators with digital forensic knowledge and command-line proficiency. It is not suitable for general users to independently check the safety of their own devices. If you are concerned about your device's security, it is best to seek help from a trusted professional. Additionally, the tool aims to facilitate forensic analysis of devices belonging to consenting subjects and is distributed under a self-defined license to prevent use in violating the privacy of non-consenting individuals.
