MVT: Open-Source Mobile Forensics and Spyware IOC Detection for iOS and Android

MVT (Mobile Verification Toolkit) is an open-source mobile forensics toolkit developed by the Amnesty International Security Lab to identify traces of sophisticated targeted spyware on smartphones. First released in July 2021 alongside the technical forensics methodology for the landmark Pegasus Project investigation, MVT has become an essential utility for digital forensics examiners, security researchers, technologists, and human rights investigators analyzing potential mobile device compromise.

Image source: mvt-project / Amnesty International Security Lab

Designed around consensual forensic acquisition with explicit user authorization, MVT parses decrypted backups, system diagnostics, and low-level databases. It evaluates these extracted artifacts against Indicators of Compromise (IOCs) formatted in the STIX2 standard published by Amnesty International and external cybersecurity research groups to track down indicators of targeted surveillance.

A Forensic Foundation Proven in the Pegasus Project

MVT is not an antivirus utility or a real-time background protection daemon. Instead, it is a specialized post-mortem digital forensics framework built in Python to inspect deep system databases and execution logs for historical evidence of exploit activity.

The toolkit played a foundational role during the 2021 Pegasus Project investigation, scientifically corroborating forensic artifacts left by NSO Group's Pegasus spyware across civil society devices worldwide. Maintained continuously by Amnesty International and open-source contributors, MVT is routinely deployed in field investigations, including recent technical guides for detecting advanced commercial threats like NoviSpy on Android hardware.

Platform Architecture: iOS vs. Android Forensics and STIX2 IOC Matching

Because iOS and Android implement distinct security architectures and sandbox primitives, MVT provides separate dedicated command-line utilities for each operating system: mvt-ios and mvt-android.

• iOS Forensic Pipeline: By decrypting and processing encrypted iOS backups, MVT parses extensive databases including Safari browsing records, SMS messages, WhatsApp chats, call logs, and system analytics logs. Because targeted surveillance campaigns frequently leverage malicious links sent over messaging protocols or zero-click delivery mechanisms, MVT scrutinizes timestamps and network interactions within these records.
• Android Forensic Pipeline: Given that Android does not provide a single consolidated backup format comparable to iOS, MVT leverages the Android Debug Bridge (ADB) protocol to dump diagnostic telemetry and extract installed package manifests. It also features dedicated analysis modules to inspect acquisition packages gathered by AndroidQF (Android Quick Forensics) and native Android bugreport files.
• STIX2 Indicator Matching and Unified Timelines: Extracted records are systematically evaluated against curated lists of Indicators of Compromise (IOCs) distributed in the STIX2 format. Upon completing an analysis run, MVT generates structured JSON logs of all parsed records alongside separate JSON reports isolating detected malicious hits. It also produces a chronological unified timeline of device activity, enabling forensic investigators to reconstruct forensic events surrounding an intrusion.

Verified CLI Workflows and Key Forensic Interpretation Caveats

Distributed as a standard package on PyPI (mvt), the toolkit is executed directly from a terminal shell. For Android investigations, a verified forensic workflow typically incorporates the following steps:

1. Synchronizing Indicators: Execute mvt-android download-iocs to download the latest threat intelligence signatures and STIX2 indicator feeds published by Amnesty International Security Lab.
2. Scanning AndroidQF Acquisitions: Analyze mobile artifacts collected through the AndroidQF extraction tool by running mvt-android check-androidqf <path/to/acquisitionfolder>.
3. Inspecting Diagnostic Bugreports: Process detailed operating system diagnostic logs using mvt-android check-bugreport <path/to/bugreport>.

When deploying MVT in real-world triage, investigators and practitioners must account for several technical constraints and operational caveats.

First, MVT is an advanced investigative framework explicitly designed for forensic analysts, security technologists, and investigators. It is not intended for end-user self-assessment; without deep forensic context, normal system activity logs can easily be misinterpreted as indicators of compromise.

Second, a clean scan with zero IOC matches does not prove a device is uncompromised. Because detection relies on known signatures and identified campaign infrastructure, novel exploits or zero-day implants will not trigger signature-based detections.

Third, Android diagnostic logs such as bugreport files can vary significantly in structure and format across different device manufacturers and Android versions. This fragmentation limits the diagnostic data available for triage compared to iOS, requiring analysts to correlate multiple artifact sources, such as comprehensive AndroidQF extractions, rather than relying on a single log file.

Sources

• MVT GitHub Repository (mvt-project/mvt)
• MVT Official Documentation
• Amnesty International Security Lab: Tech Guide on Detecting NoviSpy with AndroidQF and MVT
• PyPI MVT Package Distribution