A forensic toolkit for gathering and analyzing traces on Android and iOS devices to identify potential spyware compromise.
Mobile Verification Toolkit (MVT) is a forensic tool designed to automate the gathering and analysis of traces on Android and iOS devices. It helps identify potential compromises by sophisticated mobile spyware, such as Pegasus, by scanning for indicators of compromise (IOCs). Developed by Amnesty International's Security Lab, it provides a structured methodology for digital forensics in targeted surveillance investigations.
Digital forensic investigators, security researchers, and technologists working on consensual analysis of mobile devices, particularly those supporting civil society organizations or individuals at risk of targeted surveillance.
MVT offers a specialized, open-source toolkit focused on mobile device forensics with built-in support for IOC scanning, reducing the manual effort required for investigations. Its ethical licensing and development by a trusted organization like Amnesty International provide credibility and a focus on protecting vulnerable communities.
MVT (Mobile Verification Toolkit) helps with conducting forensics of mobile devices in order to find signs of a potential compromise.
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Released under a custom license that explicitly promotes consensual forensic analysis, targeting vulnerable groups like civil society, ensuring ethical use and avoiding privacy violations.
Provides dedicated command-line tools (`mvt-ios` and `mvt-android`) tailored for Android and iOS forensic traces, simplifying data collection and analysis for each OS.
Supports scanning with public and custom indicators of compromise (IOCs), integrated with repositories like Amnesty International's, to detect known spyware traces such as Pegasus.
Developed and maintained by Amnesty International's Security Lab, offering trusted updates and methodology, especially for high-profile threats, as highlighted in the Pegasus Project context.
Requires deep knowledge of digital forensics and command-line usage, with warnings in the README that it's not suitable for beginners or end-user self-assessment.
Designed for forensic investigation after potential compromise, lacking features for real-time threat prevention or proactive security monitoring.
Depends on public indicators of compromise, which the README admits are insufficient for comprehensive safety assessments, risking false negatives without access to non-public intelligence.