mvt-project/mvt

MVT is a forensic analysis tool that helps investigators identify signs of compromise on Android and iOS mobile devices.

The tool addresses the challenge of detecting potential spyware infections and targeted attacks on mobile platforms by automating the collection and analysis of forensic traces. It works by extracting artifacts from device acquisitions and comparing them against indicators of compromise, which are signatures of known spyware campaigns. The project was developed by Amnesty International's Security Lab in response to the Pegasus Project investigations and provides a command-line interface for conducting systematic forensic examinations.

MVT is designed for technologists and digital forensics investigators rather than end users, requiring command-line proficiency and understanding of forensic methodology. It suits organizations, civil society groups, and security researchers who need to assess whether devices have been targeted by known spyware. The tool supports both Android and iOS through separate commands and can work with public indicators of compromise published by Amnesty International and other research groups. However, the documentation emphasizes that public indicators alone are insufficient to conclusively determine device compromise, and that comprehensive assessment requires access to non-public threat intelligence available through Amnesty International's Security Lab or partner organizations.

The project maintains active development with recent significant changes introduced in a major version update that altered output formats and broke backward compatibility with scripts relying on previous output structures. Development appears focused on core functionality refinement and integration with the broader forensic research ecosystem, as evidenced by the project's connection to published forensic methodologies and ongoing maintenance alongside community contributions.