mvt README

The project's README from github.com/mvt-project/mvt. As one markdown file: README.md.

Mobile Verification Toolkit

[!IMPORTANT] We recently merged the "v3" branch. This introduced breaking changes. If you relied on mvt output in other scripts They might have broken. More details: https://github.com/mvt-project/mvt/issues/757

Documentation Status CI Downloads

Mobile Verification Toolkit (MVT) is a collection of utilities to simplify and automate the process of gathering forensic traces helpful to identify a potential compromise of Android and iOS devices.

It has been developed and released by the Amnesty International Security Lab in July 2021 in the context of the Pegasus Project along with a technical forensic methodology. It continues to be maintained by Amnesty International and other contributors.

Note MVT is a forensic research tool intended for technologists and investigators. It requires understanding digital forensics and using command-line tools. This is not intended for end-user self-assessment. If you are concerned with the security of your device please seek reputable expert assistance.

Indicators of Compromise

MVT supports using public indicators of compromise (IOCs) to scan mobile devices for potential traces of targeting or infection by known spyware campaigns. This includes IOCs published by Amnesty International and other research groups.

Warning Public indicators of compromise are insufficient to determine that a device is "clean", and not targeted with a particular spyware tool. Reliance on public indicators alone can miss recent forensic traces and give a false sense of security.

Reliable and comprehensive digital forensic support and triage requires access to non-public indicators, research and threat intelligence.

Such support is available to civil society through Amnesty International's Security Lab or through our forensic partnership with Access Now’s Digital Security Helpline.

More information about using indicators of compromise with MVT is available in the documentation.

Installation

MVT can be installed from sources or from PyPI (you will need some dependencies, check the documentation):

pip3 install mvt

You can also install MVT from PyPI with uv. First, install uv:

curl -LsSf https://astral.sh/uv/install.sh | sh

Then install MVT as a command-line tool:

uv tool install mvt

For alternative installation options and known issues, please refer to the documentation as well as GitHub Issues.

Usage

MVT provides three commands: mvt-ios and mvt-android analyse acquisitions from devices of that platform, and mvt hosts what belongs to neither: version, completion, plugins and download-iocs (version and download-iocs remain available on the platform commands for now). Running mvt on its own shows the installed version, update notices and the available commands. Check out the documentation to learn how to use them!

Pass --verbose to any of the three commands, before the command name (mvt-ios --verbose check-backup ...), for debug output. The --verbose option the check-* commands accept after their name still works but is kept for compatibility only and will be removed in a future release.

Shell completion

MVT can generate a shell completion script for Bash, Zsh, and Fish which covers mvt, mvt-ios and mvt-android:

mvt completion

The command prints setup instructions by default. To generate the completion script directly, pass the shell name:

mvt completion bash

MVT only writes completion files or shell configuration when --install is passed. See the command completion documentation for details.

Plugin packages extend MVT with additional forensic modules, which run inside the check-* commands, and with top-level commands on mvt, mvt-ios and mvt-android. See the development documentation for writing and installing them, and the custom CLI command documentation for the entry points a package registers commands in.

License

The purpose of MVT is to facilitate the consensual forensic analysis of devices of those who might be targets of sophisticated mobile spyware attacks, especially members of civil society and marginalized communities. We do not want MVT to enable privacy violations of non-consenting individuals. In order to achieve this, MVT is released under its own license. Read more here.

mvt (mvt-project/mvt)

Searching Database…

15.4K ·GitHub
Mvt
这是什么？MVT（Mobile Verification Toolkit）是一套取证工具，用于收集和分析 Android 与 iOS 设备上的痕迹，以判断设备是否可能已被入侵。它最初由 Amnesty International 的 Security Lab 在 Pegasus 项目期间开发。
这是我自己在电脑上运行的工具，还是一个帮我扫描手机的服务？这是一个命令行工具集，你需要把它安装在自己的电脑上，并针对设备的取证数据（备份或提取文件）运行，它没有远程扫描服务。
我该如何安装和运行它？可以从 PyPI 安装 MVT（文档推荐使用 uv），也可以从源代码安装，然后根据平台使用 mvt-ios、mvt-android 或 mvt 命令。
我能用它检查自己的手机是否安全吗？不太能。MVT 是一款面向技术人员和调查人员的取证研究工具，使用者需要了解数字取证和命令行工具，并不适合普通用户自我检测。如果你担心自己的设备，README 建议寻求专业人士的帮助。
它同时支持 Android 和 iOS 设备吗？支持。它提供了专门的 mvt-android 和 mvt-ios 命令，分别用于分析对应平台设备的取证数据。
MVT 的许可证有什么特别之处？MVT 采用它自己定制的许可证，而不是标准的开源许可证。这样做是为了在当事人同意的前提下允许进行取证分析，同时尽量防止该工具被用来侵犯未同意者的隐私。
促成 MVT 诞生的 Pegasus 项目是什么？Pegasus 项目是 2021 年对 NSO Group 的 Pegasus 间谍软件进行的一项调查。在此期间，Amnesty International 的 Security Lab 发布了 MVT，并同时公布了用于检测此类感染的取证方法。
MVT 的入侵指标（IOC）从哪里来？它们够用吗？MVT 可以使用 Amnesty International 和其他研究团体公开发布的入侵指标（IOC）进行扫描，但仅靠公开的 IOC 无法证明设备是干净的，它们可能漏掉较新的痕迹。因此，全面排查还需要非公开的指标和威胁情报支持。
我能用自定义检查来扩展 MVT 吗？可以。插件包可以添加额外的取证模块，这些模块在 check- 命令内运行，并可以在 mvt、mvt-ios 和 mvt-android 上注册新的顶层命令。
MVT 支持 shell 自动补全吗？支持。它可以为 Bash、Zsh 和 Fish 生成补全脚本，覆盖 mvt、mvt-ios 和 mvt-android 命令。
What are similar projects?Anthropic-Cybersecurity-Skills, wazuh, vol-rs, flowsint, awesome-honeypots, Mobile-Security-Framework-MobSF, radare2, Fieldwatch
Which topics is it in?investigation, surveillance, mobile-security, incident-response, threat-intelligence, forensics, malware-analysis, backup, security-tools, mobile, ios, android
Creator
mvt-project
Size
4.5 MB
Stars
15.4K
Updated
CommitOct 09Releasev2026.10.12Oct 12
Age
5y
Commits · 90 Days