MVT is a forensic tool to look for signs of infection in smartphone devices
Go to file
Donncha Ó Cearbhaill eb5bfb7f35 Properly handle iOS version updates with multiple builds 2023-09-30 11:45:29 +02:00
.github/workflows Properly handle iOS version updates with multiple builds 2023-09-30 11:45:29 +02:00
dev Removed AUTHORS file in favor of explicit copyright notice 2022-05-08 14:53:50 +02:00
docs Adds GlobalPreferences iOS module 2023-08-02 15:28:16 +02:00
mvt Squashed commit of the following: 2023-09-27 11:34:32 +02:00
scripts Linted code using isort + autoflake + black, fixed wrong use of Optional[bool] 2023-06-01 23:40:26 +02:00
tests Updated copyright notice 2023-09-09 17:55:27 +02:00
.gitignore Add code test coverage reporting 2023-07-22 19:54:01 +02:00
.readthedocs.yaml Improves documentation 2021-07-18 16:33:34 +02:00 Improved type hints and code style enforcement 2022-08-16 13:39:55 +02:00
Dockerfile Dockerfile improvements, support arm64 builds 2022-06-02 09:22:07 +02:00
LICENSE Updated LICENSE 2021-07-25 12:01:23 +02:00
Makefile Move syntax checking before unit tests 2023-07-21 11:30:59 +02:00 Update README with information on indicators of compromise and path ways for forensic support 2023-06-29 16:48:56 +02:00 Added 2022-08-14 19:28:30 +02:00
mkdocs.yml Add docs for the profiling feature 2023-06-29 14:55:09 +02:00
ruff.toml Improves code PEP8 compliance and adds ruff check 2023-03-01 16:43:08 -05:00
setup.cfg Improve performance when checking URLs and domains 2023-06-29 14:14:44 +02:00 Updated copyright notice 2023-09-09 17:55:27 +02:00

Mobile Verification Toolkit

Documentation Status CI Downloads

Mobile Verification Toolkit (MVT) is a collection of utilities to simplify and automate the process of gathering forensic traces helpful to identify a potential compromise of Android and iOS devices.

It has been developed and released by the Amnesty International Security Lab in July 2021 in the context of the Pegasus Project along with a technical forensic methodology. It continues to be maintained by Amnesty International and other contributors.

Note MVT is a forensic research tool intended for technologists and investigators. It requires understanding digital forensics and using command-line tools. This is not intended for end-user self-assessment. If you are concerned with the security of your device please seek reputable expert assistance.

Indicators of Compromise

MVT supports using public indicators of compromise (IOCs) to scan mobile devices for potential traces of targeting or infection by known spyware campaigns. This includes IOCs published by Amnesty International and other research groups.

Warning Public indicators of compromise are insufficient to determine that a device is "clean", and not targeted with a particular spyware tool. Reliance on public indicators alone can miss recent forensic traces and give a false sense of security.

Reliable and comprehensive digital forensic support and triage requires access to non-public indicators, research and threat intelligence.

Such support is available to civil society through Amnesty International's Security Lab or through our forensic partnership with Access Nows Digital Security Helpline.

More information about using indicators of compromise with MVT is available in the documentation.


MVT can be installed from sources or from PyPi (you will need some dependencies, check the documentation):

pip3 install mvt

For alternative installation options and known issues, please refer to the documentation as well as GitHub Issues.


MVT provides two commands mvt-ios and mvt-android. Check out the documentation to learn how to use them!


The purpose of MVT is to facilitate the consensual forensic analysis of devices of those who might be targets of sophisticated mobile spyware attacks, especially members of civil society and marginalized communities. We do not want MVT to enable privacy violations of non-consenting individuals. In order to achieve this, MVT is released under its own license. Read more here.