diff --git a/docs/android/backup.md b/docs/android/backup.md index 8752398..81344aa 100644 --- a/docs/android/backup.md +++ b/docs/android/backup.md @@ -35,7 +35,11 @@ $ mvt-android check-backup --output /path/to/results/ /path/to/backup.ab INFO [mvt.android.modules.backup.sms] Extracted a total of 64 SMS messages ``` -If the backup is encrypted, MVT will prompt you to enter the password. +If the backup is encrypted, MVT will prompt you to enter the password. A backup password can also be provided with the `--backup-password` command line option or through the `MVT_ANDROID_BACKUP_PASSWORD` environment variable. The same options can also be used to when analysing an encrypted backup collected through AndroidQF in the `mvt-android check-androidqf` command: + +```bash +$ mvt-android check-backup --backup-password "password123" --output /path/to/results/ /path/to/backup.ab +``` Through the `--iocs` argument you can specify a [STIX2](https://oasis-open.github.io/cti-documentation/stix/intro) file defining a list of malicious indicators to check against the records extracted from the backup by MVT. Any matches will be highlighted in the terminal output.