Mobile Verification Toolkit

No entries match these filters. Clear filters

1. v2026.10.26 Oct 26, 2026 · issue 121

   MVT v2026.10.26 adds Python 3.15 support.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2026.10.26 https://github.com/mvt-project/mvt.git
   # already have the repo? check out this version:
   $ git checkout v2026.10.26

2. v2026.9.28 Sep 28, 2026 · issue 089

   MVT's check-bugreport now descends into OEM wrapper archives and recovers previously truncated dumpstate sections⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2026.9.28 https://github.com/mvt-project/mvt.git
   # already have the repo? check out this version:
   $ git checkout v2026.9.28

   • Extends check-bugreport to descend into OEM wrapper .zip archives when the outer archive lacks a dumpstate entry point, automatically finding and using the nested bugreport.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Recovers properties lost when a section timing line was misidentified as a section boundary in bugreport parsing, restoring full SYSTEM PROPERTIES output on affected archives.
   • Surfaces accessibility service counts (installedServiceCount=N) per user in dumpsys accessibility analysis, raising a LOW alert when services are listed in the count but not named in the dump.
   • Extends check-bugreport to descend into OEM wrapper .zip archives when the outer archive lacks a dumpstate entry point, automatically finding and using the nested bugreport.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   2 more in Everything

3. v2026.9.14 Sep 14, 2026 · issue 074

   MVT gains --timezone/-t for bugreport timestamp accuracy and defers IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. loading until first use.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2026.9.14 https://github.com/mvt-project/mvt.git
   # already have the repo? check out this version:
   $ git checkout v2026.9.14

   └──▷ TRY IT
   Analyse a bugreport from a device known to be in a specific timezone when persist.sys.timezone is absent or unreliable in the archive.
   copy

   $ mvt-android check-bugreport --timezone 'America/New_York' -o ./results/ bugreport-2026-09-14.zip

   • Adds --timezone/-t option to mvt-android check-bugreport, accepting an IANA timezone name (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Europe/Paris), so bugreport file timestamps are interpreted in the device's wall-clock zone rather than the analysing machine's timezone; falls back to reading persist.sys.timezone from the bugreport's SYSTEM PROPERTIES section automatically.
   • Defers STIXSTIXStructured Threat Information Expression, a standard format for describing threats, indicators and their relationships. It helps organizations exchange threat intelligence in a usable form. indicator loading until first use, so mvt-android and mvt-ios subcommands that list modules or reject invalid paths no longer parse IOC files unnecessarily.
   • Reports unreadable or truncated sysdiagnose archives (catching tarfile.ReadError, EOFError, zlib.error, and OSError) with a critical-level log message and a clean exit code 1 instead of a silent Aborted!.
   • Adds --timezone/-t option to mvt-android check-bugreport, accepting an IANA timezone name (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Europe/Paris), so bugreport file timestamps are interpreted in the device's wall-clock zone rather than the analysing machine's timezone; falls back to reading persist.sys.timezone from the bugreport's SYSTEM PROPERTIES section automatically.

   2 more in Everything

4. v2026.9.7 Sep 7, 2026 · issue 067

   MVT gains concurrent backup decryption with --jobs, a new SysdiagnoseInfo module, and fixes env-var leakage to config.yaml.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2026.9.7 https://github.com/mvt-project/mvt.git
   # already have the repo? check out this version:
   $ git checkout v2026.9.7

   └──▷ TRY IT
   Decrypt a large encrypted iOS backup faster by parallelising file decryption across multiple workers.
   copy

   $ mvt-ios decrypt-backup --jobs 8 -p <password> -d /tmp/decrypted /path/to/backup

   • Adds --jobs option to mvt-ios decrypt-backup to control the number of concurrent decryption workers (integer, 1 to MAX_DECRYPT_WORKERS, defaults to DEFAULT_DECRYPT_WORKERS).
   • Adds a SysdiagnoseInfo module to check-sysdiagnose, extending IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. scanning to sysdiagnose archives.
   • Replaces the unmaintained iOSbackup dependency with iphone_backup_decrypt for iOS backup decryption, fixing decrypted-file truncation caused by inaccurate sizes in backup metadata.
   • Parses dumpsys settings output as per-record results in Android analysis, capturing multi-line values and metadata that per-line regex previously truncated or dropped.
   • Adds a SysdiagnoseInfo module to check-sysdiagnose, extending IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. scanning to sysdiagnose archives.

   3 more in Everything

5. v2026.9.1 Sep 1, 2026 · issue 062

   MVT gains a plugin system, a new mvt command, ADBADBAndroid Debug Bridge, a command-line tool maintained by Google that lets a host machine communicate with an Android device over USB or TCP, giving cyber tools shell access, file transfer, and app control. key alerting, WhatsApp contacts module, and richer Android bugreport parsing

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2026.9.1 https://github.com/mvt-project/mvt.git
   # already have the repo? check out this version:
   $ git checkout v2026.9.1

   └──▷ TRY IT
   Generate and install shell completion for Bash so all three MVT commands are tab-completable in your daily workflow.
   copy

   $ mvt completion bash --install

   View command output v2026.9.1

   ● actually ran exit 0 · 772ms · 14affed5acbf

   mvt copy

         $ mvt completion bash --install
   Installed bash completion for mvt, mvt-ios and mvt-android to /home/ctk/.mvt-complete.bash
   Updated ~/.bashrc
   

   Check what plugins are installed and whether any have updates available, before running an analysis.
   copy

   $ mvt plugins

   • Adds a top-level mvt command (platform-neutral) hosting version, completion, plugins, and download-iocs; running mvt alone shows installed version, update notices, and available commands.
   • Adds mvt completion to generate shell completion scripts for Bash, Zsh, and Fish across mvt, mvt-ios, and mvt-android; pass the shell name (e.g. mvt completion bash) to emit the script directly, and --install to write it.
   • Adds a plugin system: third-party packages can register forensic modules and top-level CLI commands via Python entry points; mvt plugins lists installed plugins and checks for updates.
   • Adds mvt.plugin as a public Python import surface for writing plugin packages.
   • Allows custom modules to replace built-in MVT modules via the plugin system.

   +10 more show less

   • Modules with unavailable dependencies are now skipped instead of aborting the run.
   • Alerts on unexpected trusted ADB keys in AndroidQF acquisitions: raises LOW-severity alerts for malformed keys, keys from a different host, trusted keys when no acquisition host key is present, and informational alerts when the acquisition host key was last connected more than one day before collection.
   • Adds a WhatsApp contacts forensic module.
   • Preserves Android tombstone abort messages and protobuf causes lists in both text-parsed and protobuf-parsed analysis output.
   • Parses package installer attribution from Android bugreports.
   • Adds bugreport parsers for process tables, system settings, and mountinfo.
   • Parses system package flags, accessibility service states per user, ADB binary XML keys, AppOps UID and event details, battery history events, database operation details, multi-user package details, platform compatibility overrides, and multiline Android properties from bugreports.
   • Adds timezone provenanceprovenanceEvidence recording where a software artifact came from and how it was built, including its source and build process. It helps a consumer check that the artifact matches a trusted build. to file timestamps in analysis output.
   • AndroidQF runs no longer abort when encountering an encrypted backup.ab; the encrypted backup is skipped and analysis continues.
   • Builds and publishes Docker images for ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead..

   15 details in Everything

6. docs update Aug 31, 2026 · issue 060

   MVT gains a plugin management subsystem with mvt plugins list and mvt plugins check-updates commands.

   └──▷ TRY IT
   Audit all installed MVT plugins at the start of an investigation to confirm origins and loaded modules before trusting any results.
   copy

   $ mvt plugins list

   Check immediately for available plugin updates (bypassing the 12-hour cache) before upgrading a plugin — review the printed pip install -U command before running it.
   copy

   $ mvt plugins check-updates

   • Adds mvt plugins list subcommand to audit installed plugin packages, showing each plugin's name, version, origin (pypi, git+<commit>, or local), number of forensic modules contributed, and any CLI commands it adds.
   • Adds mvt plugins check-updates subcommand to immediately check all installed plugins for available updates, printing the exact pip install -U <package> command needed to upgrade — MVT never upgrades automatically.
   • Adds automatic plugin update banner printed at command startup (at most once every 12 hours, caching the result between checks) that shows available plugin updates without a network lookup on every invocation.
   • Supports the --disable-update-check option and respects the NETWORK_ACCESS_ALLOWED MVT configuration setting to suppress automatic plugin update checks.
   • Supports git-installed plugins (pip install 'mvt-plugin-example @ git+<url>'), checking the remote repository for commits newer than the installed revision; plugins pinned to a specific commit or tag are treated as stable and never reported outdated.

   +2 more show less

   • Plugin packages extend both mvt-ios and mvt-android with additional forensic modules and CLI commands, and load automatically on install.
   • A plugin whose modules fail to import is listed with error in the Modules column rather than aborting the listing.

   7 details in Everything

7. docs update Aug 31, 2026 · issue 060

   MVT gains a namespaced plugin configuration API so third-party plugins can store settings, credentials, and data without touching MVT's own config.yaml.

   └──▷ USE IT
   Define and load plugin settings, falling back to an environment-variable API key when the YAML file is absent or the field is unset.
   python copy

   from typing import Optional
   from mvt.plugin import MVTPluginSettings, plugin_env_prefix
   import click
   
   class ExamplePluginSettings(MVTPluginSettings):
       plugin_name = "example-plugin"
       API_KEY: Optional[str] = None
       MAX_RESULTS: int = 25
   
   def run_scan():
       settings = ExamplePluginSettings.load()
       if not settings.API_KEY:
           prefix = plugin_env_prefix(settings.plugin_name)
           raise click.ClickException(
               f"No API key configured. Set {prefix}API_KEY or run 'example-plugin configure'."
           )
       # use settings.API_KEY ...

   Persist plugin settings (excluding values sourced from the environment) to the namespaced YAML file.
   ~/.config/mvt/plugins/example-plugin.yaml copy

   API_KEY: null
   MAX_RESULTS: 100
   LAST_SYNC: '2024-06-01T12:00:00+00:00'

   • Adds MVTPluginSettings base class in mvt.plugin for plugin authors to declare typed, namespaced settings with defaults; subclass it, set plugin_name, and call load() / save() to persist configuration.
   • Plugin settings are stored at ~/.config/mvt/plugins/<plugin name>.yaml (Linux) or the platform equivalent, created with 0600 permissions; MVT creates the plugins/ directory at 0700.
   • Adds plugin_config_path() from mvt.plugin to retrieve the correct per-plugin settings file path without hard-coding platform-specific directories.
   • Adds plugin_data_folder() from mvt.plugin (and the data_folder() class method on MVTPluginSettings) to provision a persistent data directory at ~/.local/share/mvt/plugin-data/<plugin name>/ (Linux) or ~/Library/Application Support/mvt/plugin-data/<plugin name>/ (macOS) with 0700 permissions.
   • Adds plugin_env_prefix() from mvt.plugin to compute the canonical environment-variable prefix (MVT_PLUGIN_<PLUGIN_NAME_UPPERCASED>_) for a given plugin name.

   +4 more show less

   • Every MVTPluginSettings field can be overridden at runtime via environment variables using the scheme MVT_PLUGIN_<PLUGIN_NAME>_<FIELD> (e.g. MVT_PLUGIN_EXAMPLE_PLUGIN_API_KEY); environment values take priority over the YAML file but yield to values passed directly to the class constructor.
   • save() omits values currently supplied by environment variables, so credentials injected at runtime are never written to disk when a plugin saves an unrelated setting.
   • A missing plugin YAML file is not an error — plugins fall back to field defaults and environment variables; a malformed or non-mapping file raises PluginConfigLoadError naming the offending file.
   • Plugin package names must follow the mvt-plugin-<name> convention with lowercase letters, digits, and dashes only; the plugin_name attribute on a settings subclass drives both the YAML filename and the environment-variable namespace.

   9 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !Do not add custom sections to MVT's own config.yaml: MVT rewrites that file from its known settings on every start, deleting any unrecognized keys.
8. docs update Aug 31, 2026 · issue 060

   MVT gains a plugin system for custom CLI commands, loadable via entry points, --load-command, or environment variables.

   └──▷ TRY IT
   Develop and test a custom iOS command locally without reinstalling a package after every edit.
   copy

   $ mvt-ios --load-command ./case_summary.py case-summary ./ios-backup

   Auto-load a folder of Android-specific plugin commands on every mvt-android invocation without passing --load-command each time.
   copy

   $ export MVT_ANDROID_CUSTOM_COMMANDS=./android_commands

   Permanently add a plugin command to both mvt-ios and mvt-android by registering it via entry points in the package manifest.
   pyproject.toml copy

   [project.entry-points."mvt.ios.cli_plugins"]
   summarize = "my_mvt_plugin:summarize"
   
   [project.entry-points."mvt.android.cli_plugins"]
   summarize = "my_mvt_plugin:summarize"

   • Adds --load-command <file-or-folder> flag to mvt, mvt-ios, and mvt-android for loading custom Click commands at runtime without reinstalling a package; repeatable and accepts folders of *.py files.
   • Adds MVT_CUSTOM_COMMANDS, MVT_IOS_CUSTOM_COMMANDS, and MVT_ANDROID_CUSTOM_COMMANDS environment variables to auto-load command files or folders on every invocation of their respective CLIs.
   • Supports registering custom commands as installable Python packages via pyproject.toml entry-point groups mvt.ios.cli_plugins, mvt.android.cli_plugins, and mvt.cli_plugins to permanently extend each CLI.
   • Adds mvt plugins list subcommand to show installed plugin packages and the commands they contribute.
   • Exposes Command, MVTModule, convert_unix_to_iso, and get_plugin_logger from mvt.plugin for building module-running plugin commands that produce alerts.json, info.json, and command.log output.

   +2 more show less

   • Plugin commands on the base mvt CLI can be registered as Click groups (e.g. mvt my-plugin configure) for plugins with multiple operations.
   • Each loaded command file must export a single cli object (click.Command or click.Group); broken or colliding commands are isolated so other MVT commands continue to work.

   7 details in Everything

9. docs update Aug 31, 2026 · issue 060

   MVT gains a plugin system for custom forensic modules, with path-based loading, dependency declarations, and module replacement support.

   └──▷ TRY IT
   List all installed MVT plugin packages, their install origin, and how many modules each contributes — useful after installing a new plugin to confirm it registered correctly.
   copy

   $ mvt plugins list

   Define a custom module that replaces the built-in Manifest module so dependents receive the replacement's results and the original is dropped from the run.
   python copy

   from mvt.plugin import IOSExtraction
   from mvt.ios.modules.backup import Manifest as BuiltinManifest
   
   class Manifest(IOSExtraction):
       replaces = BuiltinManifest
       # slug and --module name are inherited from BuiltinManifest
   
       def run(self):
           ...

   • Adds --module flag support for selecting individual modules, including custom plugin modules, while running their transitive dependencies automatically.
   • Introduces a plugin package system: a Python package installed alongside MVT registers custom forensic modules via an entry point (mvt_plugin_example_org:get_modules) and they load automatically into every supported command.
   • Adds path-based module loading via a new flag (accepts a Python file or a folder of .py files) for developing modules locally before packaging; can be repeated and loads files in sorted order.
   • Adds a persistent path-loading config setting that names a folder to load on every module-running command, before any per-run flag.
   • Introduces replaces attribute on custom module classes to supersede a built-in module without slug collisions — the named built-in is dropped from the run and dependents receive the replacement's results instead.

   +7 more show less

   • Introduces get_dependency_results() method on the base module class so custom modules can read results produced by declared dependency modules.
   • Adds mvt.plugin as the stable public import surface for plugin authors, exporting base classes (IOSExtraction, SysdiagnoseExtraction, AndroidQFModule, AndroidBackupModule, BugReportModule), Command, Alert, AlertLevel, DatabaseNotFoundError, DatabaseCorruptedError, timestamp converters, get_plugin_logger(), MVT_VERSION, and the settings API.
   • Adds get_plugin_logger(__name__) for logging from outside a module class (e.g. custom CLI handlers) in the same namespace as MVT.
   • Supports namespaced plugin configuration files for plugin-specific settings (such as API keys), keeping them separate from MVT's own config.yaml.
   • Adds check-iocs compatibility for custom modules: any module implementing check_indicators() is automatically included in check-iocs for its platform without needing to declare the pair explicitly.
   • Logs a warning naming both modules, their origins, and the overwritten file when two modules share a slug, but runs both unless replaces is set.
   • Logs every applied module substitution to the output folder when a command runs with an output folder, providing an audit trail of replacements.

   12 details in Everything

10. docs update Aug 31, 2026 · issue 060

    MVT adds mvt download-iocs command to automatically fetch the latest public indicator files.

    └──▷ TRY IT
    Fetch the latest public IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. files before running a device check to ensure up-to-date detections.
    copy

    $ mvt download-iocs

11. docs update Aug 31, 2026 · issue 060

    MVT adds a unified mvt completion command generating a single shell completion script for bash, zsh, and fish.

    └──▷ TRY IT
    Set up bash shell completion for all MVT commands in one step.
    copy

    $ mvt completion > ~/.mvt-complete.bash && echo 'source ~/.mvt-complete.bash' >> ~/.bashrc

    Set up fish shell completion so it is auto-loaded on every new shell session.
    copy

    $ mvt completion > ~/.config/fish/conf.d/mvt-completion.fish

    • Adds mvt completion command that generates a single shell completion script covering all MVT subcommands, replacing the previous per-command mvt-ios completion and mvt-android completion scripts.
    • Supports bash completion via script output to ~/.mvt-complete.bash.
    • Supports zsh completion via script output to ~/.mvt-complete.zsh.
    • Supports fish completion via script output to ~/.config/fish/conf.d/mvt-completion.fish, loaded automatically by fish from ~/.config/fish/conf.d with no shell config changes required.

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The old mvt-ios completion and mvt-android completion commands are superseded; when switching to the new mvt completion single script, you must remove the old per-command completion files and remove the lines that sourced them from your shell configuration.
12. docs update Aug 22, 2026 · issue 053

    MVT gains a plugin system: Python packages can register modules via mvt.modules entry points, with --list-modules auditing by source.

    └──▷ USE IT
    Register a custom plugin package so its modules load automatically in every MVT module-running command.
    pyproject.toml copy

    [project.entry-points."mvt.modules"]
    mvt-plugin-amnesty-custom = "mvt_plugin_amnesty_custom:get_modules"

    Inject a plugin package into an existing pipx-managed MVT installation so it is available to all MVT commands.
    copy

    $ pipx inject mvt mvt-plugin-amnesty-custom

    Audit which modules are loaded and where they came from before running an analysis, to verify no unexpected plugins are active.
    copy

    $ mvt-ios --list-modules

    • Adds an installed-module plugin system: Python packages register MVT modules automatically by declaring an entry point in the mvt.modules group inside pyproject.toml, using the format [project.entry-points."mvt.modules"].
    • External module packages log under the mvt.ext.<package> namespace (with the mvt_plugin_ prefix stripped), keeping plugin log output visually distinct from built-in modules in the mvt.* logger tree; file-loaded modules log as mvt.ext.<file name>.
    • Extends --list-modules to group available modules by source — MVT itself (with version), each installed package (with version and commit when installed from a repository), and each externally loaded file (with its SHA-256SHA-256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. hash).
    • When a command runs with an output folder, command.log now records one line per module source including the source's version or hash and the list of modules loaded from it.

    4 details in Everything

13. docs update Aug 22, 2026 · issue 053

    MVT WhatsApp module gains LID-to-phone-number resolution, contact records extraction, and new timeline events for chat sessions and disappearing messages.

    • Adds lid_phone_number_pair record type and lid_pair_recorded timeline event: the WhatsApp module now resolves opaque LID identifiers to phone numbers using the ZWAPHONENUMBERLIDPAIR table from LID.sqlite (or ChatStorage.sqlite), populating partner_resolved_phone_number on 1:1 chat session records.
    • Adds chat_session record type with chat_first_message and chat_last_message timeline events per conversation, plus a group_created event for group chats; notes that a session's last-message date can postdate its newest stored message when recent messages were deleted.
    • New WhatsappContacts module extracts contact records from private/var/mobile/Containers/Shared/AppGroup/*/ContactsV2.sqlite into whatsapp_contacts.json, including phone number, WhatsApp and LID identifiers, and the per-contact disappearing messages timer (absent from ChatStorage.sqlite).
    • Produces four new timeline events from contact records: disappearing_mode_set, about_changed, about_expiration, and contact_last_updated.

    4 details in Everything

14. docs update Aug 6, 2026 · issue 037

    MVT gains a custom CLI command extension system via entry-points, --load-command, and MVT_IOS/ANDROID_CUSTOM_COMMANDS env vars.

    └──▷ TRY IT
    Run a one-off local command script against an iOS backup without packaging it — useful for ad-hoc case scripting.
    copy

    $ mvt-ios --load-command ./case_summary.py case-summary ./ios-backup

    Auto-load a folder of Android commands on every invocation so your team's custom scripts are always available.
    copy

    $ export MVT_ANDROID_CUSTOM_COMMANDS=./android_commands
    mvt-android case-summary ./androidqf-output

    Register a reusable plugin package into a pipx-managed MVT install so the new subcommand appears permanently in mvt-ios.
    copy

    $ pipx inject mvt my-mvt-plugin
    mvt-ios summarize ./ios-backup

    • Adds --load-command <file-or-folder> flag to mvt-ios and mvt-android to inject local .py Click commands at runtime without packaging; the flag can be repeated.
    • Adds MVT_IOS_CUSTOM_COMMANDS and MVT_ANDROID_CUSTOM_COMMANDS environment variables to auto-load a command file or folder on every invocation.
    • Supports installing third-party command packages via mvt.ios.cli_plugins and mvt.android.cli_plugins Python entry-points in pyproject.toml, making new top-level subcommands available directly in the respective CLI.
    • Supports injecting plugin packages into a pipx-managed MVT environment with pipx inject mvt <plugin>.
    • Custom commands are distinct from custom forensic modules: they add new top-level CLI operations rather than analysis steps inside existing check-* commands.

    +1 more show less

    • Broken entry-point or environment commands surface as marked broken commands in the CLI without blocking other MVT commands, with source and error visible on invocation.

    6 details in Everything

15. docs update Jul 29, 2026 · issue 029

    MVT URL checks now run concurrently with up to 20 parallel requests and automatic deduplication.

    • URL IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. checks are now deduplicated and executed concurrently, with a configurable cap of 20 in-flight requests at a time, speeding up large-scale IOC scans.
    • Redirect chains within a single URL are still followed sequentially, preserving accuracy while parallelizing across distinct URLs.
    • New environment variables are available to control concurrent URL request behavior.

    3 details in Everything

16. docs update Jul 29, 2026 · issue 029

    MVT gains check-sysdiagnose command for analyzing iOS sysdiagnose archives via custom modules

    └──▷ TRY IT
    Analyze a compressed iOS sysdiagnose archive with a custom module and capture results — useful when triaging a device you cannot decrypt or jailbreak.
    copy

    $ mvt-ios check-sysdiagnose --load-module ./sysdiagnose_modules.py --output ./results ./sysdiagnose_2024.01.02_03-04-05+0200.tar.gz

    Preview which custom modules in a file are eligible for sysdiagnose analysis before committing to a full run.
    copy

    $ mvt-ios check-sysdiagnose --load-module ./sysdiagnose_modules.py --list-modules ./sysdiagnose_2024.01.02_03-04-05+0200.tar.gz

    Write a custom sysdiagnose module that extracts a target log file and exposes its contents as structured results for indicator checking.
    python copy

    from mvt.ios.modules.sysdiagnose import SysdiagnoseExtraction
    
    class ExampleSysdiagnoseModule(SysdiagnoseExtraction):
        supported_commands = (("ios", "check-sysdiagnose"),)
        slug = "example_sysdiagnose"
    
        def run(self):
            paths = self._get_files_by_pattern("*/example.log")
            if paths:
                content = self._get_file_content(paths[0]).decode("utf-8", "replace")
                self.results = [{"content": content}]
    
        def check_indicators(self):
            pass
    
        def serialize(self, result):
            return None

    • New mvt-ios check-sysdiagnose command analyzes iOS sysdiagnose archives (extracted directory or gzip-compressed tar) using custom MVT modules.
    • New --hashes flag includes file hashes in info.json output; --list-modules lists eligible custom modules without executing them.
    • New SysdiagnoseExtraction base class enables practitioners to write custom sysdiagnose modules with consistent directory and tar input handling, file lookup/read helpers, timezone extraction, and IPSIPSAn intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection. crash-report metadata via ips_files.

    3 details in Everything

17. v2026.7.29 Jul 29, 2026 · issue 029

    MVT gains shell completion, custom module loading, iOS sysdiagnose checking, Safari profile scanning, and parallelized URL checks.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2026.7.29 https://github.com/mvt-project/mvt.git
    # already have the repo? check out this version:
    $ git checkout v2026.7.29

    └──▷ TRY IT
    Install shell completion for your shell so mvt-ios and mvt-android arguments tab-complete in your terminal.
    copy

    $ mvt-ios completion bash --install
    mvt-android completion zsh --install

    Run an AndroidQF check with a custom detection module to extend MVT's analysis beyond built-in modules.
    copy

    $ mvt-android check-androidqf --load-module /path/to/my_custom_module.py <target>

    • Adds shell completion command for Bash, Zsh, and Fish via mvt-ios completion and mvt-android completion.
    • Supports loading custom Python analysis modules with --load-module PATH or the MVT_CUSTOM_MODULES environment variable.
    • Adds iOS sysdiagnose checking support.
    • Scans Safari profile databases for browsing history and browser state.
    • Parallelizes URL indicator checks for faster IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. scanning.

    +4 more show less

    • Adds dependency-aware module execution, allowing modules to declare prerequisites and run in stable topological order.
    • Supports rotated iOS shutdown logs.
    • Matches Android receiver indicators by package ID.
    • Handles malformed AndroidQF backups gracefully instead of crashing.

    9 details in Everything

18. advisory CVE-2026-46486 May 14, 2026 · issue 128
    • CVE-2026-46486: Path Traversal via unsanitized File identifiers in iOS Backup processing (affects <=2026.4.28)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
19. v2026.5.12 May 12, 2026 · release notes

    MVT v2026.5.12 adds checks for Android's new Intrusion Logging feature in Advanced Protection Mode.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2026.5.12 https://github.com/mvt-project/mvt.git
    # already have the repo? check out this version:
    $ git checkout v2026.5.12

20. v2026.4.28 Apr 29, 2026 · release notes

    MVT v2026.4.28 overhauls alerting with multi-level alert system, adds AndroidQF bugreport analysis, and expands IoCIoCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. and battery detection.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2026.4.28 https://github.com/mvt-project/mvt.git
    # already have the repo? check out this version:
    $ git checkout v2026.4.28

    • Replaces binary detected/not-detected alerting with a multi-level alert system, enabling heuristic detections and richer JSON output for downstream tooling.
    • Adds support for bugreport modules to analyse AndroidQF dumpsys.txt files.
    • Extends IoC matching to check broadcast receiver names.
    • Detects app uninstalls and downgrades via battery daily history analysis.
    • Aborts analysis and warns the user when an iOS backup is encrypted, preventing silent incomplete results.

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !This release is described as a major v3 refactor; the README explicitly warns about v3 breaking changes — existing integrations that parse MVT JSON output or rely on the binary detected/not-detected alert structure will need to be updated for the new multi-level alert format.
21. v2.7.0 Dec 19, 2025 · release notes

    MVT v2.7.0 adds VirusTotal checks for androidqf, new mounts and root_binaries modules, and an option to disable update checks.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.7.0 https://github.com/mvt-project/mvt.git
    # already have the repo? check out this version:
    $ git checkout v2.7.0

    • Extends VirusTotal checks to work with androidqf extractions in addition to ADBADBAndroid Debug Bridge, a command-line tool maintained by Google that lets a host machine communicate with an Android device over USB or TCP, giving cyber tools shell access, file transfer, and app control..
    • Adds mounts module for androidqf to inspect mounted filesystems on Android devices.
    • Adds root_binaries module for androidqf to detect root-related binaries on Android devices.
    • Adds options to disable automatic update checks.
    • Adds recognition of iPhone 16 and 17 models.

    +1 more show less

    • Updates known iOS versions to include iOS 18.6.1 and 18.6.2.

    6 details in Everything

22. v2.6.1 Dec 19, 2025 · release notes

    MVT v2.6.1 adds Android tombstone file parsing, ADBADBAndroid Debug Bridge, a command-line tool maintained by Google that lets a host machine communicate with an Android device over USB or TCP, giving cyber tools shell access, file transfer, and app control. keystore XML support, and new security warnings.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.6.1 https://github.com/mvt-project/mvt.git
    # already have the repo? check out this version:
    $ git checkout v2.6.1

    • Adds parser for Android tombstone files, enabling analysis of crash/kill records during forensic investigations.
    • Adds support for parsing ADB keystore in XML format, expanding credential and key artifact coverage.
    • Loads Android device timezone info and logs additional file modification events for richer timeline analysis.
    • Adds additional Android security warnings to surface more suspicious indicators during device checks.

    4 details in Everything

23. v2.6.0 Jan 27, 2025 · release notes

    MVT v2.6.0 adds IP indicator support, APK cert hash IOCsIOCsAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself., new Android modules, and improved STIX2 directory scanning.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.6.0 https://github.com/mvt-project/mvt.git
    # already have the repo? check out this version:
    $ git checkout v2.6.0

    • Adds support for IP address indicators in IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. matching across MVT checks.
    • Adds support for checking APK certificate hash IOCs to detect tampered or malicious Android packages.
    • New packages module for androidqf acquisitions to analyze installed package data.
    • New files module for androidqf acquisitions to inspect file listings.
    • New parser for ADBADBAndroid Debug Bridge, a command-line tool maintained by Google that lets a host machine communicate with an Android device over USB or TCP, giving cyber tools shell access, file transfer, and app control. state within Dumpsys output to surface connected device info.

    +6 more show less

    • New module to parse uninstalled apps from Dumpsys data, surfacing historically present applications.
    • Adds additional heuristic detections for suspicious Android packages.
    • SQLite database recovery now attempted automatically when a DB is found locked or open.
    • STIX2 indicator loading via MVT_STIX2 environment variable now recursively searches directories, not just individual files.
    • Improved STIX2 indicator support with broader indicator-type coverage and expanded test coverage.
    • Docker image now built with multistage builds and separate OS-specific images, reducing image size.

    11 details in Everything

24. v2.5.1 Apr 11, 2024 · release notes

    MVT v2.5.1 shortens the VirusTotal flag to -V and reassigns USBmuxd debug to -v

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.5.1 https://github.com/mvt-project/mvt.git
    # already have the repo? check out this version:
    $ git checkout v2.5.1

    └──▷ USE IT
    Run an iOS forensic analysis and send results to VirusTotal using the new short flag.
    shell copy

    mvt-ios check-bootstash --bootstash <path> -V

    Enable usbmuxd debug logging with the new short flag.
    shell copy

    mvt-ios check-finder --debug-mode -v

    • Shortens the VirusTotal integration flag from --virustotal to -V for quicker CLI access.
    • Changes the usbmuxd debug option short flag from -d to -v.

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The VirusTotal integration is now triggered with -V instead of --virustotal; using the old long flag will fail.