MVT turns phone artifacts into investigative leads, not a clean bill of health
MVT gives a trained investigator 3 command families: mvt-ios, mvt-android, and the shared mvt utility. They examine acquired backups, filesystem material, bug reports, AndroidQF output, and other records for signs that deserve attention. Indicator files can connect a domain, process, or other trace to a known campaign. The result is evidence for an investigation, not an automatic answer about whether a device was compromised.
That distinction is the project's most useful warning. MVT began in July 2021 around Amnesty International's Pegasus Project work, but the README says public indicators alone can miss recent forensic traces. A report with no matches only says that the available modules and supplied indicators found no matches in the available data. The project directs worried device owners toward expert help rather than presenting the command line as self-assessment.
Android results depend on the acquisition and archive shape
MVT's current Android workflow uses AndroidQF to collect artifacts, then mvt-android check-androidqf analyzes the saved output. Direct ADB analysis was removed because collection varied across environments. VirusTotal lookup is optional, sends non-system APK hashes to the service, and waits 16 seconds between requests by default to respect free quotas. That is a disclosure decision as well as a configuration switch.
Two open reports show why analysts must inspect command logs and output contents. Issue 935 describes Xiaomi-family wrapper archives that can finish with exit code 0 yet produce an almost empty result because the actual bug report sits inside another ZIP. Issue 938 shows a timing line truncating one parsed section without a warning. In its supplied example, only 418 of roughly 1,259 properties remained. These are specific Android paths, not proof that every parser is unreliable, but they rule out treating process success as evidence completeness.
iOS analysis starts with choosing what evidence to preserve
MVT's iOS workflow can inspect backups, filesystem dumps, sysdiagnose material, crash records, and related artifacts. The methodology guide asks investigators to decide on acquisition before running analysis. An encrypted backup exposes some records that an unencrypted one does not. A full filesystem dump can reveal more, yet jailbreaking may alter records or affect a device that must be returned. MVT helps analyze the resulting material; it does not make that evidence-handling choice for you.
The tooling around acquisition adds real setup work. The iOS guide recommends libimobiledevice and notes that recent iOS changes may force users to compile its utilities from source. Android work needs current SDK Platform Tools, and native Windows is not officially supported. There is also a documentation mismatch: commit e0697a5 requires Python 3.10 or newer in pyproject.toml, while the general installation page still says Python 3.6+. Follow the package metadata for the tested checkout.
What happened when we ran it
Our sandbox installed commit e0697a5 in 20 seconds. It pulled 63 packages and occupied 76 MB on disk. The build completed in 0 seconds, so packaging itself added no meaningful delay in this 3-CPU, 8 GB Debian container. Pip-audit reported 0 known vulnerabilities in the installed Python dependency set. The checkout contained 349 files and roughly 33,210 lines of source across 6.8 MB.
The test command failed with exit code 4 after 1 second, before any test result was reported. Pytest loaded tests/conftest.py, followed an import into the STIX test artifact generator, and stopped with ModuleNotFoundError: No module named 'stix2'. The log does not establish why that module was absent. The repository's pyproject.toml lists stix2 in its development dependency group, so anyone verifying a source checkout should confirm that group is installed before reading the suite result. Seven CI workflow files, a Dockerfile, and a tests directory are present.
The consent restriction changes how teams can reuse the code
MVT does not use a standard OSI-approved license. Its license adapts MPL 2.0 with a clause allowing data extraction or analysis only with the explicit consent of the data owner. The project's own explanation says this restriction may conflict with both the Free Software Foundation's freedom 0 and the Open Source Initiative's rule against restricting a field of endeavor. A civil-society lab may welcome that boundary. A vendor with a standard open-source intake policy needs legal review before reuse or redistribution.
The September 21 release shows active maintenance and live parser work
GitHub recorded 13,404 stars, 52 combined open issues and pull requests, and a last push on September 21, 2026. Release v2026.9.21 arrived the same day with an iOS data update, an iphone_backup_decrypt bump, and a correction for Android mount detection. Recent issue activity includes archive discovery and silent truncation reports, alongside a quick fix for a false high-severity mount result. That pattern looks maintained, while also showing how new device formats keep moving the target.
MVT belongs in a consented investigation where someone will preserve the raw acquisition, pin the tool version, read the logs, and revisit the data as parsers and indicators improve. The 20-second install makes a trial cheap. The failed test startup and current Android parser reports make verification mandatory. If your process ends at a green exit code or an empty alert file, MVT cannot supply the judgment that process lacks.