Who mvt is for#
Digital security helplines triaging compromised devices
Organizations like Access Now's Digital Security Helpline perform device forensics for journalists, activists, and human rights workers who report suspected surveillance. MVT's structured output and IOC matching make it possible to process multiple cases with consistent, documented methodology.
Skip if:
Skip if the device owner has not given explicit consent to the forensic procedure. The MVT license requires data owner consent, and the tool is not appropriate for covert device analysis.
Security researchers investigating mobile spyware campaigns
Researchers studying new spyware campaigns can use MVT's extraction pipeline to build forensic artifact datasets from reference devices. The plugin architecture supports custom detection modules, making MVT useful as a base for novel IOC research beyond the publicly maintained set.
Skip if:
Skip if you are working on Windows. MVT runs on macOS and Linux only; a Linux VM or container is needed for Windows-based researcher workflows.
Investigative journalists verifying device integrity
Journalists covering national security or human rights who suspect surveillance can work with a digital forensics investigator to run MVT on their device. The tool provides documented, reproducible output that can be cited as forensic evidence in published investigations.
Skip if:
Skip if you are attempting self-assessment without forensics training. The README explicitly notes MVT is not suitable for end-user self-assessment, and a false-negative result carries real risk.
IT security teams auditing devices at civil society organizations
NGOs and journalism organizations can run MVT as part of periodic device security audits for staff in high-risk environments. The IOC download command (`mvt download-iocs`) keeps the indicator database current without manual maintenance.
Skip if:
Skip if your organization lacks staff with command-line forensics experience. MVT produces outputs that require forensic interpretation; acting on misread results can create false confidence.
The problem it solves#
When a journalist or human rights defender suspects their device has been compromised by targeted spyware like Pegasus, verifying that suspicion has historically required access to commercial forensics labs and tools with enterprise pricing that civil society organizations cannot match. Tools like Cellebrite UFED and Oxygen Forensic Detective are typically sold to government and law enforcement agencies, leaving security teams supporting at-risk individuals without reliable tooling.
The deeper challenge is that advanced mobile spyware leaves subtle traces distributed across dozens of artifact types: process logs, network connection records, timeline events, crash reports, and browser history. Reliable detection requires systematic extraction of all relevant artifacts and cross-referencing against known compromise indicators. Without automation, this process is too slow and error-prone for organizations handling multiple device cases simultaneously.
How it solves it#
iOS forensic acquisition and analysis
The `mvt-ios` command analyzes both iTunes backups and full filesystem acquisitions, extracting dozens of artifact types including SMS records, call history, browser history, app data, and timeline events. Results are saved to a local directory for offline review and IOC scanning.
Android device analysis over ADB
The `mvt-android` command connects to Android devices over the Android Debug Bridge to extract forensic artifacts without requiring a full device image. This covers installed apps, SMS records, and other indicators accessible over ADB, making triage feasible without root access in many scenarios.
IOC-based spyware detection
MVT supports loading public indicators of compromise from the mvt-indicators repository, maintained by Amnesty International and partner researchers. After extraction, it cross-references device artifacts against these IOCs to flag potential traces of targeting by known campaigns including Pegasus.
Plugin architecture for extended forensic modules
Plugin packages extend MVT with additional forensic modules that run inside the `check-*` commands and add top-level commands on `mvt`, `mvt-ios`, and `mvt-android`. This lets specialized teams add detection logic without modifying the core tool.
Shell completion for Bash, Zsh, and Fish
Running `mvt completion` generates a shell completion script covering all three commands. Pass the shell name directly (`mvt completion bash`) to generate the script without prompts. Completion scripts speed up investigation workflows where analysts run many sequential forensic commands.
Strengths and trade-offs#
Strengths
- Created and maintained by Amnesty International Security LabMVT was built by the team that investigated and exposed the Pegasus spyware campaign in 2021, and continues to be maintained by that team. This institutional backing means IOC databases and forensic methodology reflect active threat intelligence from ongoing civil society investigations, not just community contributions.
- Actively maintained with 13,500+ GitHub starsWith over 13,500 stars and 1,324 forks, MVT has strong adoption among forensic investigators. The repository received its most recent push on September 21, 2026, reflecting ongoing maintenance. 54 open issues indicates active community engagement with a project that is still evolving.
- No cloud component, all data stays on investigator hardwareMVT has no telemetry, no cloud API calls, and no account registration. All forensic data stays on the investigator's machine. This matters when analyzing devices belonging to sources, activists, or individuals under surveillance, where data exfiltration to third-party servers would create additional risk.
- Published forensic methodology, reviewed by security researchersMVT was released alongside Amnesty International's technical forensic methodology from the 2021 Pegasus investigation. The extraction and detection approach is publicly documented, which means findings produced with MVT can be cited in published investigations with traceable methodology.
Trade-offs
- -Requires forensics expertise to interpret results correctlyMVT is explicitly a research tool for technologists and investigators. The README states it requires understanding digital forensics and using command-line tools, and is not intended for end-user self-assessment. The project also warns that public IOCs alone cannot confirm a device is clean: uncharacterized or new spyware variants will not appear in the public databases, and a negative result should not be treated as confirmation of no compromise.
- -MVT License 1.1 is not an OSI-approved open source licenseMVT uses a custom fair-code license. You may use, modify, distribute, and deploy MVT on your own infrastructure, including for commercial internal use. Two conditions apply: the data owner whose device is analyzed must explicitly consent to the forensic procedure (Section 3.0), and distributing MVT in executable form requires making source code available. This differs from MIT or Apache licenses and matters for organizations building services on top of MVT.
- -v3 branch introduced breaking changes to output formatThe recently merged v3 branch introduced breaking changes. Scripts or pipelines that consume MVT's JSON output may break after upgrading. Issue #757 documents the specific changes. Organizations relying on MVT output in downstream tooling should review the migration notes before upgrading.
mvt vs alternatives#
MVT vs Cellebrite UFED
Cellebrite UFED is the dominant commercial product in mobile device forensics, used primarily by law enforcement and government agencies. MVT covers a narrower scope, focusing specifically on spyware detection for civil society, rather than full device extraction for criminal investigation.
| Feature | MVT | Cellebrite UFED |
|---|---|---|
| License | MVT License 1.1 (fair-code) | Proprietary |
| Cost | Free | Enterprise licensing |
| Self-hosting | Yes (macOS, Linux) | No |
| iOS support | Yes (backups + filesystem) | Yes |
| Android support | Yes (ADB) | Yes |
| Spyware IOC matching | Yes | Limited |
| Available to civil society | Yes | Restricted to law enforcement |
MVT is the right choice for security labs and civil society organizations that need to detect targeted spyware without law enforcement credentials or enterprise forensics budgets. Cellebrite UFED has broader extraction capabilities across device types and supports more acquisition methods, making it the appropriate tool when thoroughness and legal chain of custody requirements matter more than cost or access.
MVT vs Oxygen Forensic Detective
Oxygen Forensic Detective is a commercial mobile forensics suite used by corporate security teams and law enforcement for general-purpose device analysis across a wide range of device types.
| Feature | MVT | Oxygen Forensic Detective |
|---|---|---|
| License | MVT License 1.1 (fair-code) | Proprietary |
| Cost | Free | Commercial license required |
| Spyware IOC detection | Yes, via public IOC databases | No dedicated IOC matching |
| Supported platforms | macOS, Linux | Windows |
| Civil society focus | Yes | No specific focus |
MVT's advantage is its integration with Amnesty International's published IOC databases, enabling detection of specific named spyware campaigns. Oxygen Forensic Detective is more appropriate for corporate incident response teams that need broad device type coverage in a Windows workflow, where spyware detection is one part of a wider forensic investigation rather than the primary goal.
Quick start#
Install MVT from PyPI using pip on any system with Python 3.
```bash
pip install mvt
```What it's built on#
- Languages
- Python
FAQ#
Is MVT free to use?
Yes, MVT is free to install and run on your own machine. It uses the MVT License 1.1, a fair-code license that permits use, modification, and deployment on your own infrastructure, including for commercial internal use. The key condition is that the data owner must consent to the forensic analysis (Section 3.0 of the license). There is no per-device fee or subscription.
Does MVT work on both iPhone and Android?
Yes. The mvt-ios command analyzes iOS devices via iTunes backups or full filesystem acquisitions. The mvt-android command analyzes Android devices over ADB. iOS analysis typically extracts more artifact types, particularly from full filesystem acquisitions. Both commands output results in the same format for IOC cross-referencing.
What is the MVT License 1.1?
MVT License 1.1 is a custom fair-code license written specifically for this tool. You may use, modify, distribute, and deploy MVT on your own infrastructure for any purpose, including commercial internal use. Two key restrictions apply: the data owner whose device is being analyzed must explicitly consent to the procedure and be informed of its privacy implications (Section 3.0), and distributing MVT in executable form requires making source code available.
Can MVT definitively prove a device is free from spyware?
No. The README explicitly warns that public indicators of compromise are insufficient to determine that a device is 'clean.' MVT detects traces of known spyware campaigns by matching against published IOCs, but novel or uncharacterized spyware will not appear in those databases. A negative result should not be treated as confirmation of no compromise. Organizations like Amnesty International's Security Lab and Access Now's Digital Security Helpline can provide deeper analysis using non-public indicators.
Who created and maintains MVT?
MVT was created by the Amnesty International Security Lab and released in July 2021 alongside the Pegasus Project investigation. It continues to be maintained by Amnesty International and other contributors. The GitHub repository is actively maintained, with the most recent commit in September 2026.
Similar open-source tools#
OpenFlux
TCP tunneling via Yandex Docs or WebRTC transports
tailcat
Encrypted tunnels between machines, no account or IP needed
airstats
Sixteen macOS metrics in your menu bar at 0.046% CPU
hysteria
Fast and censorship-resistant proxy solution
Tor Browser
Secure browsing through the Tor network with anti-fingerprinting
security-audit-skill
Multi-phase security audits with machine-readable findings