MVT (Mobile Verification Toolkit)

What it is

Mobile Verification Toolkit (MVT) is a set of command-line utilities for gathering forensic traces that help identify a potential compromise of Android and iOS devices. Amnesty International's Security Lab released it in July 2021 as part of the Pegasus Project, and Amnesty and other contributors still maintain it. It is source-available under the MVT License 1.1, a modified MPL 2.0.

What it helps with

- Checking iTunes backups, filesystem dumps, and sysdiagnose data from iOS devices with mvt-ios
- Checking Android backups and Android intrusion logs with mvt-android
- Scanning extracted data against public indicators of compromise (IOCs), including those published by Amnesty International
- Following Amnesty's published forensic methodology for spyware investigations

Who it's for

Technologists, forensic investigators, and digital security helpers who are comfortable with command-line tools. The project says it is not intended for end-user self-assessment.

Worth knowing

Use MVT only for lawful, consensual analysis: the license requires the device owner's explicit consent. MVT checks for indicators of compromise, and public indicators alone cannot prove a device is clean, so a result with no matches is not proof that a device was never targeted. Amnesty's Security Lab and Access Now's Digital Security Helpline offer expert help to civil society.

Can MVT check my phone for Pegasus?
MVT was built during the Pegasus Project and can scan device data against public indicators for known spyware campaigns, including NSO Group's Pegasus. The project warns that public indicators can miss recent traces, so a clean scan does not rule out an infection.

Does it work on iPhone and Android?
Yes. MVT has separate tools for iOS (mvt-ios) and Android (mvt-android). It analyzes backups, dumps, and logs taken from the device rather than running on the phone itself.

How does it relate to objection and MobSF?
In our view they serve different jobs: objection and MobSF are for testing and analyzing mobile apps, while MVT is for checking a device's data for signs of spyware compromise.