The Mobile Verification Toolkit is the forensic tool published by Amnesty International's Security Lab, and it is the tool behind the Pegasus Project — the 2021 investigation that put mercenary spyware on front pages worldwide. Its source is public, it costs nothing, and anybody can run it against their own phone.

We sell a commercial product that does a similar class of analysis, so read this with that in mind. MVT is excellent. For a technically confident person it may be all you need, and this guide is written to help you use it rather than to talk you out of it.

What MVT actually does

MVT does not scan your phone the way an antivirus scans a computer. It extracts data the phone already holds and compares it against published indicators of compromise: domains that known spyware contacts, process names it creates, file paths it leaves behind, crash patterns it produces.

That distinction explains both its strength and its limits. It reads evidence rather than asking the phone to assess itself, which is why it can find things no on-device app could. And it only finds what somebody has already published indicators for, which means a campaign nobody has documented yet is invisible to it.

On iOS it analyses an iTunes or Finder backup, which is where the good material lives: crash logs, a database recording which processes used the network and when, the system file recording shutdowns, Safari history and message attachment metadata. An encrypted backup contains meaningfully more than an unencrypted one, which surprises people.

On Android it works over ADB, enumerating installed packages, pulling system logs and checking them against the same indicator sets. It can also analyse an Android backup and scan APKs.

What running it actually involves

The honest part, which download pages tend to skip.

You need a computer, macOS or Linux. Windows is not properly supported; people use WSL.

You need to be comfortable with Python and a terminal. MVT installs with pip:

pip install mvt

That gives you two commands, mvt-ios and mvt-android.

You need an encrypted iPhone backup. Make one with Finder on macOS or iTunes, with the encryption option turned on, and remember the password. MVT decrypts it for analysis:

mvt-ios decrypt-backup -p PASSWORD -d decrypted/ backup-folder/

You need indicator files. MVT can fetch published sets:

mvt-ios download-iocs

Then the analysis itself:

mvt-ios check-backup --iocs indicators.stix2 --output results/ decrypted/

For Android over ADB, with developer options and USB debugging enabled:

mvt-android check-adb --iocs indicators.stix2 --output results/

Flags and command names do change between releases. Check the current documentation at docs.mvt.re rather than trusting any tutorial, including this one, on the exact syntax.

Then you read the output, which is a directory of JSON files plus a set of detections. This is the part that stops most people. The files are timelines and extracted records; interpreting them means knowing what a normal iPhone looks like so you can notice what is not.

Realistically: an afternoon if you work in a terminal daily, and a wall if you do not.

How to read the result

This matters more than the installation, and it is where people go wrong in both directions.

A detection is serious but not self-explanatory. MVT flags what matches an indicator. Confirming what it means, and when it happened, is analysis you still have to do.

No detections does not mean a clean phone. It means nothing matched the indicators you supplied. New campaigns, undocumented tooling and infections that predate your backup all produce a quiet result. Amnesty is explicit about this and it is the single most misunderstood thing about the tool.

Some findings are just interesting. Timelines show a lot of ordinary activity that looks alarming if you have never seen a phone's internals before.

Where MVT is the right answer

You work in a terminal and are not put off by JSON.
You are a journalist, activist, lawyer or researcher who may be a genuine target, and you want tooling with a public, auditable method.
You want something with no commercial interest in the result — an entirely reasonable thing to want from a security tool, and a real advantage of MVT over anything anybody sells you, us included.
You are analysing somebody else's device professionally and need a defensible, documented method.

Where it is not

You are worried, not technical, and need an answer this week.
The likely problem is commercial stalkerware installed by somebody you know, which is far more common than mercenary spyware. That shows up in permission screens; you do not need forensics to find it. Start with Android or iPhone.
You need documentation for a lawyer, an officer or a support worker. MVT's output is evidence, but it is not a readable report.
You need to check repeatedly rather than once.

What Haris Shield does differently

Same class of analysis — external, backup-based, indicator-driven — with the parts that stop people removed: a graphical application instead of a terminal, indicator sets maintained for you, and a report written to be read by somebody who is not a forensic analyst. Scanning is free; the detailed report and monitoring are the paid part.

What we do not claim is that we find things MVT cannot. The underlying method is the same, and where Amnesty's indicators are the best available, they are what anybody sensible builds on. What we sell is the removal of an afternoon of terminal work and the production of something you can hand to another person.

If you can run MVT and want to, run MVT.

If you find something

Do not clean the phone immediately if somebody in your life may be involved — removal can alert them and destroys evidence. And if you may be the target of a state-level actor, get help from people who do this for a living: Amnesty's Security Lab and Access Now's Digital Security Helpline both assist at-risk individuals, free of charge. How to remove spyware without tipping off whoever installed it covers the sequence.

The short answer

MVT is the real thing: the tool behind the Pegasus Project, published by Amnesty's Security Lab, free, with a public method. It analyses an encrypted iPhone backup or an Android device over ADB against published indicators of compromise.

It also assumes Python, a terminal, and the ability to interpret forensic output, and a clean result only means nothing matched the indicators you gave it. If that fits you, use it. If it does not, the method matters more than the tool — get the analysis done from a computer, by something, rather than trusting a scanner running on the phone you are trying to verify.

Sources

Mobile Verification Toolkit: mvt.re and documentation at docs.mvt.re
MVT source code: github.com/mvt-project/mvt
Amnesty International Security Lab, Forensic Methodology Report: How to Catch NSO Group's Pegasus: amnesty.org
Access Now Digital Security Helpline: accessnow.org/help

MVT (Mobile Verification Toolkit): An Honest Guide, and Easier Alternatives