Forensic tooling for investigators
Traces.
Not verdicts.
It gathers forensic traces from an acquisition and checks them against public indicators of compromise. What it cannot do is call a device clean.
pip3 install mvt
what a run can establish
From the project's own warnings- can show
- Traces worth investigatingForensic artifacts from an acquisition, matched against published indicators.
- can show
- Known campaign markersIndicators published by Amnesty International and other research groups.
- cannot show
- That a device is cleanThe project states plainly that public indicators are insufficient to determine a device was not targeted.
The third row is the reason this page exists: a tool that names its own blind spot is more useful than one that does not.
Reliance on public indicators alone can miss recent traces and give a false sense of security.