Check stable results in parallel module tests

Keep settings history timestamps on 29 February

Dockerfile

@@ -1,107 +1,3 @@
-# Base image for building libraries
-# ---------------------------------
-FROM ubuntu:22.04 AS build-base
-
-ARG DEBIAN_FRONTEND=noninteractive
-
-# Install build tools and dependencies
-RUN apt-get update \
-  && apt-get install -y \
-  build-essential \
-  git \
-  autoconf \
-  automake \
-  libtool-bin \
-  pkg-config \
-  libcurl4-openssl-dev \
-  libusb-1.0-0-dev \
-  libssl-dev \
-  udev \
-  && rm -rf /var/lib/apt/lists/*
-
-
-# libplist
-# --------
-FROM build-base AS build-libplist
-
-# Build
-RUN git clone https://github.com/libimobiledevice/libplist && cd libplist \
-  && ./autogen.sh && make -j "$(nproc)" && make install DESTDIR=/build \
-  && cd .. && rm -rf libplist
-
-
-# libimobiledevice-glue
-# ---------------------
-FROM build-base AS build-libimobiledevice-glue
-
-# Install dependencies
-COPY --from=build-libplist /build /
-
-# Build
-RUN git clone https://github.com/libimobiledevice/libimobiledevice-glue && cd libimobiledevice-glue \
-  && ./autogen.sh && make -j "$(nproc)" && make install DESTDIR=/build \
-  && cd .. && rm -rf libimobiledevice-glue
-
-
-# libtatsu
-# --------
-FROM build-base AS build-libtatsu
-
-# Install dependencies
-COPY --from=build-libplist /build /
-
-# Build
-RUN git clone https://github.com/libimobiledevice/libtatsu && cd libtatsu \
-  && ./autogen.sh && make -j "$(nproc)" && make install DESTDIR=/build \
-  && cd .. && rm -rf libtatsu
-
-
-# libusbmuxd
-# ----------
-FROM build-base AS build-libusbmuxd
-
-# Install dependencies
-COPY --from=build-libplist /build /
-COPY --from=build-libimobiledevice-glue /build /
-
-# Build
-RUN git clone https://github.com/libimobiledevice/libusbmuxd && cd libusbmuxd \
-  && ./autogen.sh && make -j "$(nproc)" && make install DESTDIR=/build \
-  && cd .. && rm -rf libusbmuxd
-
-
-# libimobiledevice
-# ----------------
-FROM build-base AS build-libimobiledevice
-
-# Install dependencies
-COPY --from=build-libplist /build /
-COPY --from=build-libtatsu /build /
-COPY --from=build-libimobiledevice-glue /build /
-COPY --from=build-libusbmuxd /build /
-
-# Build
-RUN git clone https://github.com/libimobiledevice/libimobiledevice && cd libimobiledevice \
-  && ./autogen.sh --enable-debug && make -j "$(nproc)" && make install DESTDIR=/build \
-  && cd .. && rm -rf libimobiledevice
-
-
-# usbmuxd
-# -------
-FROM build-base AS build-usbmuxd
-
-# Install dependencies
-COPY --from=build-libplist /build /
-COPY --from=build-libimobiledevice-glue /build /
-COPY --from=build-libusbmuxd /build /
-COPY --from=build-libimobiledevice /build /
-
-# Build
-RUN git clone https://github.com/libimobiledevice/usbmuxd && cd usbmuxd \
-  && ./autogen.sh --sysconfdir=/etc --localstatedir=/var --runstatedir=/run && make -j "$(nproc)" && make install DESTDIR=/build \
-  && cd .. && rm -rf usbmuxd && mv /build/lib /build/usr/lib
-
-
 # Create main image
 FROM ubuntu:24.04 AS main
 COPY --from=ghcr.io/astral-sh/uv:0.11.8 /uv /uvx /usr/local/bin/
@@ -112,7 +8,7 @@ LABEL org.opencontainers.image.source="https://github.com/mvt-project/mvt"
 LABEL org.opencontainers.image.title="Mobile Verification Toolkit"
 LABEL org.opencontainers.image.description="MVT is a forensic tool to look for signs of infection in smartphone devices."
 LABEL org.opencontainers.image.licenses="MVT License 1.1"
-LABEL org.opencontainers.image.base.name=docker.io/library/ubuntu:22.04
+LABEL org.opencontainers.image.base.name=docker.io/library/ubuntu:24.04
 
 # Install runtime dependencies
 ARG DEBIAN_FRONTEND=noninteractive
@@ -125,7 +21,6 @@ RUN apt-get update \
   git \
   jq \
   less \
-  libcurl4 \
   libimage-exiftool-perl \
   libssl3 \
   libusb-1.0-0 \
@@ -136,18 +31,20 @@ RUN apt-get update \
   sqlite3 \
   tree \
   unzip \
-  xxd
-COPY --from=build-libplist /build /
-COPY --from=build-libimobiledevice-glue /build /
-COPY --from=build-libtatsu /build /
-COPY --from=build-libusbmuxd /build /
-COPY --from=build-libimobiledevice /build /
-COPY --from=build-usbmuxd /build /
+  xxd \
+  && rm -rf /var/lib/apt/lists/*
 
-# Install mvt using the locally checked out source
+# Install MVT and pymobiledevice3. Native build dependencies are needed on ARM64.
+ARG PYMOBILEDEVICE3_VERSION=11.12.4
 COPY . mvt/
-RUN uv pip install --system --break-system-packages --no-cache ./mvt \
-  && rm -rf mvt
+RUN apt-get update \
+  && apt-get install -y --no-install-recommends build-essential python3-dev libssl-dev \
+  && uv pip install --system --break-system-packages --no-cache ./mvt "pymobiledevice3==${PYMOBILEDEVICE3_VERSION}" \
+  && apt-get purge -y --auto-remove build-essential python3-dev libssl-dev \
+  && rm -rf mvt /var/lib/apt/lists/* \
+  && pymobiledevice3 --help > /dev/null \
+  && pymobiledevice3 backup2 --help > /dev/null \
+  && mvt-ios --help > /dev/null
 
 # Installing ABE
 ADD --checksum=sha256:a20e07f8b2ea47620aff0267f230c3f1f495f097081fd709eec51cf2a2e11632 \

Dockerfile.ios

@@ -1,110 +1,6 @@
-# Base image for building libraries
-# ---------------------------------
-FROM ubuntu:22.04 AS build-base
-
-ARG DEBIAN_FRONTEND=noninteractive
-
-# Install build tools and dependencies
-RUN apt-get update \
-  && apt-get install -y \
-  build-essential \
-  git \
-  autoconf \
-  automake \
-  libtool-bin \
-  pkg-config \
-  libcurl4-openssl-dev \
-  libusb-1.0-0-dev \
-  libssl-dev \
-  udev \
-  && rm -rf /var/lib/apt/lists/*
-
-
-# libplist
-# --------
-FROM build-base AS build-libplist
-
-# Build
-RUN git clone https://github.com/libimobiledevice/libplist && cd libplist \
-  && ./autogen.sh && make -j "$(nproc)" && make install DESTDIR=/build \
-  && cd .. && rm -rf libplist
-
-
-# libimobiledevice-glue
-# ---------------------
-FROM build-base AS build-libimobiledevice-glue
-
-# Install dependencies
-COPY --from=build-libplist /build /
-
-# Build
-RUN git clone https://github.com/libimobiledevice/libimobiledevice-glue && cd libimobiledevice-glue \
-  && ./autogen.sh && make -j "$(nproc)" && make install DESTDIR=/build \
-  && cd .. && rm -rf libimobiledevice-glue
-
-
-# libtatsu
-# --------
-FROM build-base AS build-libtatsu
-
-# Install dependencies
-COPY --from=build-libplist /build /
-
-# Build
-RUN git clone https://github.com/libimobiledevice/libtatsu && cd libtatsu \
-  && ./autogen.sh && make -j "$(nproc)" && make install DESTDIR=/build \
-  && cd .. && rm -rf libtatsu
-
-
-# libusbmuxd
-# ----------
-FROM build-base AS build-libusbmuxd
-
-# Install dependencies
-COPY --from=build-libplist /build /
-COPY --from=build-libimobiledevice-glue /build /
-
-# Build
-RUN git clone https://github.com/libimobiledevice/libusbmuxd && cd libusbmuxd \
-  && ./autogen.sh && make -j "$(nproc)" && make install DESTDIR=/build \
-  && cd .. && rm -rf libusbmuxd
-
-
-# libimobiledevice
-# ----------------
-FROM build-base AS build-libimobiledevice
-
-# Install dependencies
-COPY --from=build-libplist /build /
-COPY --from=build-libtatsu /build /
-COPY --from=build-libimobiledevice-glue /build /
-COPY --from=build-libusbmuxd /build /
-
-# Build
-RUN git clone https://github.com/libimobiledevice/libimobiledevice && cd libimobiledevice \
-  && ./autogen.sh --enable-debug && make -j "$(nproc)" && make install DESTDIR=/build \
-  && cd .. && rm -rf libimobiledevice
-
-
-# usbmuxd
-# -------
-FROM build-base AS build-usbmuxd
-
-# Install dependencies
-COPY --from=build-libplist /build /
-COPY --from=build-libimobiledevice-glue /build /
-COPY --from=build-libusbmuxd /build /
-COPY --from=build-libimobiledevice /build /
-
-# Build
-RUN git clone https://github.com/libimobiledevice/usbmuxd && cd usbmuxd \
-  && ./autogen.sh --sysconfdir=/etc --localstatedir=/var --runstatedir=/run && make -j "$(nproc)" && make install DESTDIR=/build \
-  && cd .. && rm -rf usbmuxd && mv /build/lib /build/usr/lib
-
-
 # Main image
 # ----------
-FROM python:3.10.14-alpine3.20 AS main
+FROM ubuntu:24.04 AS main
 COPY --from=ghcr.io/astral-sh/uv:0.11.8 /uv /uvx /usr/local/bin/
 
 LABEL org.opencontainers.image.url="https://mvt.re"
@@ -113,26 +9,30 @@ LABEL org.opencontainers.image.source="https://github.com/mvt-project/mvt"
 LABEL org.opencontainers.image.title="Mobile Verification Toolkit (iOS)"
 LABEL org.opencontainers.image.description="MVT is a forensic tool to look for signs of infection in smartphone devices."
 LABEL org.opencontainers.image.licenses="MVT License 1.1"
-LABEL org.opencontainers.image.base.name=docker.io/library/python:3.10.14-alpine3.20
+LABEL org.opencontainers.image.base.name=docker.io/library/ubuntu:24.04
 
 # Install runtime dependencies
-RUN apk add --no-cache \
-  gcompat \
-  libcurl \
+ARG DEBIAN_FRONTEND=noninteractive
+RUN apt-get update \
+  && apt-get install -y --no-install-recommends \
+  ca-certificates \
+  git \
   libssl3 \
-  libusb \
-  sqlite
-COPY --from=build-libplist /build /
-COPY --from=build-libimobiledevice-glue /build /
-COPY --from=build-libtatsu /build /
-COPY --from=build-libusbmuxd /build /
-COPY --from=build-libimobiledevice /build /
-COPY --from=build-usbmuxd /build /
+  libusb-1.0-0 \
+  python3 \
+  sqlite3 \
+  && rm -rf /var/lib/apt/lists/*
 
-# Install mvt using the locally checked out source
-COPY ./ mvt
-RUN apk add --no-cache --virtual .build-deps git gcc musl-dev \
-  && uv pip install --system --no-cache ./mvt \
-  && apk del .build-deps git gcc musl-dev && rm -rf ./mvt
+# Install MVT and pymobiledevice3. Native build dependencies are needed on ARM64.
+ARG PYMOBILEDEVICE3_VERSION=11.12.4
+COPY . mvt/
+RUN apt-get update \
+  && apt-get install -y --no-install-recommends build-essential python3-dev libssl-dev \
+  && uv pip install --system --break-system-packages --no-cache ./mvt "pymobiledevice3==${PYMOBILEDEVICE3_VERSION}" \
+  && apt-get purge -y --auto-remove build-essential python3-dev libssl-dev \
+  && rm -rf mvt /var/lib/apt/lists/* \
+  && pymobiledevice3 --help > /dev/null \
+  && pymobiledevice3 backup2 --help > /dev/null \
+  && mvt-ios --help > /dev/null
 
 ENTRYPOINT [ "/usr/local/bin/mvt-ios" ]

Makefile

@@ -31,4 +31,3 @@ clean:
 
 dist:
 	$(UV) build
-

README.md

@@ -86,6 +86,11 @@ writing and installing them, and the
 [custom CLI command documentation](https://docs.mvt.re/en/latest/development/custom_commands/)
 for the entry points a package registers commands in.
 
+Extraction commands run independent modules concurrently with four workers by
+default. Use `--jobs 1` for sequential execution or another positive value to
+set the worker limit. Dependencies retain their declared ordering, and parallel
+console logs are printed as grouped module blocks.
+
 
 ## License
 

docs/development/index.md

@@ -46,6 +46,33 @@ on it, and runs the rest of the analysis. Selecting such a module with
 A cycle in the dependency graph is a programming error rather than a
 configuration problem: the command logs a warning and runs no modules at all.
 
+## Parallel module execution
+
+Extraction modules run concurrently, using four worker threads by default. Use
+`--jobs INTEGER` to change the worker limit, or `--jobs 1` for sequential
+execution and live per-line logging:
+
+```bash
+mvt-ios check-backup --jobs 8 --output ./out ./backup
+```
+
+The scheduler starts a module only after all of its declared dependencies have
+completed. Results, alerts, and timeline entries are still aggregated in stable
+topological order. During parallel execution, console records from each module
+are buffered and printed together as a labeled block when that module finishes;
+`command.log` is written immediately and retains the complete log stream.
+
+Parallel-safe modules must log through `self.log`, must not write directly to
+stdout or stderr, and must not mutate shared global state. A module that uses a
+non-thread-safe resource or direct terminal output can opt out:
+
+```python
+class TerminalModule(MVTModule):
+    parallel_safe = False
+```
+
+Such modules run synchronously and exclusively after active workers finish.
+
 ## Custom modules
 
 MVT's module-running `check-*` commands can run forensic modules which are not
@@ -382,7 +409,8 @@ module came from:
 Some MVT modules extract and process significant amounts of data during the analysis process or while checking results against known indicators. Care must be
 take to avoid inefficient code paths as we add new modules.
 
-MVT modules can be profiled with Python built-in `cProfile` by setting the `MVT_PROFILE` environment variable.
+MVT modules can be profiled with Python built-in `cProfile` by setting the `MVT_PROFILE` environment variable. Profiling forces sequential execution even
+when `--jobs` is greater than one.
 
 ```bash
 MVT_PROFILE=1 dev/mvt-ios check-backup test_backup

docs/docker.md

@@ -1,4 +1,6 @@
-Using Docker simplifies having all the required dependencies and tools (including most recent versions of [libimobiledevice](https://libimobiledevice.org)) readily installed. Note that this requires a Linux host, as Docker for Windows and Mac [doesn't support passing through USB devices](https://docs.docker.com/desktop/faqs/#can-i-pass-through-a-usb-device-to-a-container).
+Using Docker simplifies running MVT with its dependencies readily installed. Note that this requires a Linux host, as Docker for Windows and Mac [doesn't support passing through USB devices](https://docs.docker.com/desktop/faqs/#can-i-pass-through-a-usb-device-to-a-container).
+
+The main and iOS Docker images include pymobiledevice3 for [creating iOS backups](ios/backup/pymobiledevice3.md). You do not need to install it separately on the host. Older image tags may still include libimobiledevice instead; build from the updated source if pymobiledevice3 is unavailable.
 
 Install Docker following the [official documentation](https://docs.docker.com/get-docker/).
 
@@ -37,12 +39,31 @@ If a prompt is spawned successfully, you can close it with `exit`.
 
 On the Linux host, install and start [usbmuxd](https://github.com/libimobiledevice/usbmuxd), then connect and unlock the iOS device. The daemon exposes the device through the `/var/run/usbmuxd` socket.
 
-Bind that socket into the container to let MVT communicate with the device:
+Bind that socket into the container to let pymobiledevice3 communicate with the device. Also mount a local directory so acquired backups persist after the container exits:
 
 ```bash
-docker run -it \
+mkdir -p "$PWD/cases"
+docker run --rm -it \
     --mount type=bind,source=/var/run/usbmuxd,target=/var/run/usbmuxd \
+    --mount type=bind,source="$PWD/cases",target=/home/cases \
     ghcr.io/mvt-project/mvt
 ```
 
-If you built the image from source, replace `ghcr.io/mvt-project/mvt` with `mvt`. 
+Inside the container, verify connectivity:
+
+```bash
+pymobiledevice3 lockdown info
+```
+
+Accept the trust prompt on the unlocked device if requested. Then follow the [backup instructions](ios/backup/pymobiledevice3.md), using a destination under `/home/cases`, such as `/home/cases/backup`.
+
+The iOS-only image defaults to running `mvt-ios`. To use pymobiledevice3 instead, override its entrypoint:
+
+```bash
+docker run --rm -it \
+    --mount type=bind,source=/var/run/usbmuxd,target=/var/run/usbmuxd \
+    --entrypoint pymobiledevice3 \
+    ghcr.io/mvt-project/mvt:latest-ios lockdown info
+```
+
+If you built the image from source, replace `ghcr.io/mvt-project/mvt` with `mvt`.

docs/install.md

@@ -1,6 +1,6 @@
 # Installation
 
-Before proceeding, please note that MVT requires Python 3.6+ to run. While it should be available on most operating systems, please make sure of that before proceeding.
+Before proceeding, please note that MVT requires Python 3.10 or newer to run. While it should be available on most operating systems, please make sure of that before proceeding.
 
 ## Dependencies on Linux
 

docs/ios/backup/libimobiledevice.md

@@ -1,19 +1,3 @@
 # Backup with libimobiledevice
 
-If you have correctly [installed libimobiledevice](../install.md) you can easily generate an iTunes backup using the `idevicebackup2` tool included in the suite. First, you might want to ensure that backup encryption is enabled (**note: encrypted backup contain more data than unencrypted backups**):
-
-```bash
-idevicebackup2 -i encryption on
-```
-
-Note that if a backup password was previously set on this device, you might need to use the same or change it. You can try changing password using `idevicebackup2 -i changepw`, or by turning off encryption (`idevicebackup2 -i encryption off`) and turning it back on again.
-
-If you are not able to recover or change the password, you should try to disable encryption and obtain an unencrypted backup.
-
-If all else fails, as a *last resort* you can try resetting the password by [resetting all the settings through the iPhone's Settings app](https://support.apple.com/en-us/HT205220), via `Settings » General » Reset » Reset All Settings`.  Note that resetting the settings through the iPhone's Settings app will wipe some of the files that contain useful forensic traces, so try the options explained above first.
-
-Once ready, you can proceed performing the backup:
-
-```bash
-idevicebackup2 backup --full /path/to/backup/
-```
+We now recommend pymobiledevice3 for iOS backups. See [Backup with pymobiledevice3](pymobiledevice3.md) for the current instructions.

docs/ios/backup/pymobiledevice3.md

@@ -0,0 +1,37 @@
+# Backup with pymobiledevice3
+
+After [installing pymobiledevice3](../install.md) and pairing your device, you can generate an iTunes-compatible backup using its `backup2` commands.
+
+## Enable backup encryption
+
+We recommend encrypted backups because they contain more data than unencrypted backups. If encryption is not already enabled, enable it with:
+
+```bash
+pymobiledevice3 backup2 encryption on 'YOUR_BACKUP_PASSWORD'
+```
+
+Replace `YOUR_BACKUP_PASSWORD` with a strong password and keep it safe: you will need it to decrypt the backup for analysis. Passwords supplied on the command line may be saved in shell history or visible to other processes.
+
+If a backup password was previously set, use that password. To change a known password:
+
+```bash
+pymobiledevice3 backup2 change-password 'CURRENT_PASSWORD' 'NEW_PASSWORD'
+```
+
+You can also disable encryption with `pymobiledevice3 backup2 encryption off 'CURRENT_PASSWORD'` and then enable it again. Disabling encryption requires the current password; it is not a way to bypass an unknown password.
+
+!!! warning
+    If you cannot recover the password, resetting it through [Reset All Settings in the iPhone's Settings app](https://support.apple.com/en-us/HT205220) should be a last resort. Resetting settings can remove files containing useful forensic traces.
+
+## Create a backup
+
+Choose a new destination directory to avoid overwriting an earlier acquisition:
+
+```bash
+mkdir -p /path/to/backup/
+pymobiledevice3 backup2 backup --full /path/to/backup/
+```
+
+The backup is saved in a subdirectory named after the device's UDID, such as `/path/to/backup/udid/`. Follow [Check a Backup with mvt-ios](check.md) to decrypt and analyze that directory.
+
+For additional options, see the [pymobiledevice3 backup2 reference](https://doronz88.github.io/pymobiledevice3/cli/backup2/).

docs/ios/install.md

@@ -1,55 +1,44 @@
-# Install libimobiledevice
+# Install pymobiledevice3
 
-Before proceeding with doing any acquisition of iOS devices we recommend installing [libimobiledevice](https://libimobiledevice.org/) utilities. These utilities will become useful when extracting crash logs and generating iTunes backups. Because the utilities and its libraries are subject to frequent changes in response to new versions of iOS, you might want to consider compiling libimobiledevice utilities from sources. Otherwise, if available, you can try installing packages available in your distribution:
+Before acquiring data from an iOS device, we recommend installing [pymobiledevice3](https://github.com/doronz88/pymobiledevice3). It provides command-line tools for generating iTunes-compatible backups and extracting crash logs.
+
+## Installation
+
+Install `pipx` following the [MVT installation instructions](../install.md), then run:
 
 ```bash
-sudo apt install libimobiledevice-utils
+pipx install pymobiledevice3
 ```
 
-On Mac, you can try installing it from brew:
+To update an existing installation:
 
 ```bash
-brew install --HEAD libimobiledevice
+pipx upgrade pymobiledevice3
 ```
 
-If you have a reasonably recent version of libimobiledevice in your package manager, it might work straight out of the box. Try connecting your iOS device to your computer via USB and run:
+On Linux, you also need `usbmuxd` to communicate with devices over USB. On Debian and Ubuntu, install it with:
 
 ```bash
-ideviceinfo
+sudo apt install usbmuxd
 ```
 
-If you encounter unexpected issues, uninstall the packages and try compiling libimobiledevcice from sources.
+macOS includes the required USB device service. For other platforms and additional requirements, see the [pymobiledevice3 installation documentation](https://doronz88.github.io/pymobiledevice3/installation/).
 
-## Compile libimobiledevice from sources
+## Verify connectivity
 
-!!! warning
-    The following instructions are a best effort. The installation from source requires several steps, and it is likely some have been forgotten here and that won't work for you. You will likely need to fiddle around a bit before getting this right.
-
-Make sure you have uninstalled all the libimobiledevice tools from your package manage:
+Connect the iOS device to your computer with a USB cable and unlock it. Accept the **Trust This Computer** prompt and enter the device passcode if requested. Then run:
 
 ```bash
-sudo apt remove --purge libimobiledevice-utils libimobiledevice-dev libimobiledevice6 libplist-dev libplist3 libusbmuxd-dev libusbmuxd-tools libusbmuxd4 libusbmuxd6 usbmuxd
+pymobiledevice3 usbmux list
+pymobiledevice3 lockdown info
 ```
 
-Firstly you need to install [libplist](https://github.com/libimobiledevice/libplist). Then you can install [libusbmuxd](https://github.com/libimobiledevice/libusbmuxd).
-
-Now you should be able to to download and install the actual suite of tools at [https://github.com/libimobiledevice/libimobiledevice](https://github.com/libimobiledevice/libimobiledevice).
-
-You can now also build and install [usbmuxd](https://github.com/libimobiledevice/usbmuxd).
-
-## Making sure everything works fine.
-
-Once the idevice tools are available you can check if everything works fine by connecting your iOS device and running:
+These commands should list the connected device and display its details. If pairing is needed, run:
 
 ```bash
-ideviceinfo
+pymobiledevice3 lockdown pair
 ```
 
-This should show many details on the connected iOS device. If you are connecting the device to your laptop for the first time, it will require to unlock and enter the PIN code on the mobile device. If it complains that no device is connected and the mobile device is indeed plugged in through the USB cable, you might need to do this first, although typically the pairing is automatically done when connecting the device:
+If no device is found, check the USB connection, make sure the device is unlocked, and, on Linux, check that `usbmuxd` is running. See the [upstream troubleshooting guide](https://doronz88.github.io/pymobiledevice3/guides/troubleshooting/) for further help.
 
-```bash
-sudo usbmuxd -f -v
-idevicepair pair
-```
-
-Again, it will ask to unlock the phone and enter the PIN code. 
+Once connected, follow the [backup instructions](backup/pymobiledevice3.md).

docs/ios/records.md

@@ -204,6 +204,10 @@ This JSON file is created by mvt-ios' `Manifest` module. The module extracts rec
 
 If indicators are provided through the command-line, they are checked against the original relative path in case. In some cases, there might be records of files created containing a domain name in their name, for example in the case of browser cache folders. Any matches are stored in *manifest_detected.json*.
 
+An incomplete backup still lists in its manifest the files it failed to acquire. Those records carry a `"missing": true` field, and the module reports how many of them it found. Use it to tell a module which returned nothing because the artifact was not acquired apart from one which found nothing on a device that never had it.
+
+Files must be stored at their expected paths inside the backup folder. If the module cannot finish listing the backup files, it logs a warning and skips the missing-file check; the manifest metadata is still extracted.
+
 ---
 
 ### `os_analytics_ad_daily.json`

mkdocs.yml

@@ -5,6 +5,7 @@ copyright: Copyright © 2021-2023 MVT Project Developers
 site_description: Mobile Verification Toolkit Documentation
 not_in_nav: |
     android/adb.md
+    ios/backup/libimobiledevice.md
 markdown_extensions:
     - attr_list
     - admonition
@@ -34,10 +35,10 @@ nav:
     - Using Docker: "docker.md"
     - MVT for iOS:
         - iOS Forensic Methodology: "ios/methodology.md"
-        - Install libimobiledevice: "ios/install.md"
+        - Install pymobiledevice3: "ios/install.md"
         - Check an iTunes Backup:
             - Backup with iTunes app: "ios/backup/itunes.md"
-            - Backup with libimobiledevice: "ios/backup/libimobiledevice.md"
+            - Backup with pymobiledevice3: "ios/backup/pymobiledevice3.md"
             - Check a Backup with mvt-ios: "ios/backup/check.md"
         - Check a Filesystem Dump:
             - Dumping the filesystem: "ios/filesystem/dump.md"

src/mvt/android/artifacts/dumpsys_accessibility.py

@@ -10,8 +10,45 @@ from .artifact import AndroidArtifact
 
 
 class DumpsysAccessibilityArtifact(AndroidArtifact):
+    # One list for both record shapes — a service record and a count-only
+    # record must stay the same shape.
+    _FIELDS = (
+        "user_id",
+        "component",
+        "package_name",
+        "service_name",
+        "installed",
+        "enabled",
+        "binding",
+        "bound",
+        "crashed",
+        "accessibility_tool",
+        "installed_service_count",
+        "unnamed_service_count",
+    )
+
     def check_indicators(self) -> None:
         for result in self.results:
+            # A stated count the dump does not back with component names is a
+            # coverage statement, not a service: low, but not silent.
+            if not result.get("component"):
+                stated = result["installed_service_count"]
+                unnamed = result["unnamed_service_count"]
+                if unnamed == stated:
+                    detail = "does not list their component names"
+                else:
+                    detail = (
+                        f"lists the component names of only {stated - unnamed} "
+                        f"of them ({unnamed} unnamed)"
+                    )
+                self.alertstore.low(
+                    f"The accessibility dump states {stated} installed "
+                    f"service(s) for user {result['user_id']} but {detail}",
+                    "",
+                    result,
+                )
+                continue
+
             if self.indicators:
                 ioc_match = self.indicators.check_app_id(result["package_name"])
                 if ioc_match:
@@ -20,11 +57,22 @@ class DumpsysAccessibilityArtifact(AndroidArtifact):
                     )
                     continue
 
-            self.alertstore.medium(
-                f'Found accessibility service: "{result["component"]}"',
-                "",
-                result,
+            # Installed is not enabled. A service can sit installed for years
+            # without ever being switched on, and that is the difference this
+            # channel is read for — an alert that says only "found" makes every
+            # device look equally exposed. A service the dump says is switched
+            # OFF is reported LOW, so it still reaches the analyst without
+            # competing with one that is actually running; a dump that does not
+            # state the enabled state stays MEDIUM, because "not stated" is not
+            # "not enabled".
+            message = (
+                f'Found accessibility service: "{result["component"]}" '
+                f"({self._describe_state(result)})"
             )
+            if result.get("enabled") is False and not result.get("bound"):
+                self.alertstore.low(message, "", result)
+            else:
+                self.alertstore.medium(message, "", result)
 
     def parse(self, content: str) -> None:
         """
@@ -36,6 +84,13 @@ class DumpsysAccessibilityArtifact(AndroidArtifact):
 
         self.results: list[dict[str, Any]] = []
         services: dict[tuple[int | None, str], dict] = {}
+        # Which state sections the dump printed, per user: one user's printed
+        # `enabled services` says nothing about another user's.
+        seen_states: dict[int | None, set[str]] = {}
+        # `installedServiceCount=N` from the user's `attributes:{…}` line is on
+        # most builds the only statement about installed services in the dump:
+        # few print the `installed services: {…}` block.
+        installed_counts: dict[int | None, int] = {}
         user_id: int | None = None
         state: str | None = None
 
@@ -44,6 +99,10 @@ class DumpsysAccessibilityArtifact(AndroidArtifact):
             if user_match:
                 user_id = int(user_match.group(1))
 
+            count_match = re.search(r"installedServiceCount=(\d+)", line)
+            if count_match:
+                installed_counts[user_id] = int(count_match.group(1))
+
             stripped = line.strip()
             state_match = re.match(
                 r"(?i)(installed|enabled|binding|bound|crashed) services\s*:\s*\{(.*)",
@@ -51,6 +110,7 @@ class DumpsysAccessibilityArtifact(AndroidArtifact):
             )
             if state_match:
                 state = state_match.group(1).lower()
+                seen_states.setdefault(user_id, set()).add(self._state_field(state))
                 inline = state_match.group(2)
                 for component in re.findall(
                     r"\{?([\w.$-]+/[\w.$-]+)(?:\s+\(A11yTool\))?\}?", inline
@@ -79,24 +139,65 @@ class DumpsysAccessibilityArtifact(AndroidArtifact):
                 service[self._state_field(state)] = True
                 service["accessibility_tool"] = "(A11yTool)" in stripped
 
+        # A section that was never printed is NOT the same as one printed
+        # empty: the first says nothing, the second says nothing is enabled.
+        # Defaulting every flag to False would turn "not stated" into "not
+        # enabled". Flags for sections this dump never printed stay None.
+        named: dict[int | None, int] = {}
+        for (service_user, _component), service in services.items():
+            printed = seen_states.get(service_user, set())
+            for state in ("installed", "enabled", "binding", "bound", "crashed"):
+                if self._state_field(state) not in printed:
+                    service[self._state_field(state)] = None
+            service["installed_service_count"] = installed_counts.get(service_user)
+            named[service_user] = named.get(service_user, 0) + 1
+
         self.results.extend(services.values())
 
+        # A stated count the named services do not add up to would leave no
+        # trace of the rest: the module would log "a total of 0" about a dump
+        # that said five, or "a total of 1" about one that said two.
+        for count_user, count in installed_counts.items():
+            unnamed = count - named.get(count_user, 0)
+            if unnamed > 0:
+                self.results.append(self._new_unlisted(count_user, count, unnamed))
+
+    @staticmethod
+    def _describe_state(result: dict) -> str:
+        if result.get("bound"):
+            return "enabled and bound"
+        if result.get("enabled"):
+            return "enabled"
+        if result.get("enabled") is None:
+            return "installed, enabled state not stated"
+        return "installed, not enabled"
+
     @staticmethod
     def _state_field(state: str) -> str:
         return {"binding": "binding", "bound": "bound"}.get(state, state)
 
+    @staticmethod
+    def _new_unlisted(user_id: int | None, count: int, unnamed: int) -> dict:
+        """The dump's own count for a user, and how many of those services it
+        did not name.
+
+        Every other field stays unknown: the dump named no service to carry it.
+        """
+        record: dict[str, Any] = dict.fromkeys(DumpsysAccessibilityArtifact._FIELDS)
+        record["user_id"] = user_id
+        record["installed_service_count"] = count
+        record["unnamed_service_count"] = unnamed
+        return record
+
     @staticmethod
     def _new_service(component: str, user_id: int | None) -> dict:
-        package_name, service_name = component.split("/", 1)
-        return {
-            "user_id": user_id,
-            "component": component,
-            "package_name": package_name,
-            "service_name": service_name,
-            "installed": False,
-            "enabled": False,
-            "binding": False,
-            "bound": False,
-            "crashed": False,
-            "accessibility_tool": False,
-        }
+        record: dict[str, Any] = dict.fromkeys(
+            DumpsysAccessibilityArtifact._FIELDS, False
+        )
+        record["user_id"] = user_id
+        record["component"] = component
+        record["package_name"], record["service_name"] = component.split("/", 1)
+        # Filled in after parsing: the count is per user.
+        record["installed_service_count"] = None
+        record["unnamed_service_count"] = None
+        return record

src/mvt/android/artifacts/dumpsys_adb.py

@@ -29,11 +29,26 @@ class DumpsysADBArtifact(AndroidArtifact):
         stack = [res]
         cur_indent = 0
         in_multiline = False
-        for line in dump_data.strip(b"\n").split(b"\n"):
+        for line in dump_data.strip(b"\r\n").split(b"\n"):
+            line = line.removesuffix(b"\r")
             # Track the level of indentation
             indent = len(line) - len(line.lstrip())
-            if indent < cur_indent:
+            # A closing brace is dedented from the block it closes, and the
+            # brace handler below pops that block. Popping on the dedent as
+            # well would close two levels for one brace. A blank line has no
+            # indentation to compare: it ends a multiline value (handled
+            # below) and is otherwise skipped.
+            if indent < cur_indent and line.strip() not in (b"", b"}"):
                 # If the current line is less indented than the previous one, back out
+                if len(stack) <= 1:
+                    # Dedenting below the outermost level means this is not the
+                    # well-formed block the parser expects. Stop here rather than
+                    # raise IndexError out of the module on the next line.
+                    self.log.error(
+                        "Unexpected indentation in ADB manager state, "
+                        "stopping the parse of this section"
+                    )
+                    break
                 stack.pop()
                 cur_indent = indent
             else:
@@ -62,7 +77,16 @@ class DumpsysADBArtifact(AndroidArtifact):
                     stack.pop()
                 current_dict = stack[-1]
 
+            if not line.strip():
+                continue
+
             if key == "}":
+                if len(stack) <= 1:
+                    self.log.error(
+                        "Unbalanced closing brace in ADB manager state, "
+                        "stopping the parse of this section"
+                    )
+                    break
                 stack.pop()
                 continue
 
@@ -161,6 +185,26 @@ class DumpsysADBArtifact(AndroidArtifact):
                     f"'{user_key['fingerprint']}'"
                 )
 
+    @staticmethod
+    def _find_state_end(content: bytes, open_brace: int) -> int:
+        """Find the unindented line closing the ADB manager state, or -1.
+
+        Braces inside key comments or embedded keystore data are values, while
+        nested structural closing braces are indented.
+        """
+        line_start = open_brace
+        while line_start < len(content):
+            line_end = content.find(b"\n", line_start)
+            if line_end == -1:
+                line_end = len(content)
+            line = content[line_start:line_end].removesuffix(b"\r")
+            if line_start > open_brace and line == b"}":
+                return line_start
+            if line.startswith((b"---------", b"DUMP OF SERVICE ")):
+                break
+            line_start = line_end + 1
+        return -1
+
     def parse(self, content: bytes) -> None:
         """
         Parse the Dumpsys ADB section
@@ -180,12 +224,16 @@ class DumpsysADBArtifact(AndroidArtifact):
             self.log.error("Unable to find ADB manager state in dumpsys output")
             return
 
-        end_of_json = content.rfind(b"}\n")
-        if end_of_json == -1 or end_of_json <= start_of_json:
-            self.log.error("Unable to find complete ADB manager state in dumpsys output")
+        end_of_json = self._find_state_end(content, start_of_json + 1)
+        if end_of_json == -1:
+            self.log.error(
+                "Unable to find complete ADB manager state in dumpsys output"
+            )
             return
 
-        json_content = content[start_of_json + 2 : end_of_json - 2].rstrip()
+        # The brace that opens the state and the one that closes it are not part
+        # of the indented body.
+        json_content = content[start_of_json + 2 : end_of_json].rstrip()
 
         parsed = self.indented_dump_parser(json_content)
         if parsed.get("debugging_manager") is None:

src/mvt/android/artifacts/dumpsys_battery_daily.py

@@ -73,8 +73,12 @@ class DumpsysBatteryDailyArtifact(AndroidArtifact):
                 continue
 
             line = line.strip().replace("Update ", "")
-            package_name, vers = line.split(" ", 1)
-            vers_raw = vers.split("=", 1)[1]
+            # A truncated or vendor-specific line must not abort the parse and
+            # lose every record after it.
+            package_name, _, vers = line.partition(" ")
+            vers_raw = vers.partition("=")[2]
+            if not package_name or not vers_raw:
+                continue
             try:
                 version_code: int | str = int(vers_raw)
             except ValueError:

src/mvt/android/artifacts/settings.py

@@ -255,19 +255,25 @@ class Settings(AndroidArtifact):
         dumpsys prints the change history without a year, so it is resolved
         against the time the section was dumped: the most recent matching date
         at or before that time.
+
+        The year is parsed together with the value, because strptime() would
+        otherwise parse it in 1900, which has no 29 February. The most recent
+        matching leap day can be eight years earlier when a century year is
+        not a leap year and the current year's leap day is still in the future.
         """
         if section_end is None:
             return None
 
-        try:
-            partial = datetime.strptime(value, "%m-%d %H:%M:%S.%f")
-            timestamp = partial.replace(year=section_end.year)
-            if timestamp > section_end:
-                timestamp = partial.replace(year=section_end.year - 1)
-        except ValueError:
-            return None
+        for year in range(section_end.year, section_end.year - 9, -1):
+            try:
+                timestamp = datetime.strptime(f"{year}-{value}", "%Y-%m-%d %H:%M:%S.%f")
+            except ValueError:
+                continue
 
-        return convert_datetime_to_iso(timestamp)
+            if timestamp <= section_end:
+                return convert_datetime_to_iso(timestamp)
+
+        return None
 
     def _parse_history(
         self, line: str, section_end: Optional[datetime]

src/mvt/android/cli.py

@@ -28,6 +28,7 @@ from mvt.common.help import (
     HELP_MSG_DISABLE_UPDATE_CHECK,
     HELP_MSG_HASHES,
     HELP_MSG_IOC,
+    HELP_MSG_JOBS,
     HELP_MSG_LIST_MODULES,
     HELP_MSG_LOAD_MODULE,
     HELP_MSG_MODULE,
@@ -161,6 +162,9 @@ def check_adb(ctx):
     ),
 )
 @click.option("--verbose", "-v", is_flag=True, help=HELP_MSG_VERBOSE_COMMAND)
+@click.option(
+    "--jobs", type=click.IntRange(min=1), default=4, show_default=True, help=HELP_MSG_JOBS
+)
 @click.argument("BUGREPORT_PATH", type=click.Path(exists=True))
 @click.pass_context
 def check_bugreport(
@@ -172,6 +176,7 @@ def check_bugreport(
     load_module,
     timezone,
     verbose,
+    jobs,
     bugreport_path,
 ):
     from .cmd_check_bugreport import CmdAndroidCheckBugreport
@@ -194,6 +199,7 @@ def check_bugreport(
         disable_version_check=_get_disable_flags(ctx)[0],
         disable_indicator_check=_get_disable_flags(ctx)[1],
         custom_modules=custom_modules,
+        jobs=jobs,
     )
 
     if list_modules:
@@ -236,6 +242,9 @@ def check_bugreport(
 @click.option("--non-interactive", "-n", is_flag=True, help=HELP_MSG_NONINTERACTIVE)
 @click.option("--backup-password", "-p", help=HELP_MSG_ANDROID_BACKUP_PASSWORD)
 @click.option("--verbose", "-v", is_flag=True, help=HELP_MSG_VERBOSE_COMMAND)
+@click.option(
+    "--jobs", type=click.IntRange(min=1), default=4, show_default=True, help=HELP_MSG_JOBS
+)
 @click.argument("BACKUP_PATH", type=click.Path(exists=True))
 @click.pass_context
 def check_backup(
@@ -247,6 +256,7 @@ def check_backup(
     non_interactive,
     backup_password,
     verbose,
+    jobs,
     backup_path,
 ):
     from .cmd_check_backup import CmdAndroidCheckBackup
@@ -268,6 +278,7 @@ def check_backup(
         disable_version_check=_get_disable_flags(ctx)[0],
         disable_indicator_check=_get_disable_flags(ctx)[1],
         custom_modules=custom_modules,
+        jobs=jobs,
     )
 
     if list_modules:
@@ -311,6 +322,9 @@ def check_backup(
 @click.option("--non-interactive", "-n", is_flag=True, help=HELP_MSG_NONINTERACTIVE)
 @click.option("--backup-password", "-p", help=HELP_MSG_ANDROID_BACKUP_PASSWORD)
 @click.option("--verbose", "-v", is_flag=True, help=HELP_MSG_VERBOSE_COMMAND)
+@click.option(
+    "--jobs", type=click.IntRange(min=1), default=4, show_default=True, help=HELP_MSG_JOBS
+)
 @click.argument("ANDROIDQF_PATH", type=click.Path(exists=True))
 @click.pass_context
 def check_androidqf(
@@ -326,6 +340,7 @@ def check_androidqf(
     non_interactive,
     backup_password,
     verbose,
+    jobs,
     androidqf_path,
 ):
     from .cmd_check_androidqf import CmdAndroidCheckAndroidQF
@@ -349,6 +364,7 @@ def check_androidqf(
         disable_version_check=_get_disable_flags(ctx)[0],
         disable_indicator_check=_get_disable_flags(ctx)[1],
         custom_modules=custom_modules,
+        jobs=jobs,
     )
 
     if list_modules:
@@ -398,6 +414,9 @@ def check_androidqf(
     ),
 )
 @click.option("--verbose", "-v", is_flag=True, help=HELP_MSG_VERBOSE_COMMAND)
+@click.option(
+    "--jobs", type=click.IntRange(min=1), default=4, show_default=True, help=HELP_MSG_JOBS
+)
 @click.argument("LOGS_PATH", type=click.Path(exists=True))
 @click.pass_context
 def check_intrusion_logs(
@@ -409,6 +428,7 @@ def check_intrusion_logs(
     load_module,
     timezone,
     verbose,
+    jobs,
     logs_path,
 ):
     from .cmd_check_intrusion_logs import CmdAndroidCheckIntrusionLogs
@@ -429,6 +449,7 @@ def check_intrusion_logs(
         disable_version_check=_get_disable_flags(ctx)[0],
         disable_indicator_check=_get_disable_flags(ctx)[1],
         custom_modules=custom_modules,
+        jobs=jobs,
     )
 
     if list_modules:

src/mvt/android/cmd_check_androidqf.py

@@ -53,6 +53,7 @@ class CmdAndroidCheckAndroidQF(Command):
         disable_version_check: bool = False,
         disable_indicator_check: bool = False,
         custom_modules: Optional[list[type[MVTModule]]] = None,
+        jobs: int = 4,
     ) -> None:
         super().__init__(
             target_path=target_path,
@@ -68,6 +69,7 @@ class CmdAndroidCheckAndroidQF(Command):
             disable_version_check=disable_version_check,
             disable_indicator_check=disable_indicator_check,
             custom_modules=custom_modules,
+            jobs=jobs,
         )
 
         self.platform = "android"
@@ -259,6 +261,7 @@ class CmdAndroidCheckAndroidQF(Command):
                 hashes=self.hashes,
                 sub_command=True,
                 custom_modules=self.custom_modules,
+                jobs=self.jobs,
             )
             cmd.from_zip(bugreport)
             cmd.run()
@@ -290,6 +293,7 @@ class CmdAndroidCheckAndroidQF(Command):
             hashes=self.hashes,
             sub_command=True,
             custom_modules=self.custom_modules,
+            jobs=self.jobs,
         )
         try:
             cmd.from_ab(backup)
@@ -376,6 +380,7 @@ class CmdAndroidCheckAndroidQF(Command):
                 hashes=self.hashes,
                 sub_command=True,
                 custom_modules=self.custom_modules,
+                jobs=self.jobs,
             )
             cmd.run()
 

src/mvt/android/cmd_check_backup.py

@@ -47,6 +47,7 @@ class CmdAndroidCheckBackup(Command):
         disable_version_check: bool = False,
         disable_indicator_check: bool = False,
         custom_modules: Optional[list[type[MVTModule]]] = None,
+        jobs: int = 4,
     ) -> None:
         super().__init__(
             target_path=target_path,
@@ -62,6 +63,7 @@ class CmdAndroidCheckBackup(Command):
             disable_version_check=disable_version_check,
             disable_indicator_check=disable_indicator_check,
             custom_modules=custom_modules,
+            jobs=jobs,
         )
 
         self.platform = "android"

src/mvt/android/cmd_check_bugreport.py

@@ -3,14 +3,19 @@
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
+import fnmatch
+import io
 import logging
 import os
 from pathlib import Path
 from typing import List, Optional
-from zipfile import ZipFile
+from zipfile import BadZipFile, ZipFile
 
 from mvt.android.artifacts.getprop import GetProp
-from mvt.android.modules.bugreport.base import BugReportModule
+from mvt.android.modules.bugreport.base import (
+    DUMPSTATE_ENTRY_POINTS,
+    BugReportModule,
+)
 from mvt.common.command import Command
 from mvt.common.indicators import Indicators
 from mvt.common.module import MVTModule
@@ -35,6 +40,7 @@ class CmdAndroidCheckBugreport(Command):
         disable_version_check: bool = False,
         disable_indicator_check: bool = False,
         custom_modules: Optional[list[type[MVTModule]]] = None,
+        jobs: int = 4,
     ) -> None:
         super().__init__(
             target_path=target_path,
@@ -50,6 +56,7 @@ class CmdAndroidCheckBugreport(Command):
             disable_version_check=disable_version_check,
             disable_indicator_check=disable_indicator_check,
             custom_modules=custom_modules,
+            jobs=jobs,
         )
 
         self.platform = "android"
@@ -88,6 +95,48 @@ class CmdAndroidCheckBugreport(Command):
         for file_name in self.__zip.namelist():
             self.__files.append(file_name)
 
+        if not self._has_dumpstate(self.__files):
+            nested = self._nested_bugreport(bugreport_zip)
+            if nested:
+                self.__zip = nested
+                self.__files = list(nested.namelist())
+
+    @staticmethod
+    def _has_dumpstate(file_names: List[str]) -> bool:
+        """Whether these members carry any of the entry points the bug report
+        modules read (see `BugReportModule._get_dumpstate_file`)."""
+        return any(
+            fnmatch.filter(file_names, pattern) for pattern in DUMPSTATE_ENTRY_POINTS
+        )
+
+    def _nested_bugreport(self, outer: ZipFile) -> Optional[ZipFile]:
+        """Descend one level into an OEM wrapper archive.
+
+        MIUI / HyperOS hands out a zip of app logs, ANR traces and tcpdump
+        captures with the real `bugreport-<device>-<timestamp>.zip` nested
+        inside. Without this descent the outer archive has no entry point,
+        every module reports it found no files, and the command still exits 0
+        with an empty result.
+        """
+        candidates = [
+            name for name in outer.namelist() if name.lower().endswith(".zip")
+        ]
+        candidates.sort(
+            key=lambda name: (
+                "bugreport" not in name.lower() and "dumpstate" not in name.lower()
+            )
+        )
+        for name in candidates:
+            try:
+                inner = ZipFile(io.BytesIO(outer.read(name)))
+            except (BadZipFile, OSError):
+                continue
+            if self._has_dumpstate(inner.namelist()):
+                log.info("Found the bug report nested inside the archive: %s", name)
+                return inner
+            inner.close()
+        return None
+
     def init(self) -> None:
         if self.target_path:
             self.log.info("Checking Android bug report at path: %s", self.target_path)

src/mvt/android/cmd_check_intrusion_logs.py

@@ -37,6 +37,7 @@ class CmdAndroidCheckIntrusionLogs(Command):
         disable_version_check: bool = False,
         disable_indicator_check: bool = False,
         custom_modules: Optional[list[type[MVTModule]]] = None,
+        jobs: int = 4,
     ) -> None:
         super().__init__(
             target_path=target_path,
@@ -52,6 +53,7 @@ class CmdAndroidCheckIntrusionLogs(Command):
             disable_version_check=disable_version_check,
             disable_indicator_check=disable_indicator_check,
             custom_modules=custom_modules,
+            jobs=jobs,
         )
 
         self.platform = "android"

src/mvt/android/modules/androidqf/aqf_packages.py

@@ -8,8 +8,6 @@ import logging
 import time
 from typing import Optional
 
-from rich.progress import track
-
 from mvt.android.utils import (
     BROWSER_INSTALLERS,
     PLAY_STORE_INSTALLERS,
@@ -153,10 +151,9 @@ class AQFPackages(AndroidQFModule):
         if total_hashes == 0:
             return
 
-        progress_desc = f"Looking up {total_hashes} package files on VirusTotal..."
-        for index, file_hash in enumerate(
-            track(files_by_hash, description=progress_desc)
-        ):
+        self.log.info("Looking up %d package files on VirusTotal...", total_hashes)
+        for index, file_hash in enumerate(files_by_hash):
+            self.log.debug("VirusTotal lookup %d/%d", index + 1, total_hashes)
             try:
                 results = virustotal_lookup(file_hash)
             except VTNoKey as exc:

src/mvt/android/modules/androidqf/base.py

@@ -81,12 +81,13 @@ class AndroidQFModule(MVTModule):
         return None
 
     def _get_file_content(self, file_path):
-        if self.archive:
-            handle = self.archive.open(file_path)
-        else:
-            handle = open(os.path.join(self.parent_path, file_path), "rb")
+        with self.resource_lock:
+            if self.archive:
+                handle = self.archive.open(file_path)
+            else:
+                handle = open(os.path.join(self.parent_path, file_path), "rb")
 
-        data = handle.read()
-        handle.close()
+            data = handle.read()
+            handle.close()
 
-        return data
+            return data

src/mvt/android/modules/backup/base.py

@@ -55,21 +55,22 @@ class BackupModule(MVTModule):
         return fnmatch.filter(self.files, pattern)
 
     def _get_file_content(self, file_path: str) -> bytes:
-        handle = None
-        if self.tar:
-            try:
-                member = self.tar.getmember(file_path)
-                handle = self.tar.extractfile(member)
-                if not handle:
-                    raise ValueError(f"Could not extract file: {file_path}")
-            except KeyError:
-                raise FileNotFoundError(f"File not found in tar: {file_path}")
-        elif self.backup_path:
-            handle = open(os.path.join(self.backup_path, file_path), "rb")
-        else:
-            raise ValueError("No backup path or tar file provided")
+        with self.resource_lock:
+            handle = None
+            if self.tar:
+                try:
+                    member = self.tar.getmember(file_path)
+                    handle = self.tar.extractfile(member)
+                    if not handle:
+                        raise ValueError(f"Could not extract file: {file_path}")
+                except KeyError:
+                    raise FileNotFoundError(f"File not found in tar: {file_path}")
+            elif self.backup_path:
+                handle = open(os.path.join(self.backup_path, file_path), "rb")
+            else:
+                raise ValueError("No backup path or tar file provided")
 
-        data = handle.read()
-        handle.close()
+            data = handle.read()
+            handle.close()
 
-        return data
+            return data

src/mvt/android/modules/bugreport/base.py

@@ -4,15 +4,45 @@
 #   https://github.com/mvt-project/mvt/blob/main/LICENSE
 import datetime
 import fnmatch
+import io
 import logging
 import os
+import re
 from pathlib import Path
 from typing import List, Optional
 from zipfile import ZipFile
 from zoneinfo import ZoneInfo, ZoneInfoNotFoundError
 
+from mvt.android.artifacts.artifact import AndroidArtifact
 from mvt.common.module import ModuleResults, MVTModule
 
+# `------ 0.101s was the duration of 'SOME SECTION' ------`, printed when that
+# section finishes and not necessarily between two sections.
+SECTION_DURATION = re.compile(r"^-{3,}\s*[0-9.]+s was the duration of", re.IGNORECASE)
+
+# The members a bug report archive can be entered through, in the order
+# _get_dumpstate_file() tries them. An archive carrying none of them is not a
+# bug report at this level (see CmdAndroidCheckBugreport._has_dumpstate).
+DUMPSTATE_ENTRY_POINTS = ("main_entry.txt", "dumpState_*.log", "*/dumpsys.txt")
+
+
+_DUMPSTATE_BYTES_CACHE_KEY = ("android_bugreport", "dumpstate", "bytes")
+_DUMPSTATE_SECTIONS_CACHE_KEY = ("android_bugreport", "dumpstate", "sections")
+_SYSTEM_PROPERTIES_SECTION = b"------ SYSTEM PROPERTIES"
+_DUMPSYS_SEPARATORS = {
+    b"DUMP OF SERVICE accessibility:",
+    b"DUMP OF SERVICE adb:",
+    b"DUMP OF SERVICE appops:",
+    b"DUMP OF SERVICE batterystats:",
+    b"DUMP OF SERVICE dbinfo:",
+    b"DUMP OF SERVICE package:",
+    b"DUMP OF SERVICE platform_compat:",
+}
+_DUMPSTATE_DELIMITER = (
+    b"------------------------------------------------------------------------------"
+)
+_GETPROP_LINE_RE = re.compile(rb"\[(.+?)\]: \[(.+?)\]")
+
 
 class BugReportModule(MVTModule):
     """This class provides a base for all Android Bug Report modules."""
@@ -67,43 +97,156 @@ class BugReportModule(MVTModule):
         return []
 
     def _get_file_content(self, file_path: str) -> bytes:
-        if self.zip_archive:
-            handle = self.zip_archive.open(file_path)
-        else:
-            if not self.extract_path:
-                raise ValueError("extract_path is not set")
-            joined = os.path.join(self.extract_path, file_path)
-            if (
-                not Path(joined)
-                .resolve()
-                .is_relative_to(Path(self.extract_path).resolve())
-            ):
-                raise ValueError("unsafe file_path")
-            handle = open(joined, "rb")
+        with self.resource_lock:
+            if self.zip_archive:
+                handle = self.zip_archive.open(file_path)
+            else:
+                if not self.extract_path:
+                    raise ValueError("extract_path is not set")
+                joined = os.path.join(self.extract_path, file_path)
+                if (
+                    not Path(joined)
+                    .resolve()
+                    .is_relative_to(Path(self.extract_path).resolve())
+                ):
+                    raise ValueError("unsafe file_path")
+                handle = open(joined, "rb")
 
-        data = handle.read()
-        handle.close()
+            data = handle.read()
+            handle.close()
 
-        return data
+            return data
 
     def _get_dumpstate_file(self) -> Optional[bytes]:
-        main = self._get_files_by_pattern("main_entry.txt")
-        if main:
-            main_content = self._get_file_content(main[0])
-            try:
-                return self._get_file_content(main_content.decode().strip())
-            except KeyError:
-                return None
+        with self.resource_lock:
+            if _DUMPSTATE_BYTES_CACHE_KEY in self.resource_cache:
+                return self.resource_cache[_DUMPSTATE_BYTES_CACHE_KEY]
 
-        dumpstate_logs = self._get_files_by_pattern("dumpState_*.log")
-        if dumpstate_logs:
-            return self._get_file_content(dumpstate_logs[0])
+            content = None
+            main_entry, dumpstate_log, dumpsys_txt = DUMPSTATE_ENTRY_POINTS
+            main = self._get_files_by_pattern(main_entry)
+            if main:
+                main_content = self._get_file_content(main[0])
+                try:
+                    content = self._get_file_content(main_content.decode().strip())
+                except KeyError:
+                    pass
+            else:
+                dumpstate_logs = self._get_files_by_pattern(dumpstate_log)
+                if dumpstate_logs:
+                    content = self._get_file_content(dumpstate_logs[0])
+                else:
+                    dumpsys_files = self._get_files_by_pattern(dumpsys_txt)
+                    if dumpsys_files:
+                        content = self._get_file_content(dumpsys_files[0])
 
-        dumpsys_files = self._get_files_by_pattern("*/dumpsys.txt")
-        if dumpsys_files:
-            return self._get_file_content(dumpsys_files[0])
+            self.resource_cache[_DUMPSTATE_BYTES_CACHE_KEY] = content
+            return content
 
-        return None
+    def _get_dumpstate_sections(self) -> dict[bytes, bytes]:
+        with self.resource_lock:
+            if _DUMPSTATE_SECTIONS_CACHE_KEY in self.resource_cache:
+                return self.resource_cache[_DUMPSTATE_SECTIONS_CACHE_KEY]
+
+            section_lines: dict[bytes, list[bytes]] = {
+                separator: [] for separator in _DUMPSYS_SEPARATORS
+            }
+            section_lines[_SYSTEM_PROPERTIES_SECTION] = []
+            current_section = None
+            completed_sections = set()
+            in_system_properties = False
+            content = self._get_dumpstate_file()
+
+            if content:
+                for raw_line in io.BytesIO(content):
+                    line = raw_line.rstrip(b"\r\n")
+                    stripped = line.strip()
+
+                    if stripped.startswith(_SYSTEM_PROPERTIES_SECTION):
+                        in_system_properties = True
+                    elif in_system_properties:
+                        if stripped == b"------":
+                            in_system_properties = False
+                        elif _GETPROP_LINE_RE.search(line):
+                            section_lines[_SYSTEM_PROPERTIES_SECTION].append(line)
+
+                    if stripped in _DUMPSYS_SEPARATORS:
+                        if current_section is not None:
+                            completed_sections.add(current_section)
+                        current_section = (
+                            None if stripped in completed_sections else stripped
+                        )
+                        continue
+
+                    if stripped.startswith(_DUMPSTATE_DELIMITER):
+                        if current_section is not None:
+                            completed_sections.add(current_section)
+                        current_section = None
+                        continue
+
+                    if current_section is not None:
+                        section_lines[current_section].append(line)
+
+            sections = {
+                separator: b"\n".join(lines)
+                for separator, lines in section_lines.items()
+            }
+            self.resource_cache[_DUMPSTATE_SECTIONS_CACHE_KEY] = sections
+            return sections
+
+    def _get_dumpsys_section_bytes(self, separator: bytes) -> Optional[bytes]:
+        sections = self._get_dumpstate_sections()
+        if separator in sections:
+            return sections[separator]
+
+        content = self._get_dumpstate_file()
+        if not content:
+            return None
+        return AndroidArtifact.extract_dumpsys_section(content, separator, binary=True)
+
+    def _get_dumpsys_section(
+        self, separator: str, errors: str = "replace"
+    ) -> Optional[str]:
+        cache_key = (
+            "android_bugreport",
+            "dumpstate",
+            "section",
+            separator,
+            errors,
+        )
+        with self.resource_lock:
+            if cache_key in self.resource_cache:
+                return self.resource_cache[cache_key]
+
+            section_bytes = self._get_dumpsys_section_bytes(separator.encode("utf-8"))
+            section = (
+                section_bytes.decode("utf-8", errors=errors)
+                if section_bytes is not None
+                else None
+            )
+            self.resource_cache[cache_key] = section
+            return section
+
+    def _get_system_properties_text(self, errors: str = "ignore") -> Optional[str]:
+        cache_key = (
+            "android_bugreport",
+            "dumpstate",
+            "system_properties",
+            errors,
+        )
+        with self.resource_lock:
+            if cache_key in self.resource_cache:
+                return self.resource_cache[cache_key]
+
+            sections = self._get_dumpstate_sections()
+            section_bytes = sections.get(_SYSTEM_PROPERTIES_SECTION)
+            section = (
+                section_bytes.decode("utf-8", errors=errors)
+                if section_bytes is not None
+                else None
+            )
+            self.resource_cache[cache_key] = section
+            return section
 
     @staticmethod
     def extract_command_section(content: str, heading: str) -> str:
@@ -122,6 +265,12 @@ class BugReportModule(MVTModule):
                     in_section = True
                 continue
             if stripped.startswith("------"):
+                # dumpstate prints a section's timing line when that section
+                # finishes, which can land in the middle of the one being
+                # written. Treating it as a boundary truncates the section at
+                # an arbitrary point, silently.
+                if SECTION_DURATION.match(stripped):
+                    continue
                 break
             lines.append(line)
         return "\n".join(lines)
@@ -146,7 +295,8 @@ class BugReportModule(MVTModule):
         instant returned in UTC.
         """
         if self.zip_archive:
-            file_timetuple = self.zip_archive.getinfo(file_path).date_time
+            with self.resource_lock:
+                file_timetuple = self.zip_archive.getinfo(file_path).date_time
             return datetime.datetime(*file_timetuple, tzinfo=self._device_timezone())
         if not self.extract_path:
             raise ValueError("extract_path is not set")

src/mvt/android/modules/bugreport/dumpsys_accessibility.py

@@ -34,23 +34,34 @@ class DumpsysAccessibility(DumpsysAccessibilityArtifact, BugReportModule):
         )
 
     def run(self) -> None:
-        full_dumpsys = self._get_dumpstate_file()
-        if not full_dumpsys:
+        content = self._get_dumpsys_section(
+            "DUMP OF SERVICE accessibility:", errors="ignore"
+        )
+        if content is None:
             self.log.error(
                 "Unable to find dumpstate file. "
                 "Did you provide a valid bug report archive?"
             )
             return
 
-        content = self.extract_dumpsys_section(
-            full_dumpsys.decode("utf-8", errors="ignore"),
-            "DUMP OF SERVICE accessibility:",
-        )
         self.parse(content)
 
+        listed = unnamed = 0
         for result in self.results:
-            self.log.info('Found accessibility service "%s"', result.get("component"))
+            if result.get("component"):
+                listed += 1
+                self.log.info(
+                    'Found accessibility service "%s"', result.get("component")
+                )
+                continue
+            # The operator gets this per user as a LOW alert from
+            # check_indicators(); here it only has to survive into the summary,
+            # so that a stated count never reads as "a total of 0".
+            unnamed += result.get("unnamed_service_count") or 0
 
         self.log.info(
-            "Identified a total of %d accessibility services", len(self.results)
+            "Identified a total of %d accessibility services (%d more stated by "
+            "the dump without a component name)",
+            listed,
+            unnamed,
         )

src/mvt/android/modules/bugreport/dumpsys_activities.py

@@ -38,19 +38,14 @@ class DumpsysActivities(DumpsysPackageActivitiesArtifact, BugReportModule):
         self.results = results if results else []
 
     def run(self) -> None:
-        content = self._get_dumpstate_file()
-        if not content:
+        section = self._get_dumpsys_section("DUMP OF SERVICE package:", errors="ignore")
+        if section is None:
             self.log.error(
                 "Unable to find dumpstate file. "
                 "Did you provide a valid bug report archive?"
             )
             return
 
-        # Extract package section
-        section = self.extract_dumpsys_section(
-            content.decode("utf-8", errors="ignore"), "DUMP OF SERVICE package:"
-        )
-
         # Parse
         self.parse(section)
 

src/mvt/android/modules/bugreport/dumpsys_adb_state.py

@@ -38,19 +38,14 @@ class DumpsysADBState(DumpsysADBArtifact, BugReportModule):
         )
 
     def run(self) -> None:
-        full_dumpsys = self._get_dumpstate_file()
-        if not full_dumpsys:
+        content = self._get_dumpsys_section_bytes(b"DUMP OF SERVICE adb:")
+        if content is None:
             self.log.error(
                 "Unable to find dumpstate file. "
                 "Did you provide a valid bug report archive?"
             )
             return
 
-        content = self.extract_dumpsys_section(
-            full_dumpsys,
-            b"DUMP OF SERVICE adb:",
-            binary=True,
-        )
         self.parse(content)
         if self.results:
             self.log.info(

src/mvt/android/modules/bugreport/dumpsys_appops.py

@@ -34,17 +34,14 @@ class DumpsysAppops(DumpsysAppopsArtifact, BugReportModule):
         )
 
     def run(self) -> None:
-        content = self._get_dumpstate_file()
-        if not content:
+        section = self._get_dumpsys_section("DUMP OF SERVICE appops:")
+        if section is None:
             self.log.error(
                 "Unable to find dumpstate file. "
                 "Did you provide a valid bug report archive?"
             )
             return
 
-        section = self.extract_dumpsys_section(
-            content.decode("utf-8", errors="replace"), "DUMP OF SERVICE appops:"
-        )
         self.parse(section)
 
         self.log.info(

src/mvt/android/modules/bugreport/dumpsys_battery_daily.py

@@ -34,17 +34,14 @@ class DumpsysBatteryDaily(DumpsysBatteryDailyArtifact, BugReportModule):
         )
 
     def run(self) -> None:
-        content = self._get_dumpstate_file()
-        if not content:
+        dumpsys_section = self._get_dumpsys_section("DUMP OF SERVICE batterystats:")
+        if dumpsys_section is None:
             self.log.error(
                 "Unable to find dumpstate file. "
                 "Did you provide a valid bug report archive?"
             )
             return
 
-        dumpsys_section = self.extract_dumpsys_section(
-            content.decode("utf-8", errors="replace"), "DUMP OF SERVICE batterystats:"
-        )
         self.parse(dumpsys_section)
 
         self.log.info("Extracted a total of %d battery daily stats", len(self.results))

src/mvt/android/modules/bugreport/dumpsys_battery_history.py

@@ -34,17 +34,14 @@ class DumpsysBatteryHistory(DumpsysBatteryHistoryArtifact, BugReportModule):
         )
 
     def run(self) -> None:
-        content = self._get_dumpstate_file()
-        if not content:
+        dumpsys_section = self._get_dumpsys_section("DUMP OF SERVICE batterystats:")
+        if dumpsys_section is None:
             self.log.error(
                 "Unable to find dumpstate file. "
                 "Did you provide a valid bug report archive?"
             )
             return
 
-        dumpsys_section = self.extract_dumpsys_section(
-            content.decode("utf-8", errors="replace"), "DUMP OF SERVICE batterystats:"
-        )
         self.parse(dumpsys_section)
 
         self.log.info(

src/mvt/android/modules/bugreport/dumpsys_dbinfo.py

@@ -36,18 +36,14 @@ class DumpsysDBInfo(DumpsysDBInfoArtifact, BugReportModule):
         )
 
     def run(self) -> None:
-        data = self._get_dumpstate_file()
-        if not data:
+        section = self._get_dumpsys_section("DUMP OF SERVICE dbinfo:", errors="ignore")
+        if section is None:
             self.log.error(
                 "Unable to find dumpstate file. "
                 "Did you provide a valid bug report archive?"
             )
             return
 
-        section = self.extract_dumpsys_section(
-            data.decode("utf-8", errors="ignore"), "DUMP OF SERVICE dbinfo:"
-        )
-
         self.parse(section)
         self.log.info(
             "Extracted a total of %d database connection pool records",

src/mvt/android/modules/bugreport/dumpsys_getprop.py

@@ -36,16 +36,13 @@ class DumpsysGetProp(GetPropArtifact, BugReportModule):
         self.results = [] if not results else results
 
     def run(self) -> None:
-        content = self._get_dumpstate_file()
-        if not content:
+        content = self._get_system_properties_text()
+        if content is None:
             self.log.error(
                 "Unable to find dumpstate file. "
                 "Did you provide a valid bug report archive?"
             )
             return
 
-        section = self.extract_command_section(
-            content.decode(errors="ignore"), "------ SYSTEM PROPERTIES"
-        )
-        self.parse(section)
+        self.parse(content)
         self.log.info("Extracted %d Android system properties", len(self.results))

src/mvt/android/modules/bugreport/dumpsys_packages.py

@@ -35,17 +35,14 @@ class DumpsysPackages(DumpsysPackagesArtifact, BugReportModule):
         )
 
     def run(self) -> None:
-        data = self._get_dumpstate_file()
-        if not data:
+        content = self._get_dumpsys_section("DUMP OF SERVICE package:")
+        if content is None:
             self.log.error(
                 "Unable to find dumpstate file. "
                 "Did you provide a valid bug report archive?"
             )
             return
 
-        content = self.extract_dumpsys_section(
-            data.decode("utf-8", errors="replace"), "DUMP OF SERVICE package:"
-        )
         self.parse(content)
 
         for result in self.results:

src/mvt/android/modules/bugreport/dumpsys_platform_compat.py

@@ -34,18 +34,14 @@ class DumpsysPlatformCompat(DumpsysPlatformCompatArtifact, BugReportModule):
         )
 
     def run(self) -> None:
-        data = self._get_dumpstate_file()
-        if not data:
+        content = self._get_dumpsys_section("DUMP OF SERVICE platform_compat:")
+        if content is None:
             self.log.error(
                 "Unable to find dumpstate file. "
                 "Did you provide a valid bug report archive?"
             )
             return
 
-        decoded_data = data.decode("utf-8", errors="replace")
-        content = self.extract_dumpsys_section(
-            decoded_data, "DUMP OF SERVICE platform_compat:"
-        )
         self.parse(content)
 
         self.log.info("Found %d package compatibility overrides", len(self.results))

src/mvt/android/modules/bugreport/dumpsys_receivers.py

@@ -36,17 +36,13 @@ class DumpsysReceivers(DumpsysReceiversArtifact, BugReportModule):
         self.results = results if results else []
 
     def run(self) -> None:
-        content = self._get_dumpstate_file()
-        if not content:
+        dumpsys_section = self._get_dumpsys_section("DUMP OF SERVICE package:")
+        if dumpsys_section is None:
             self.log.error(
                 "Unable to find dumpstate file. "
                 "Did you provide a valid bug report archive?"
             )
             return
 
-        dumpsys_section = self.extract_dumpsys_section(
-            content.decode("utf-8", errors="replace"), "DUMP OF SERVICE package:"
-        )
-
         self.parse(dumpsys_section)
         self.log.info("Extracted %d package receivers", len(self.results))

src/mvt/common/command.py

@@ -6,7 +6,10 @@
 import json
 import logging
 import os
+import queue
 import sys
+import threading
+from concurrent.futures import Future, ThreadPoolExecutor
 from datetime import datetime
 from functools import cached_property
 from heapq import heappop, heappush
@@ -19,6 +22,7 @@ from rich.text import Text
 from .alerts import AlertLevel, AlertStore
 from .config import settings
 from .indicators import Indicators
+from .log import MVTLogHandler, finish_module_log_buffer, start_module_log_buffer
 from .module import EncryptedBackupError, MVTModule, run_module, save_timeline
 from .module_loader import (
     ModuleOrigin,
@@ -52,6 +56,7 @@ class Command:
         disable_version_check: bool = False,
         disable_indicator_check: bool = False,
         custom_modules: Optional[list[type[MVTModule]]] = None,
+        jobs: int = 4,
     ) -> None:
         self.name = ""
         self.platform = ""
@@ -67,6 +72,11 @@ class Command:
         self.sub_command = sub_command
         self.disable_version_check = disable_version_check
         self.disable_indicator_check = disable_indicator_check
+        if jobs < 1:
+            raise ValueError("jobs must be at least 1")
+        self.jobs = jobs
+        self._resource_lock = threading.RLock()
+        self._resource_cache: dict[object, Any] = {}
 
         # This dictionary can contain options that will be passed down from
         # the Command to all modules. This can for example be used to pass
@@ -710,41 +720,22 @@ class Command:
 
         return ordered
 
-    def run(self) -> None:
-        # The output folder and its command.log exist for a run, so that
-        # listing modules or rejecting a target leaves nothing behind.
-        # Resolving the module list can warn, so the log comes first.
-        self._create_storage()
-        self._setup_logging()
-
-        ordered_modules = self._ordered_modules()
-        if ordered_modules is None:
-            return
-
-        # Read the indicators once the run is certain to happen, before
-        # init() does any work on the target, so that a missing indicators
-        # file is reported first and every module gets the same object.
-        iocs = self.iocs
-
-        # Commands announce their target from init(), so it goes before the
-        # module list.
+    def _run_module(
+        self,
+        module: type[MVTModule],
+        executed_by_type: dict[type[MVTModule], MVTModule],
+        capture_logs: bool,
+    ) -> tuple[MVTModule, list[logging.LogRecord], bool]:
+        """Initialize and run one module, optionally buffering console logs."""
+        token = start_module_log_buffer() if capture_logs else None
+        records: list[logging.LogRecord] = []
+        encrypted = False
         try:
-            self.init()
-        except NotImplementedError:
-            pass
-
-        self._log_loaded_modules(ordered_modules)
-
-        executed_by_type: dict[type[MVTModule], MVTModule] = {}
-        for module in ordered_modules:
-
-            module_logger = get_module_logger(module)
-
             m = module(
                 target_path=self.target_path,
                 results_path=self.results_path,
                 module_options=self.module_options,
-                log=module_logger,
+                log=get_module_logger(module),
             )
             # Dependencies are keyed by the module class they declare, even
             # when it was replaced, so that a module asking for the results
@@ -753,10 +744,12 @@ class Command:
                 dependency: executed_by_type[resolved]
                 for dependency, resolved in self._module_dependencies(module)
             }
+            m.resource_lock = self._resource_lock
+            m.resource_cache = self._resource_cache
 
-            if iocs.total_ioc_count:
-                m.indicators = iocs
-                m.indicators.log = m.log
+            if self.iocs.total_ioc_count:
+                # IOC collections are shared read-only during module execution.
+                m.indicators = self.iocs
 
             if self.serial:
                 m.serial = self.serial
@@ -769,23 +762,215 @@ class Command:
             try:
                 run_module(m)
             except EncryptedBackupError:
-                self.log.critical(
-                    "The backup appears to be encrypted. "
-                    "Please decrypt it first using `mvt-ios decrypt-backup`."
-                )
-                return
+                encrypted = True
+        finally:
+            if token is not None:
+                records = finish_module_log_buffer(token)
 
-            self.executed.append(m)
-            executed_by_type[module] = m
-            self.timeline.extend(m.timeline)
-            self.url_results.extend(m.url_results)
-            self.alertstore.extend(m.alertstore.alerts)
+        return m, records, encrypted
+
+    @staticmethod
+    def _console_handler() -> Optional[MVTLogHandler]:
+        for handler in reversed(logging.getLogger("mvt").handlers):
+            if isinstance(handler, MVTLogHandler):
+                return handler
+        return None
+
+    def _publish_completed_modules(
+        self,
+        ordered_modules: list[type[MVTModule]],
+        completed: dict[type[MVTModule], MVTModule],
+    ) -> None:
+        """Expose a stable snapshot of completed modules to initialization hooks."""
+        self.executed = [
+            completed[module] for module in ordered_modules if module in completed
+        ]
+
+    def _aggregate_modules(
+        self,
+        ordered_modules: list[type[MVTModule]],
+        completed: dict[type[MVTModule], MVTModule],
+    ) -> None:
+        """Aggregate results in stable topological order."""
+        for module in ordered_modules:
+            if module not in completed:
+                continue
+            instance = completed[module]
+            self.timeline.extend(instance.timeline)
+            self.url_results.extend(instance.url_results)
+            self.alertstore.extend(instance.alertstore.alerts)
+
+    def _run_sequential(
+        self, ordered_modules: list[type[MVTModule]]
+    ) -> tuple[dict[type[MVTModule], MVTModule], bool]:
+        completed: dict[type[MVTModule], MVTModule] = {}
+        for module in ordered_modules:
+            instance, _, encrypted = self._run_module(module, completed, False)
+            if encrypted:
+                return completed, True
+            completed[module] = instance
+            self._publish_completed_modules(ordered_modules, completed)
+        return completed, False
+
+    def _run_parallel(
+        self, ordered_modules: list[type[MVTModule]], jobs: int
+    ) -> tuple[dict[type[MVTModule], MVTModule], bool]:
+        """Run a stable module DAG with bounded worker threads."""
+        completed: dict[type[MVTModule], MVTModule] = {}
+        scheduled: set[type[MVTModule]] = set()
+        running: dict[Future, type[MVTModule]] = {}
+        completion_queue: queue.Queue[Future] = queue.Queue()
+        handler = self._console_handler()
+        status = None
+        fatal = False
+
+        def ready_modules() -> list[type[MVTModule]]:
+            return [
+                module
+                for module in ordered_modules
+                if module not in scheduled
+                and all(
+                    dependency in completed
+                    for _, dependency in self._module_dependencies(module)
+                )
+            ]
+
+        def update_status() -> None:
+            if status is None:
+                return
+            names = ", ".join(module.__name__ for module in running.values())
+            status.update(
+                f"Modules: {len(completed)}/{len(ordered_modules)} complete"
+                + (f"; running {names}" if names else "")
+            )
+
+        if handler and handler.console.is_terminal:
+            status = handler.console.status("")
+            status.start()
+
+        try:
+            with ThreadPoolExecutor(max_workers=jobs) as executor:
+                while len(completed) < len(ordered_modules):
+                    ready = ready_modules()
+
+                    # An unsafe module is a scheduler barrier: it starts only
+                    # after active workers drain and blocks later ready work.
+                    if ready and not ready[0].parallel_safe:
+                        if running:
+                            future = completion_queue.get()
+                            module = running.pop(future)
+                            instance, records, encrypted = future.result()
+                            if handler:
+                                handler.emit_module_records(module.__name__, records)
+                            if encrypted:
+                                fatal = True
+                                break
+                            completed[module] = instance
+                            self._publish_completed_modules(ordered_modules, completed)
+                            update_status()
+                            continue
+
+                        module = ready[0]
+                        scheduled.add(module)
+                        if status is not None:
+                            status.update(
+                                f"Modules: {len(completed)}/{len(ordered_modules)} "
+                                f"complete; running {module.__name__}"
+                            )
+                        instance, records, encrypted = self._run_module(
+                            module, completed, True
+                        )
+                        if handler:
+                            handler.emit_module_records(module.__name__, records)
+                        if encrypted:
+                            fatal = True
+                            break
+                        completed[module] = instance
+                        self._publish_completed_modules(ordered_modules, completed)
+                        update_status()
+                        continue
+
+                    for module in ready:
+                        if len(running) >= jobs or not module.parallel_safe:
+                            break
+                        scheduled.add(module)
+                        future = executor.submit(
+                            self._run_module, module, dict(completed), True
+                        )
+                        running[future] = module
+                        future.add_done_callback(completion_queue.put)
+
+                    update_status()
+                    if not running:
+                        break
+
+                    future = completion_queue.get()
+                    module = running.pop(future)
+                    instance, records, encrypted = future.result()
+                    if handler:
+                        handler.emit_module_records(module.__name__, records)
+                    if encrypted:
+                        fatal = True
+                        break
+                    completed[module] = instance
+                    self._publish_completed_modules(ordered_modules, completed)
+                    update_status()
+
+                if fatal:
+                    for future in running:
+                        future.cancel()
+                    # The executor context waits for already-active work. Its
+                    # results are intentionally discarded after the fatal error.
+        finally:
+            if status is not None:
+                status.stop()
+
+        return completed, fatal
+
+    def run(self) -> None:
+        self._create_storage()
+        self._setup_logging()
+
+        ordered_modules = self._ordered_modules()
+        if ordered_modules is None:
+            return
+
+        # Load shared indicators before touching the acquisition.
+        self.iocs
+
+        try:
+            self.init()
+        except NotImplementedError:
+            pass
+
+        self._log_loaded_modules(ordered_modules)
+
+        jobs = self.jobs
+        if settings.PROFILE and jobs > 1:
+            self.log.warning(
+                "MVT_PROFILE is enabled; forcing sequential module execution."
+            )
+            jobs = 1
+
+        if jobs == 1:
+            completed, fatal = self._run_sequential(ordered_modules)
+        else:
+            completed, fatal = self._run_parallel(ordered_modules, jobs)
+
+        self._aggregate_modules(ordered_modules, completed)
 
         try:
             self.finish()
         except NotImplementedError:
             pass
 
+        if fatal:
+            self.log.critical(
+                "The backup appears to be encrypted. "
+                "Please decrypt it first using `mvt-ios decrypt-backup`."
+            )
+            return
+
         # We only store the timeline from the parent/main command
         if self.sub_command:
             return

src/mvt/common/help.py

@@ -17,6 +17,7 @@ HELP_MSG_LOAD_MODULE = (
 HELP_MSG_NONINTERACTIVE = "Don't ask interactive questions during processing"
 HELP_MSG_HASHES = "Generate hashes of all the files analyzed"
 HELP_MSG_VERBOSE = "Verbose mode"
+HELP_MSG_JOBS = "Number of extraction modules to run concurrently"
 HELP_MSG_VERBOSE_COMMAND = (
     "Verbose mode (kept for compatibility, pass --verbose before the command "
     "name instead)"

src/mvt/common/log.py

@@ -4,6 +4,8 @@
 #   https://license.mvt.re/1.1/
 
 import logging
+import threading
+from contextvars import ContextVar, Token
 from rich.console import Console
 from rich.logging import RichHandler
 from typing import Optional
@@ -27,16 +29,33 @@ logging.addLevelName(HIGH_ALERT, "HIGH")
 logging.addLevelName(CRITICAL_ALERT, "CRITICAL")
 
 
+_module_log_buffer: ContextVar[Optional[list[logging.LogRecord]]] = ContextVar(
+    "mvt_module_log_buffer", default=None
+)
+
+
+def start_module_log_buffer() -> Token:
+    """Capture console records in the current module execution context."""
+    return _module_log_buffer.set([])
+
+
+def finish_module_log_buffer(token: Token) -> list[logging.LogRecord]:
+    records = _module_log_buffer.get() or []
+    _module_log_buffer.reset(token)
+    return records
+
+
 class MVTLogHandler(RichHandler):
     def __init__(self, console: Optional[Console] = None, level: int = logging.DEBUG):
         super().__init__(console=console, level=level)
+        self._console_lock = threading.RLock()
 
     def __add_prefix_space(self, level: str) -> str:
         max_length = len("CRITICAL ALERT")
         space = max_length - len(level)
         return f"{level}{' ' * space}"
 
-    def emit(self, record: logging.LogRecord):
+    def _emit_record(self, record: logging.LogRecord) -> None:
         try:
             msg = rf"[grey50]\[{record.name}][/] {self.format(record)}"
 
@@ -63,3 +82,24 @@ class MVTLogHandler(RichHandler):
 
         except Exception:
             self.handleError(record)
+
+    def emit(self, record: logging.LogRecord):
+        buffer = _module_log_buffer.get()
+        if buffer is not None:
+            # More than one CLI can be imported in-process (notably in tests),
+            # which can install multiple console handlers for the same record.
+            if not buffer or buffer[-1] is not record:
+                buffer.append(record)
+            return
+
+        with self._console_lock:
+            self._emit_record(record)
+
+    def emit_module_records(
+        self, module_name: str, records: list[logging.LogRecord]
+    ) -> None:
+        """Print one module's captured records without interleaving."""
+        with self._console_lock:
+            self.console.print(f"[bold cyan]--- {module_name} ---[/bold cyan]")
+            for record in records:
+                self._emit_record(record)

src/mvt/common/module.py

@@ -8,6 +8,7 @@ import json
 import logging
 import os
 import re
+import threading
 from dataclasses import asdict, is_dataclass
 from typing import Any, Dict, Optional, Sequence
 
@@ -46,6 +47,7 @@ class MVTModule:
     slug: Optional[str] = None
     dependencies: Sequence[type["MVTModule"]] = ()
     supported_commands: Sequence[tuple[str, str]] = ()
+    parallel_safe: bool = True
     # A custom module can name a module class it supersedes, usually a
     # built-in one. When both are available to a command, the named module is
     # dropped from the run and this module takes its place, including in the
@@ -90,6 +92,12 @@ class MVTModule:
         self.timeline: ModuleTimeline = []
         self.url_results: list[URLResult] = []
         self.dependency_modules: Dict[type["MVTModule"], "MVTModule"] = {}
+        # Commands replace this with a command-scoped lock for modules sharing
+        # archive handles or other non-thread-safe read resources.
+        self.resource_lock = threading.RLock()
+        # Commands also replace this with a command-scoped cache. Cached values
+        # must be immutable, because parallel modules can read them concurrently.
+        self.resource_cache: Dict[object, Any] = {}
 
     def get_dependency_results(
         self, module_class: type["MVTModule"]
@@ -185,17 +193,20 @@ class MVTModule:
 
         """
         timeline_set = set()
+        deduplicated = []
         for record in timeline:
-            timeline_set.add(
-                json.dumps(
-                    asdict(record)
-                    if is_dataclass(record) and not isinstance(record, type)
-                    else record,
-                    sort_keys=True,
-                )
+            serialized = json.dumps(
+                asdict(record)
+                if is_dataclass(record) and not isinstance(record, type)
+                else record,
+                sort_keys=True,
             )
+            if serialized in timeline_set:
+                continue
+            timeline_set.add(serialized)
+            deduplicated.append(json.loads(serialized))
 
-        return [json.loads(record) for record in timeline_set]
+        return deduplicated
 
     def to_timeline(self) -> None:
         """Convert results into a timeline."""

src/mvt/common/url.py

@@ -349,7 +349,9 @@ class URL:
             return tld_obj
         if tld_obj is None:
             return ""
-        return tld_obj.parsed_url.netloc.lower().lstrip("www.")
+        # removeprefix, not lstrip: lstrip takes a set of characters, so it ate the
+        # leading "w"s and dots of any domain ("web.evil.com" -> "eb.evil.com").
+        return tld_obj.parsed_url.netloc.lower().removeprefix("www.")
 
     def get_top_level(self) -> str:
         """Get only the top-level domain from a URL.

src/mvt/ios/cli.py

@@ -36,6 +36,7 @@ from mvt.common.help import (
     HELP_MSG_LOAD_MODULE,
     HELP_MSG_MODULE,
     HELP_MSG_VERBOSE,
+    HELP_MSG_JOBS,
     HELP_MSG_VERBOSE_COMMAND,
     HELP_MSG_CHECK_FS,
     HELP_MSG_CHECK_IOCS,
@@ -279,6 +280,9 @@ def extract_key(password, key_file, backup_path):
 )
 @click.option("--hashes", "-H", is_flag=True, help=HELP_MSG_HASHES)
 @click.option("--verbose", "-v", is_flag=True, help=HELP_MSG_VERBOSE_COMMAND)
+@click.option(
+    "--jobs", type=click.IntRange(min=1), default=4, show_default=True, help=HELP_MSG_JOBS
+)
 @click.argument("BACKUP_PATH", type=click.Path(exists=True))
 @click.pass_context
 def check_backup(
@@ -291,6 +295,7 @@ def check_backup(
     load_module,
     hashes,
     verbose,
+    jobs,
     backup_path,
 ):
     from .cmd_check_backup import CmdIOSCheckBackup
@@ -309,6 +314,7 @@ def check_backup(
         disable_version_check=_get_disable_flags(ctx)[0],
         disable_indicator_check=_get_disable_flags(ctx)[1],
         custom_modules=custom_modules,
+        jobs=jobs,
     )
 
     if list_modules:
@@ -348,6 +354,9 @@ def check_backup(
 )
 @click.option("--hashes", "-H", is_flag=True, help=HELP_MSG_HASHES)
 @click.option("--verbose", "-v", is_flag=True, help=HELP_MSG_VERBOSE_COMMAND)
+@click.option(
+    "--jobs", type=click.IntRange(min=1), default=4, show_default=True, help=HELP_MSG_JOBS
+)
 @click.argument("DUMP_PATH", type=click.Path(exists=True))
 @click.pass_context
 def check_fs(
@@ -360,6 +369,7 @@ def check_fs(
     load_module,
     hashes,
     verbose,
+    jobs,
     dump_path,
 ):
     from .cmd_check_fs import CmdIOSCheckFS
@@ -378,6 +388,7 @@ def check_fs(
         disable_version_check=_get_disable_flags(ctx)[0],
         disable_indicator_check=_get_disable_flags(ctx)[1],
         custom_modules=custom_modules,
+        jobs=jobs,
     )
 
     if list_modules:

src/mvt/ios/cmd_check_backup.py

@@ -38,6 +38,7 @@ class CmdIOSCheckBackup(Command):
         disable_version_check: bool = False,
         disable_indicator_check: bool = False,
         custom_modules: Optional[list[type[MVTModule]]] = None,
+        jobs: int = 4,
     ) -> None:
         super().__init__(
             target_path=target_path,
@@ -53,6 +54,7 @@ class CmdIOSCheckBackup(Command):
             disable_version_check=disable_version_check,
             disable_indicator_check=disable_indicator_check,
             custom_modules=custom_modules,
+            jobs=jobs,
         )
 
         self.platform = "ios"

src/mvt/ios/cmd_check_fs.py

@@ -31,6 +31,7 @@ class CmdIOSCheckFS(Command):
         disable_version_check: bool = False,
         disable_indicator_check: bool = False,
         custom_modules: Optional[list[type[MVTModule]]] = None,
+        jobs: int = 4,
     ) -> None:
         super().__init__(
             target_path=target_path,
@@ -45,6 +46,7 @@ class CmdIOSCheckFS(Command):
             disable_version_check=disable_version_check,
             disable_indicator_check=disable_indicator_check,
             custom_modules=custom_modules,
+            jobs=jobs,
         )
 
         self.platform = "ios"

src/mvt/ios/data/ios_versions.json

@@ -1279,5 +1279,9 @@
     {
         "version": "27.0",
         "build": "24A437"
+    },
+    {
+        "version": "27.0.1",
+        "build": "24A446"
     }
 ]

src/mvt/ios/modules/backup/manifest.py

@@ -147,6 +147,12 @@ class Manifest(IOSExtraction):
             )
         names = [description[0] for description in cur.description]
 
+        # An incomplete backup still lists the files it failed to acquire in
+        # its manifest. Only regular files are stored in the backup folder, so
+        # directories and symlinks (flags 2 and 4) are not looked up.
+        stored_file_ids = self._get_stored_backup_file_ids()
+        missing_files = 0
+
         for file_entry in cur:
             file_data = {}
             for index, value in enumerate(file_entry):
@@ -160,6 +166,22 @@ class Manifest(IOSExtraction):
                 "created": "",
             }
 
+            if (
+                stored_file_ids is not None
+                and file_data["flags"] == 1
+                and file_data["fileID"] not in stored_file_ids
+            ):
+                # Without this, a module which found nothing for one of these
+                # files would look like a negative result rather than a gap in
+                # the acquisition.
+                cleaned_metadata["missing"] = True
+                missing_files += 1
+                self.log.debug(
+                    "File %s is listed in the manifest but was not found in the "
+                    "backup folder",
+                    cleaned_metadata["relative_path"],
+                )
+
             if file_data["file"]:
                 try:
                     file_plist = plistlib.load(io.BytesIO(file_data["file"]))
@@ -197,3 +219,10 @@ class Manifest(IOSExtraction):
         conn.close()
 
         self.log.info("Extracted a total of %d file metadata items", len(self.results))
+
+        if missing_files:
+            self.log.info(
+                "Found %d files listed in the manifest but missing from the backup "
+                "folder. The backup might be incomplete.",
+                missing_files,
+            )

src/mvt/ios/modules/base.py

@@ -216,6 +216,55 @@ class IOSExtraction(MVTModule):
 
         return None
 
+    def _get_stored_backup_file_ids(self) -> Optional[set[str]]:
+        """List the IDs of the files actually stored in the backup folder.
+
+        A backup folder stores each file under a two character subfolder named
+        after the first two characters of its file ID. Walking the folders once
+        is cheaper than a filesystem lookup per file ID, and it keeps callers
+        which compare a whole manifest against the folder from paying a
+        `resolve()` for every entry.
+
+        :returns: The file IDs found at their expected paths within the backup
+                  folder, or None if the inventory could not be completed.
+        """
+        if not self.target_path:
+            return None
+
+        file_ids: set[str] = set()
+        try:
+            backup_root = Path(self.target_path).resolve()
+            with os.scandir(self.target_path) as entries:
+                for entry in entries:
+                    if len(entry.name) != 2 or any(
+                        char not in "0123456789abcdef" for char in entry.name
+                    ):
+                        continue
+                    if not entry.is_dir():
+                        continue
+                    if not Path(entry.path).resolve().is_relative_to(backup_root):
+                        continue
+                    with os.scandir(entry.path) as sub_entries:
+                        for sub_entry in sub_entries:
+                            if sub_entry.name[:2] != entry.name:
+                                continue
+                            if sub_entry.is_symlink() and not Path(
+                                sub_entry.path
+                            ).resolve().is_relative_to(backup_root):
+                                continue
+                            if sub_entry.is_file():
+                                file_ids.add(sub_entry.name)
+        except OSError as exc:
+            self.log.warning(
+                "Unable to list the files stored in the backup folder %s: %s. "
+                "Skipping the missing-file check.",
+                self.target_path,
+                exc,
+            )
+            return None
+
+        return file_ids
+
     def _get_fs_files_from_patterns(self, root_paths: list) -> Iterator[str]:
         if not self.target_path:
             return

src/mvt/ios/modules/fs/filesystem.py

@@ -82,7 +82,9 @@ class Filesystem(IOSExtraction):
                 try:
                     dir_path = os.path.join(root, dir_name)
                     result = {
-                        "path": os.path.relpath(dir_path, self.target_path),
+                        "path": os.path.relpath(dir_path, self.target_path).replace(
+                            os.sep, "/"
+                        ),
                         "modified": convert_unix_to_iso(os.stat(dir_path).st_mtime),
                     }
                 except Exception:
@@ -94,7 +96,9 @@ class Filesystem(IOSExtraction):
                 try:
                     file_path = os.path.join(root, file_name)
                     result = {
-                        "path": os.path.relpath(file_path, self.target_path),
+                        "path": os.path.relpath(file_path, self.target_path).replace(
+                            os.sep, "/"
+                        ),
                         "modified": convert_unix_to_iso(os.stat(file_path).st_mtime),
                     }
                 except Exception:

tests/android/test_artifact_dumpsys_accessibility.py

@@ -35,11 +35,16 @@ class TestDumpsysAccessibilityArtifact:
 
         assert len(da.results) == 0
         da.parse(data)
-        assert len(da.results) == 1
+        # One named service, plus one count-only record: the dump states
+        # `installedServiceCount=2` and names only one component.
+        assert len(da.results) == 2
         assert da.results[0]["package_name"] == "com.malware.accessibility"
         assert da.results[0]["service_name"] == "com.malware.service.malwareservice"
         assert da.results[0]["enabled"] is True
-        assert da.results[0]["installed"] is False
+        # This fixture never prints an `installed services:` section, so the
+        # dump does not state the installed status. Reporting False would turn
+        # "not stated" into "not installed", so it reads None here.
+        assert da.results[0]["installed"] is None
 
     def test_accessibility_service_alert(self):
         da = DumpsysAccessibilityArtifact()
@@ -50,9 +55,11 @@ class TestDumpsysAccessibilityArtifact:
 
         da.check_indicators()
 
-        assert len(da.alertstore.alerts) == 1
+        assert len(da.alertstore.alerts) == 2
         assert da.alertstore.alerts[0].level == AlertLevel.MEDIUM
         assert da.alertstore.alerts[0].event == da.results[0]
+        assert da.alertstore.alerts[1].level == AlertLevel.LOW
+        assert da.alertstore.alerts[1].event == da.results[1]
 
     def test_same_component_is_kept_for_each_user(self):
         da = DumpsysAccessibilityArtifact()
@@ -84,7 +91,11 @@ User state[attributes:{id=10
         assert len(da.alertstore.alerts) == 0
         da.check_indicators()
         assert len(da.alertstore.alerts) == len(da.results)
-        assert da.alertstore.count(AlertLevel.MEDIUM) == 3
+        # Every service in this fixture is installed and switched off
+        # (`enabled services:{}` is printed and empty), so the three non-IOC
+        # findings are LOW, not MEDIUM. The IOC match is unaffected by the
+        # state.
+        assert da.alertstore.count(AlertLevel.LOW) == 3
         assert da.alertstore.count(AlertLevel.CRITICAL) == 1
         critical_alert = next(
             alert

tests/android/test_artifact_dumpsys_accessibility_count.py

@@ -0,0 +1,149 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2026 The MVT Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+"""The dump's own installed-service count must survive into the artifact.
+
+Most builds never print the `installed services: {…}` block; they state `installedServiceCount=N` in the user's `attributes:{…}` line and
+list nothing. Dropping that number makes an artifact that says "no
+accessibility services" about a dump that said there are five.
+"""
+
+from mvt.android.artifacts.dumpsys_accessibility import DumpsysAccessibilityArtifact
+from mvt.common.alerts import AlertLevel
+
+from ..utils import get_artifact
+
+AOSP_NO_LIST = """\
+ACCESSIBILITY MANAGER (dumpsys accessibility)
+User state[
+     attributes:{id=0, touchExplorationEnabled=false, installedServiceCount=5}
+     Bound services:{}
+     Enabled services:{}
+     Binding services:{}
+     Crashed services:{}
+"""
+
+ONE_UI_WITH_LIST = """\
+ACCESSIBILITY MANAGER (dumpsys accessibility)
+User state[attributes:{id=0, installedServiceCount=2}
+  installed services: {
+    0 : com.example.app/com.example.app.Service
+    1 : com.other.app/.Helper
+  }
+  enabled services: {
+  }
+"""
+
+TWO_USERS = """\
+ACCESSIBILITY MANAGER (dumpsys accessibility)
+User state[attributes:{id=0, installedServiceCount=1}
+  installed services: {
+    0 : com.example.app/com.example.app.Service
+  }
+User state[attributes:{id=95, installedServiceCount=3}
+     Enabled services:{}
+"""
+
+PARTIAL_TWO_USERS = """\
+ACCESSIBILITY MANAGER (dumpsys accessibility)
+User state[attributes:{id=0, installedServiceCount=3}
+     Enabled services:{{com.example.app/com.example.app.Service}}
+User state[attributes:{id=10, installedServiceCount=1}
+     Enabled services:{{com.other.app/.Helper}}
+"""
+
+ZERO_COUNT = """\
+ACCESSIBILITY MANAGER (dumpsys accessibility)
+User state[attributes:{id=0, installedServiceCount=0}
+     Enabled services:{}
+"""
+
+
+def _parse(content):
+    artifact = DumpsysAccessibilityArtifact()
+    artifact.results = []
+    artifact.parse(content)
+    return artifact
+
+
+class TestAccessibilityInstalledServiceCount:
+    def test_stated_count_without_a_list_is_kept(self):
+        artifact = _parse(AOSP_NO_LIST)
+        assert len(artifact.results) == 1
+        record = artifact.results[0]
+        assert record["installed_service_count"] == 5
+        assert record["component"] is None
+        # Every state flag stays unknown: the dump named no service to which a
+        # state could belong.
+        assert record["installed"] is None
+        assert record["enabled"] is None
+
+    def test_a_stated_count_is_reported_as_low(self):
+        artifact = _parse(AOSP_NO_LIST)
+        artifact.check_indicators()
+        alerts = artifact.alertstore.alerts
+        assert len(alerts) == 1
+        # A count is a coverage statement, not a running service: it must not
+        # compete with a service the dump says is enabled.
+        assert alerts[0].level == AlertLevel.LOW
+        assert "does not list their component names" in alerts[0].message
+        assert "5 installed" in alerts[0].message
+
+    def test_a_listed_user_carries_the_count_on_each_service(self):
+        artifact = _parse(ONE_UI_WITH_LIST)
+        assert len(artifact.results) == 2
+        assert {record["installed_service_count"] for record in artifact.results} == {2}
+        assert all(record["component"] for record in artifact.results)
+
+    def test_only_the_unlisted_user_gets_a_count_record(self):
+        artifact = _parse(TWO_USERS)
+        listed = [record for record in artifact.results if record["component"]]
+        unlisted = [record for record in artifact.results if not record["component"]]
+        assert [record["user_id"] for record in listed] == [0]
+        assert [record["user_id"] for record in unlisted] == [95]
+        assert unlisted[0]["installed_service_count"] == 3
+
+    def test_a_zero_count_adds_nothing(self):
+        # "Zero installed" is a negative result the empty section already
+        # states; a record for it would be noise.
+        assert _parse(ZERO_COUNT).results == []
+
+    def test_a_partly_named_count_reports_the_unnamed_rest(self):
+        # The Android 14 fixture states `installedServiceCount=2` and names one
+        # enabled component. The listing is incomplete, and must not read as
+        # complete.
+        artifact = DumpsysAccessibilityArtifact()
+        artifact.results = []
+        with open(
+            get_artifact("android_data/dumpsys_accessibility_v14_or_later.txt")
+        ) as handle:
+            artifact.parse(handle.read())
+        unlisted = [record for record in artifact.results if not record["component"]]
+        assert len(unlisted) == 1
+        assert unlisted[0]["installed_service_count"] == 2
+        assert unlisted[0]["unnamed_service_count"] == 1
+
+        artifact.check_indicators()
+        low = [
+            alert
+            for alert in artifact.alertstore.alerts
+            if alert.level == AlertLevel.LOW
+        ]
+        assert len(low) == 1
+        assert "only 1 of them (1 unnamed)" in low[0].message
+
+    def test_the_unnamed_rest_is_counted_per_user(self):
+        # User 0 names one of three, user 10 names its only one: the gap
+        # belongs to user 0 alone.
+        artifact = _parse(PARTIAL_TWO_USERS)
+        unlisted = [record for record in artifact.results if not record["component"]]
+        assert [
+            (record["user_id"], record["unnamed_service_count"]) for record in unlisted
+        ] == [(0, 2)]
+
+    def test_a_fully_named_count_adds_nothing(self):
+        artifact = _parse(ONE_UI_WITH_LIST)
+        assert all(
+            record["unnamed_service_count"] is None for record in artifact.results
+        )

tests/android/test_artifact_dumpsys_accessibility_state.py

@@ -0,0 +1,155 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2026 The MVT Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+"""Installed is not the same as enabled, and the dump says which.
+
+Two things this guards:
+
+  * a section the dump never printed must read as None ("not stated"), not as
+    False ("not enabled");
+  * the alert must name the state, instead of firing identically on a device
+    where nothing is switched on and one where something is bound.
+"""
+
+from types import SimpleNamespace
+
+from mvt.android.artifacts.dumpsys_accessibility import DumpsysAccessibilityArtifact
+from mvt.common.alerts import AlertLevel
+
+from ..utils import get_artifact
+
+NO_STATE_SECTIONS = """\
+ACCESSIBILITY MANAGER (dumpsys accessibility)
+User state[attributes:{id=0, currentUser=true}
+  installed services: {
+    0 : com.example.app/com.example.app.Service
+  }
+"""
+
+ENABLED_BLOCK = """\
+ACCESSIBILITY MANAGER (dumpsys accessibility)
+User state[attributes:{id=0, currentUser=true}
+  installed services: {
+    0 : com.example.app/com.example.app.Service
+    1 : com.other.app/.Helper
+  }
+  enabled services: {
+    0 : com.other.app/.Helper
+  }
+  bound services:{
+    0 : com.other.app/.Helper
+  }
+"""
+
+# User 0 prints only `installed services`, user 10 only `Enabled services`.
+# Neither section speaks for the other user.
+TWO_USERS_DIFFERENT_SECTIONS = """\
+ACCESSIBILITY MANAGER (dumpsys accessibility)
+User state[attributes:{id=0, currentUser=true}
+  installed services: {
+    0 : com.example.app/com.example.app.Service
+  }
+User state[attributes:{id=10, currentUser=false}
+     Enabled services:{{com.other.app/.Helper}}
+"""
+
+
+class _IndicatorsMatching:
+    """Minimal stand-in: matches one package id, like the STIX2 loader would."""
+
+    def __init__(self, package_name: str) -> None:
+        self.package_name = package_name
+
+    def check_app_id(self, app_id):
+        if app_id != self.package_name:
+            return None
+        return SimpleNamespace(
+            message=f"Found a known suspicious app: {app_id}", ioc={"value": app_id}
+        )
+
+
+class TestAccessibilityServiceState:
+    def _parse(self, content):
+        artifact = DumpsysAccessibilityArtifact()
+        artifact.results = []
+        artifact.parse(content)
+        return {r["component"]: r for r in artifact.results}
+
+    def test_absent_sections_leave_the_state_unknown(self):
+        # None, not False: a build that does not print the sections says
+        # nothing about what is enabled, and that must not read as "nothing".
+        state = self._parse(NO_STATE_SECTIONS)[
+            "com.example.app/com.example.app.Service"
+        ]
+        assert state["installed"] is True
+        assert state["enabled"] is None
+        assert state["bound"] is None
+
+    def test_enabled_and_bound_are_attributed_per_service(self):
+        results = self._parse(ENABLED_BLOCK)
+        installed_only = results["com.example.app/com.example.app.Service"]
+        active = results["com.other.app/.Helper"]
+        assert (installed_only["enabled"], installed_only["bound"]) == (False, False)
+        assert (active["enabled"], active["bound"]) == (True, True)
+
+    def test_alert_message_carries_the_state(self):
+        artifact = DumpsysAccessibilityArtifact()
+        artifact.results = []
+        with open(get_artifact("android_data/dumpsys_accessibility.txt")) as handle:
+            artifact.parse(handle.read())
+        artifact.check_indicators()
+        assert artifact.alertstore.alerts
+        assert all("installed" in alert.message for alert in artifact.alertstore.alerts)
+
+    def test_a_switched_off_service_is_low_and_a_running_one_medium(self):
+        # A service the dump says is OFF still reaches the analyst, but must not
+        # compete with one that is actually bound. "Not stated" is not "off".
+        artifact = DumpsysAccessibilityArtifact()
+        artifact.results = []
+        artifact.parse(ENABLED_BLOCK)
+        artifact.check_indicators()
+        by_level = {}
+        for alert in artifact.alertstore.alerts:
+            by_level.setdefault(alert.level, []).append(alert.message)
+        assert artifact.alertstore.count(AlertLevel.LOW) == 1
+        assert artifact.alertstore.count(AlertLevel.MEDIUM) == 1
+        assert "com.example.app" in by_level[AlertLevel.LOW][0]
+        assert "com.other.app" in by_level[AlertLevel.MEDIUM][0]
+
+    def test_an_unstated_enabled_state_stays_medium(self):
+        artifact = DumpsysAccessibilityArtifact()
+        artifact.results = []
+        artifact.parse(NO_STATE_SECTIONS)
+        artifact.check_indicators()
+        assert artifact.alertstore.count(AlertLevel.MEDIUM) == 1
+        assert artifact.alertstore.count(AlertLevel.LOW) == 0
+
+    def test_a_disabled_service_is_still_matched_against_indicators(self):
+        # The state decides the severity of an ordinary finding, never whether
+        # the package is compared with the IOC feeds.
+        artifact = DumpsysAccessibilityArtifact()
+        artifact.results = []
+        artifact.parse(ENABLED_BLOCK)
+        artifact.indicators = _IndicatorsMatching("com.example.app")
+        artifact.check_indicators()
+        assert artifact.alertstore.count(AlertLevel.CRITICAL) == 1
+        assert artifact.alertstore.count(AlertLevel.LOW) == 0
+
+    def test_printed_sections_are_tracked_per_user(self):
+        artifact = DumpsysAccessibilityArtifact()
+        artifact.results = []
+        artifact.parse(TWO_USERS_DIFFERENT_SECTIONS)
+        by_user = {r["user_id"]: r for r in artifact.results}
+        # User 0's enabled state is not stated, so it is unknown, not off.
+        assert (by_user[0]["installed"], by_user[0]["enabled"]) == (True, None)
+        # User 10's installed state is not stated either.
+        assert (by_user[10]["installed"], by_user[10]["enabled"]) == (None, True)
+
+        artifact.check_indicators()
+        assert artifact.alertstore.count(AlertLevel.LOW) == 0
+        assert artifact.alertstore.count(AlertLevel.MEDIUM) == 2
+        assert not any(
+            "installed, not enabled" in alert.message
+            for alert in artifact.alertstore.alerts
+        )

tests/android/test_artifact_dumpsys_adb.py

@@ -130,6 +130,180 @@ class TestDumpsysADBArtifact:
         assert key_store_entry["fingerprint"] == expected_fingerprint
         assert key_store_entry["last_connected"] == "1628501829898"
 
+    def test_parsing_adb_xml_with_crlf_line_endings(self):
+        da_adb = DumpsysADBArtifact()
+        file = get_artifact("android_data/dumpsys_adb_xml.txt")
+        with open(file, "rb") as f:
+            data = f.read().replace(b"\r\n", b"\n").replace(b"\n", b"\r\n")
+
+        da_adb.parse(data)
+
+        assert len(da_adb.results) == 1
+        assert da_adb.results[0]["user_keys"][0]["user"] == "user@laptop"
+        assert da_adb.results[0]["keystore"][0]["last_connected"] == "1628501829898"
+
+    def test_parsing_adb_wifi_with_mixed_line_endings(self):
+        da_adb = DumpsysADBArtifact()
+        data = (
+            b"ADB MANAGER STATE (dumpsys adb):\n"
+            b"{\n"
+            b"  debugging_manager={\n"
+            b"    connected_to_adb=true\n"
+            b"    user_keys=QUJDRA== host@example\n"
+            b"    adb_wifi={\n"
+            b"      enabled=false\n"
+            b"    }\n"
+            b"  }\r\n"
+            b"}\n"
+            b"--------- duration\n"
+        )
+
+        da_adb.parse(data)
+
+        assert len(da_adb.results) == 1
+        assert da_adb.results[0]["user_keys"][0]["user"] == "host@example"
+        assert da_adb.results[0]["adb_wifi"]["enabled"] == b"false"
+
+    ADB_STATE = (
+        b"ADB MANAGER STATE (dumpsys adb):\n"
+        b"{\n"
+        b"  debugging_manager={\n"
+        b"    connected_to_adb=true\n"
+        b"    user_keys=QUJDRA== host@example\n"
+        b"  }\n"
+        b"}\n"
+        b"--------- 0.5s was the duration of 'dumpsys adb'\n"
+    )
+
+    def test_a_later_dumpsys_section_does_not_extend_the_adb_state(self):
+        # A bug report holds many sections. Looking for the last closing brace
+        # in the whole output pulled a later section into this one, which threw
+        # IndexError out of parse() and lost the ADB records entirely.
+        da_adb = DumpsysADBArtifact()
+        da_adb.parse(
+            self.ADB_STATE + b"DUMP OF SERVICE other:\n"
+            b"  debugging_manager={\n"
+            b"    connected_to_adb=false\n"
+            b"    user_keys=RVZJTA== attacker@host\n"
+            b"  }\n"
+            b"}\n"
+        )
+
+        assert len(da_adb.results) == 1
+        assert [key["user"] for key in da_adb.results[0]["user_keys"]] == [
+            "host@example"
+        ]
+        assert da_adb.results[0]["connected_to_adb"] is True
+
+    def test_braces_in_key_comment_are_not_state_delimiters(self):
+        for user in (b"host{example", b"host}}example"):
+            da_adb = DumpsysADBArtifact()
+            da_adb.parse(
+                b"ADB MANAGER STATE (dumpsys adb):\n"
+                b"{\n"
+                b"  debugging_manager={\n"
+                b"    connected_to_adb=true\n"
+                b"    user_keys=QUJDRA== " + user + b"\n  }\n}\n"
+            )
+
+            assert len(da_adb.results) == 1
+            assert da_adb.results[0]["user_keys"][0]["user"] == user.decode()
+
+    def test_state_without_keys_is_parsed_without_error(self, caplog):
+        # Shape printed by every device with no stored ADB keys (Samsung
+        # SM-A525F, Android 12). The block's closing brace is dedented from
+        # the last entry and must close exactly one level.
+        da_adb = DumpsysADBArtifact()
+        da_adb.parse(
+            b"ADB MANAGER STATE (dumpsys adb):\n"
+            b"{\n"
+            b"  debugging_manager={\n"
+            b"    connected_to_adb=false\n"
+            b"  }\n"
+            b"}\n"
+            b"--------- 0.015s was the duration of dumpsys adb\n"
+        )
+
+        assert len(da_adb.results) == 1
+        assert da_adb.results[0]["connected_to_adb"] is False
+        assert not [r for r in caplog.records if r.levelname == "ERROR"]
+
+    def test_nested_block_as_last_entry_is_parsed_without_error(self, caplog):
+        # Shape printed by Pixel devices with no stored ADB keys.
+        da_adb = DumpsysADBArtifact()
+        da_adb.parse(
+            b"ADB MANAGER STATE (dumpsys adb):\n"
+            b"{\n"
+            b"  debugging_manager={\n"
+            b"    connected_to_adb=false\n"
+            b"    adb_wifi={\n"
+            b"      enabled=false\n"
+            b"      tls_port=0\n"
+            b"    }\n"
+            b"  }\n"
+            b"}\n"
+        )
+
+        assert len(da_adb.results) == 1
+        assert da_adb.results[0]["connected_to_adb"] is False
+        assert da_adb.results[0]["adb_wifi"]["tls_port"] == b"0"
+        assert not [r for r in caplog.records if r.levelname == "ERROR"]
+
+    def test_entry_after_nested_block_stays_in_debugging_manager(self):
+        da_adb = DumpsysADBArtifact()
+        da_adb.parse(
+            b"ADB MANAGER STATE (dumpsys adb):\n"
+            b"{\n"
+            b"  debugging_manager={\n"
+            b"    adb_wifi={\n"
+            b"      enabled=false\n"
+            b"    }\n"
+            b"    connected_to_adb=true\n"
+            b"  }\n"
+            b"}\n"
+        )
+
+        assert len(da_adb.results) == 1
+        assert da_adb.results[0]["connected_to_adb"] is True
+
+    def test_blank_line_after_single_line_value_does_not_raise(self):
+        # `system_keys` is the content of /adb_keys and ends with a newline,
+        # so a blank line follows it. It is not a multiline field, so the
+        # blank line is not a multiline terminator either.
+        da_adb = DumpsysADBArtifact()
+        da_adb.parse(
+            b"ADB MANAGER STATE (dumpsys adb):\n"
+            b"{\n"
+            b"  debugging_manager={\n"
+            b"    connected_to_adb=true\n"
+            b"    user_keys=QUJDRA== host@example\n"
+            b"\n"
+            b"    system_keys=RUZHSA== system@example\n"
+            b"\n"
+            b"  }\n"
+            b"}\n"
+        )
+
+        assert len(da_adb.results) == 1
+        assert da_adb.results[0]["user_keys"][0]["user"] == "host@example"
+        assert da_adb.results[0]["system_keys"] == "RUZHSA== system@example"
+
+    def test_unbalanced_state_is_reported_rather_than_raising(self):
+        da_adb = DumpsysADBArtifact()
+        da_adb.parse(
+            b"ADB MANAGER STATE (dumpsys adb):\n"
+            b"{\n"
+            b"  debugging_manager={\n"
+            b"    connected_to_adb=true\n"
+            b"  }\n"
+            b"  }\n"
+            b"}\n"
+        )
+
+        # No exception, and whatever was read before the bad line is kept.
+        assert len(da_adb.results) == 1
+        assert da_adb.results[0]["connected_to_adb"] is True
+
 
 class TestDumpsysADBStateAlerts:
     def test_no_androidqf_context_preserves_existing_behavior(self):

tests/android/test_artifact_dumpsys_battery_daily.py

@@ -144,3 +144,18 @@ class TestDumpsysBatteryDailyArtifact:
             "Detected uninstall of package com.example.app (vers 0)"
         )
         assert uninstall_alert.event_time == "2026-01-10"
+
+    def test_malformed_update_line_does_not_lose_later_records(self):
+        # A truncated "Update" line, or one from a vendor that omits "vers=",
+        # used to raise out of parse() and lose every record after it.
+        dba = DumpsysBatteryDailyArtifact()
+        dba.parse(
+            "  Daily from 2021-05-10-08-00-00 to 2021-05-11-08-00-00:\n"
+            "    Update com.first vers=1\n"
+            "    Update com.truncated\n"
+            "    Update com.no.equals vers 2\n"
+            "    Update com.last vers=3\n"
+        )
+
+        assert [r["package_name"] for r in dba.results] == ["com.first", "com.last"]
+        assert [r["version_code"] for r in dba.results] == [1, 3]

tests/android/test_artifact_settings.py

@@ -3,6 +3,8 @@
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
+from typing import Optional
+
 from mvt.android.artifacts.settings import Settings
 
 from ..utils import get_artifact
@@ -21,6 +23,21 @@ def find(settings: Settings, name: str) -> list:
     return [result for result in settings.results if result["name"] == name]
 
 
+def resolve_history_time(time: str, section_end: str) -> Optional[str]:
+    settings = Settings()
+    settings.parse(
+        "SECURE SETTINGS (user 0)\n"
+        "_id:240 name:accessibility_enabled pkg:android value:1\n"
+        "\tHistory (accessibility_enabled)\n"
+        f"\t\ttime:{time} mode:update oldValue:0 newValue:1 "
+        "package:com.example.helper\n"
+        "\n"
+        "--------- 0.019s was the duration of dumpsys settings, "
+        f"ending at: {section_end}\n"
+    )
+    return settings.results[0]["history"][0]["timestamp"]
+
+
 class TestSettingsArtifact:
     def test_parsing(self):
         settings = parse_bugreport_settings()
@@ -159,6 +176,32 @@ class TestSettingsArtifact:
             }
         ]
 
+    def test_leap_day_history_keeps_its_timestamp(self):
+        assert (
+            resolve_history_time("02-29 22:41:07.980", "2024-03-05 23:14:28")
+            == "2024-02-29 22:41:07.980000"
+        )
+
+    def test_leap_day_history_resolved_to_the_last_leap_year(self):
+        # The most recent 29 February at or before the dump can be several
+        # years back when the dump was taken in a year without one.
+        assert (
+            resolve_history_time("02-29 22:41:07.980", "2025-03-01 10:00:00")
+            == "2024-02-29 22:41:07.980000"
+        )
+        assert (
+            resolve_history_time("02-29 22:41:07.980", "2024-01-10 10:00:00")
+            == "2020-02-29 22:41:07.980000"
+        )
+
+    def test_leap_day_history_before_a_leap_day_after_a_skipped_century(self):
+        # 2100 is not a leap year, so before 29 February 2104 the most
+        # recent matching date is eight years earlier, in 2096.
+        assert (
+            resolve_history_time("02-29 22:41:07.980", "2104-01-10 10:00:00")
+            == "2096-02-29 22:41:07.980000"
+        )
+
     def test_dangerous_setting_is_detected_with_the_changing_package(self):
         settings = parse_bugreport_settings()
         settings.check_indicators()

tests/android/test_bugreport_section_extraction.py

@@ -0,0 +1,42 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2026 The MVT Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+"""A section ends at the next section, not at a timing line printed inside it."""
+
+from mvt.android.modules.bugreport.base import BugReportModule
+
+# dumpstate prints a section's duration when that section finishes, which can
+# land in the middle of the section currently being written.
+DUMPSTATE = """\
+------ SYSTEM PROPERTIES (getprop) ------
+[nfc.initialized]: [true]
+------ 0.101s was the duration of 'DROPBOX SYSTEM SERVER CRASHES' ------
+[ro.build.version.sdk]: [30]
+[ro.product.model]: [SM-A305F]
+------ 0.064s was the duration of 'SYSTEM PROPERTIES' ------
+------ STORAGE INFO (df) ------
+/dev/root  2.9G
+"""
+
+
+class TestExtractCommandSection:
+    def test_a_foreign_timing_line_does_not_end_the_section(self):
+        section = BugReportModule.extract_command_section(
+            DUMPSTATE, "------ SYSTEM PROPERTIES"
+        )
+        assert "[ro.product.model]: [SM-A305F]" in section
+        assert section.count("\n") == 2
+
+    def test_the_next_section_is_still_the_boundary(self):
+        section = BugReportModule.extract_command_section(
+            DUMPSTATE, "------ SYSTEM PROPERTIES"
+        )
+        assert "STORAGE INFO" not in section
+        assert "/dev/root" not in section
+
+    def test_timing_lines_are_not_returned_as_content(self):
+        section = BugReportModule.extract_command_section(
+            DUMPSTATE, "------ SYSTEM PROPERTIES"
+        )
+        assert "was the duration of" not in section

tests/android/test_check_bugreport_wrapper.py

@@ -0,0 +1,56 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2023 The MVT Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+"""An OEM wrapper archive must not read as an empty bug report.
+
+MIUI / HyperOS hands out a zip of app logs with the real
+`bugreport-<device>-<timestamp>.zip` nested inside. The outer archive has
+none of the entry points the modules read, so every module
+reported it found nothing and the command still exited 0 — an empty analysis
+that looks like a finished one.
+"""
+
+import io
+import zipfile
+
+from mvt.android.cmd_check_bugreport import CmdAndroidCheckBugreport
+
+DUMPSTATE = "== dumpstate: 2026-01-01 00:00:00\nDUMP OF SERVICE package:\n"
+
+
+def _inner_zip() -> bytes:
+    buffer = io.BytesIO()
+    with zipfile.ZipFile(buffer, "w") as inner:
+        inner.writestr("main_entry.txt", "bugreport-test-2026-01-01-00-00-00.txt")
+        inner.writestr("bugreport-test-2026-01-01-00-00-00.txt", DUMPSTATE)
+    return buffer.getvalue()
+
+
+def _wrapper_zip() -> zipfile.ZipFile:
+    buffer = io.BytesIO()
+    with zipfile.ZipFile(buffer, "w") as outer:
+        outer.writestr("app_logs/hilog.txt", "unrelated OEM log\n")
+        outer.writestr("bugreport-test-2026-01-01-00-00-00.zip", _inner_zip())
+    return zipfile.ZipFile(io.BytesIO(buffer.getvalue()))
+
+
+class TestCheckBugreportWrapper:
+    def test_nested_bugreport_is_used(self, tmp_path):
+        cmd = CmdAndroidCheckBugreport(results_path=str(tmp_path))
+        cmd.from_zip(_wrapper_zip())
+        module = cmd.modules[0](results_path=str(tmp_path))
+        cmd.module_init(module)
+        assert "main_entry.txt" in module.zip_files
+
+    def test_plain_bugreport_is_left_alone(self, tmp_path):
+        buffer = io.BytesIO()
+        with zipfile.ZipFile(buffer, "w") as archive:
+            archive.writestr("main_entry.txt", "bugreport.txt")
+            archive.writestr("bugreport.txt", DUMPSTATE)
+            archive.writestr("attachments/extra.zip", _inner_zip())
+        cmd = CmdAndroidCheckBugreport(results_path=str(tmp_path))
+        cmd.from_zip(zipfile.ZipFile(io.BytesIO(buffer.getvalue())))
+        module = cmd.modules[0](results_path=str(tmp_path))
+        cmd.module_init(module)
+        assert "attachments/extra.zip" in module.zip_files

tests/android_bugreport/test_bugreport.py

@@ -4,8 +4,13 @@
 #   https://license.mvt.re/1.1/
 
 import os
+import threading
+from concurrent.futures import ThreadPoolExecutor
+from io import BytesIO
 from pathlib import Path
+from unittest.mock import MagicMock
 
+from mvt.android.modules.bugreport.base import BugReportModule
 from mvt.android.modules.bugreport.dumpsys_appops import DumpsysAppops
 from mvt.android.modules.bugreport.dumpsys_getprop import DumpsysGetProp
 from mvt.android.modules.bugreport.dumpsys_packages import DumpsysPackages
@@ -118,3 +123,53 @@ class TestBugreportAnalysis:
         assert len(m.results) == 2
         assert m.results[1]["pid"] == 3559
         assert m.results[0]["sources"]["text"]["parsed"] is True
+
+    def test_dumpstate_section_is_cached_across_parallel_modules(self):
+        dumpstate = (
+            b"header\n"
+            b"------ SYSTEM PROPERTIES (getprop) ------\n"
+            b"[persist.sys.timezone]: [Europe/Berlin]\n"
+            b"------------------------------------------------------------------------------\n"
+            b"------\n"
+            b"DUMP OF SERVICE package:\n"
+            b"package data\n"
+            b"------------------------------------------------------------------------------\n"
+            b"DUMP OF SERVICE package:\n"
+            b"duplicate package data\n"
+            b"------------------------------------------------------------------------------\n"
+            b"DUMP OF SERVICE adb:\n"
+            b"adb data\n"
+            b"------------------------------------------------------------------------------\n"
+        )
+        archive = MagicMock()
+        archive.open.side_effect = lambda _: BytesIO(dumpstate)
+        shared_lock = threading.RLock()
+        shared_cache = {}
+        modules = []
+
+        for _ in range(4):
+            module = BugReportModule()
+            module.from_zip(archive, ["dumpState_test.log"])
+            module.resource_lock = shared_lock
+            module.resource_cache = shared_cache
+            modules.append(module)
+
+        with ThreadPoolExecutor(max_workers=4) as executor:
+            sections = list(
+                executor.map(
+                    lambda module: module._get_dumpsys_section(
+                        "DUMP OF SERVICE package:"
+                    ),
+                    modules,
+                )
+            )
+
+        assert sections == ["package data"] * 4
+        assert all(section is sections[0] for section in sections)
+        assert modules[0]._get_dumpsys_section_bytes(b"DUMP OF SERVICE adb:") == (
+            b"adb data"
+        )
+        assert modules[0]._get_system_properties_text() == (
+            "[persist.sys.timezone]: [Europe/Berlin]"
+        )
+        archive.open.assert_called_once_with("dumpState_test.log")

tests/common/test_cli_plugins.py

@@ -1,3 +1,4 @@
+import shlex
 from types import SimpleNamespace
 
 import click
@@ -110,7 +111,7 @@ def test_load_command_option_supports_folders_and_repeated_paths(tmp_path):
 def test_loaded_command_participates_in_shell_completion(tmp_path):
     command_path = _write_command(tmp_path / "hello.py", "hello")
     group = _make_group()
-    words = f"group --load-command {command_path} he"
+    words = f"group --load-command {shlex.quote(str(command_path))} he"
 
     result = CliRunner().invoke(
         group,

tests/common/test_cmd_plugins.py

@@ -1,4 +1,5 @@
 import json
+import re
 from types import SimpleNamespace
 
 import pytest
@@ -54,20 +55,23 @@ def _run(command, arguments):
     return CliRunner().invoke(command, arguments, env={"COLUMNS": "200"})
 
 
-def _table_rows(output):
-    """Return the content of the table rows, without the header and the box."""
+def _table_lines(output):
+    """Return the cells of each line of the table, header first."""
     return [
-        [cell.strip() for cell in line.strip().strip("│").split("│")]
+        [cell.strip() for cell in re.split("[│┃]", line.strip().strip("│┃"))]
         for line in output.splitlines()
-        if "│" in line
+        if "│" in line or "┃" in line
     ]
 
 
+def _table_rows(output):
+    """Return the content of the table rows, without the header and the box."""
+    return _table_lines(output)[1:]
+
+
 def _table_header(output):
-    for line in output.splitlines():
-        if "┃" in line:
-            return [cell.strip() for cell in line.strip().strip("┃").split("┃")]
-    return []
+    lines = _table_lines(output)
+    return lines[0] if lines else []
 
 
 def _install(monkeypatch, distributions, entry_points):

tests/common/test_command.py

@@ -5,14 +5,22 @@
 
 import json
 import logging
-from unittest.mock import patch
+import threading
+import time
+from io import StringIO
 
 import pytest
-from click.testing import CliRunner
+from rich.console import Console
 
 from mvt.common.command import Command
+from mvt.common.config import settings
+from mvt.common.log import MVTLogHandler
+from mvt.common.module import EncryptedBackupError, MVTModule
+from unittest.mock import patch
+
+from click.testing import CliRunner
+
 from mvt.common.indicators import Indicators
-from mvt.common.module import MVTModule
 
 
 class RecordingModule(MVTModule):
@@ -298,6 +306,15 @@ class TestCommand:
         alerts = json.loads((tmp_path / "alerts.json").read_text())
         assert alerts[0]["event"]["payload"] == "\\xa8\\xa9"
 
+    def test_timeline_deduplication_preserves_first_seen_order(self):
+        timeline = [
+            {"timestamp": "same", "event": "first"},
+            {"timestamp": "same", "event": "second"},
+            {"timestamp": "same", "event": "first"},
+        ]
+
+        assert MVTModule._deduplicate_timeline(timeline) == timeline[:2]
+
     def test_stores_collected_urls(self, tmp_path):
         cmd = RecordingCommand(results_path=str(tmp_path))
         cmd.modules = [URLRecordingModule]
@@ -314,7 +331,7 @@ class TestCommand:
         ]
 
     def test_modules_run_in_stable_topological_order(self):
-        cmd = RecordingCommand()
+        cmd = RecordingCommand(jobs=1)
         cmd.modules = [ThirdModule, IndependentModule, SecondModule, FirstModule]
 
         cmd.run()
@@ -329,7 +346,7 @@ class TestCommand:
         assert second.results == ["first", "second"]
 
     def test_selected_module_runs_transitive_dependencies(self):
-        cmd = RecordingCommand(module_name="ThirdModule")
+        cmd = RecordingCommand(module_name="ThirdModule", jobs=1)
         cmd.modules = [ThirdModule, SecondModule, FirstModule, IndependentModule]
 
         cmd.run()
@@ -340,6 +357,38 @@ class TestCommand:
             "ThirdModule",
         ]
 
+    @pytest.mark.parametrize("jobs", [1, 2])
+    @pytest.mark.parametrize("parallel_safe", [False, True])
+    def test_initialization_hook_sees_completed_dependencies(self, jobs, parallel_safe):
+        class Prerequisite(FirstModule):
+            pass
+
+        Prerequisite.parallel_safe = parallel_safe
+
+        class Dependent(SecondModule):
+            dependencies = (Prerequisite,)
+
+            def run(self):
+                self.results = self.get_dependency_results(Prerequisite) + ["second"]
+
+        class HookCommand(RecordingCommand):
+            def module_init(self, module):
+                if isinstance(module, Dependent):
+                    self.seen = [
+                        executed.results
+                        for executed in self.executed
+                        if isinstance(executed, Prerequisite)
+                    ]
+
+        cmd = HookCommand(jobs=jobs)
+        cmd.modules = [Dependent, Prerequisite]
+
+        cmd.run()
+
+        assert cmd.seen == [["first"]]
+        assert [type(module) for module in cmd.executed] == [Prerequisite, Dependent]
+        assert cmd.executed[1].results == ["first", "second"]
+
     def test_circular_dependency_warns_and_stops(self, caplog):
         class CircularOne(RecordingModule):
             pass
@@ -372,7 +421,10 @@ class TestCommand:
         with caplog.at_level(logging.WARNING):
             cmd.run()
 
-        assert RecordingModule.run_order == ["IndependentModule", "FirstModule"]
+        assert [type(module).__name__ for module in cmd.executed] == [
+            "IndependentModule",
+            "FirstModule",
+        ]
         assert cmd.initialized
         assert "Module DependentModule will be SKIPPED" in caplog.text
         assert "depends on module UnavailableModule" in caplog.text
@@ -476,7 +528,7 @@ class TestCommand:
         ]
 
     def test_selected_custom_module_runs(self):
-        cmd = RecordingCommand(module_name="CustomIOSBackupModule")
+        cmd = RecordingCommand(module_name="CustomIOSBackupModule", jobs=1)
         cmd.platform = "ios"
         cmd.name = "check-backup"
         cmd.custom_modules = [CustomIOSBackupModule]
@@ -496,7 +548,7 @@ class TestCommand:
         assert RecordingModule.run_order == []
 
     def test_custom_module_dependencies_use_topological_order(self):
-        cmd = RecordingCommand(module_name="CustomDependsOnBuiltin")
+        cmd = RecordingCommand(module_name="CustomDependsOnBuiltin", jobs=1)
         cmd.platform = "ios"
         cmd.name = "check-backup"
         cmd.modules = [SecondModule, FirstModule]
@@ -506,6 +558,228 @@ class TestCommand:
 
         assert RecordingModule.run_order == ["FirstModule", "CustomDependsOnBuiltin"]
 
+    def test_parallel_modules_overlap_and_respect_worker_limit(self):
+        lock = threading.Lock()
+        barrier = threading.Barrier(2)
+        active = 0
+        maximum = 0
+        overlapped = []
+
+        class ParallelModule(RecordingModule):
+            def run(self):
+                nonlocal active, maximum
+                with lock:
+                    active += 1
+                    maximum = max(maximum, active)
+                try:
+                    barrier.wait(timeout=2)
+                    overlapped.append(self.__class__.__name__)
+                    time.sleep(0.02)
+                finally:
+                    with lock:
+                        active -= 1
+
+        class ParallelOne(ParallelModule):
+            pass
+
+        class ParallelTwo(ParallelModule):
+            pass
+
+        class ParallelThree(ParallelModule):
+            pass
+
+        cmd = RecordingCommand(jobs=2)
+        cmd.modules = [ParallelOne, ParallelTwo, ParallelThree]
+        cmd.run()
+
+        assert maximum == 2
+        assert {"ParallelOne", "ParallelTwo"}.issubset(overlapped)
+
+    def test_dependencies_wait_and_transitive_dependencies_run_once(self):
+        prerequisite_finished = threading.Event()
+        runs = []
+
+        class Prerequisite(RecordingModule):
+            def run(self):
+                runs.append("prerequisite")
+                self.results = ["ready"]
+                prerequisite_finished.set()
+
+        class Dependent(RecordingModule):
+            dependencies = (Prerequisite,)
+
+            def run(self):
+                assert prerequisite_finished.is_set()
+                assert self.get_dependency_results(Prerequisite) == ["ready"]
+                runs.append(self.__class__.__name__)
+
+        class DependentOne(Dependent):
+            pass
+
+        class DependentTwo(Dependent):
+            pass
+
+        cmd = RecordingCommand(jobs=3)
+        cmd.modules = [DependentOne, DependentTwo, Prerequisite]
+        cmd.run()
+
+        assert runs.count("prerequisite") == 1
+        assert set(runs[1:]) == {"DependentOne", "DependentTwo"}
+
+    def test_parallel_unsafe_module_runs_exclusively(self):
+        lock = threading.Lock()
+        active = 0
+        unsafe_ran_exclusively = []
+
+        class SafeOne(RecordingModule):
+            def run(self):
+                nonlocal active
+                with lock:
+                    active += 1
+                time.sleep(0.03)
+                with lock:
+                    active -= 1
+
+        class Unsafe(RecordingModule):
+            parallel_safe = False
+
+            def run(self):
+                nonlocal active
+                with lock:
+                    unsafe_ran_exclusively.append(active == 0)
+                    active += 1
+                time.sleep(0.01)
+                with lock:
+                    active -= 1
+
+        class SafeTwo(SafeOne):
+            pass
+
+        cmd = RecordingCommand(jobs=3)
+        cmd.modules = [SafeOne, Unsafe, SafeTwo]
+        cmd.run()
+
+        assert unsafe_ran_exclusively == [True]
+
+    def test_results_are_aggregated_in_topological_order(self):
+        release_first = threading.Event()
+
+        class SlowFirst(RecordingModule):
+            def run(self):
+                release_first.wait(timeout=2)
+                self.results = ["first"]
+                self.timeline = [{"module": "first"}]
+                self.alertstore.info("first", "", {"order": 1})
+
+        class FastSecond(RecordingModule):
+            def run(self):
+                self.results = ["second"]
+                self.timeline = [{"module": "second"}]
+                self.alertstore.info("second", "", {"order": 2})
+                release_first.set()
+
+        cmd = RecordingCommand(jobs=2)
+        cmd.modules = [SlowFirst, FastSecond]
+        cmd.run()
+
+        assert [type(module) for module in cmd.executed] == [SlowFirst, FastSecond]
+        assert [entry["module"] for entry in cmd.timeline] == ["first", "second"]
+        assert [alert.message for alert in cmd.alertstore.alerts] == ["first", "second"]
+
+    def test_parallel_console_logs_are_grouped_and_file_log_is_complete(
+        self, tmp_path
+    ):
+        output = StringIO()
+        handler = MVTLogHandler(
+            console=Console(file=output, force_terminal=False, color_system=None)
+        )
+        handler.setFormatter(logging.Formatter("%(message)s"))
+        logger = logging.getLogger("mvt")
+        logger.setLevel(logging.DEBUG)
+        logger.addHandler(handler)
+        release_slow = threading.Event()
+
+        class SlowLog(RecordingModule):
+            def run(self):
+                self.log.info("slow-a")
+                release_slow.wait(timeout=2)
+                self.log.info("slow-b")
+
+        class FastLog(RecordingModule):
+            def run(self):
+                self.log.info("fast-a")
+                self.log.info("fast-b")
+                release_slow.set()
+
+        SlowLog.__module__ = "mvt.tests.parallel"
+        FastLog.__module__ = "mvt.tests.parallel"
+        try:
+            cmd = RecordingCommand(results_path=str(tmp_path), jobs=2)
+            cmd.modules = [SlowLog, FastLog]
+            cmd.run()
+        finally:
+            logger.removeHandler(handler)
+
+        console_output = output.getvalue()
+        fast_block = (
+            console_output.index("--- FastLog ---"),
+            console_output.index("fast-a"),
+            console_output.index("fast-b"),
+        )
+        slow_block = (
+            console_output.index("--- SlowLog ---"),
+            console_output.index("slow-a"),
+            console_output.index("slow-b"),
+        )
+        assert fast_block == tuple(sorted(fast_block))
+        assert slow_block == tuple(sorted(slow_block))
+        assert fast_block[-1] < slow_block[0] or slow_block[-1] < fast_block[0]
+        file_output = (tmp_path / "command.log").read_text()
+        for message in ("slow-a", "slow-b", "fast-a", "fast-b"):
+            assert message in file_output
+
+    def test_encrypted_backup_stops_scheduling_and_cleans_up(self, caplog):
+        finish_called = []
+
+        class Encrypted(RecordingModule):
+            def run(self):
+                raise EncryptedBackupError
+
+        class NeverScheduled(RecordingModule):
+            dependencies = (Encrypted,)
+
+        class CleanupCommand(RecordingCommand):
+            def finish(self):
+                finish_called.append(True)
+
+        cmd = CleanupCommand(jobs=2)
+        cmd.modules = [Encrypted, NeverScheduled]
+        with caplog.at_level(logging.CRITICAL):
+            cmd.run()
+
+        assert finish_called == [True]
+        assert not any(isinstance(module, NeverScheduled) for module in cmd.executed)
+        assert "backup appears to be encrypted" in caplog.text
+
+    def test_profiling_forces_sequential_execution(self, monkeypatch, caplog):
+        run_order = []
+
+        class ProfileOne(RecordingModule):
+            def run(self):
+                run_order.append("one")
+
+        class ProfileTwo(RecordingModule):
+            def run(self):
+                run_order.append("two")
+
+        monkeypatch.setattr(settings, "PROFILE", True)
+        cmd = RecordingCommand(jobs=4)
+        cmd.modules = [ProfileOne, ProfileTwo]
+        with caplog.at_level(logging.WARNING):
+            cmd.run()
+
+        assert run_order == ["one", "two"]
+        assert "forcing sequential module execution" in caplog.text
     def test_custom_module_replaces_builtin(self, caplog):
         cmd = RecordingCommand()
         cmd.platform = "ios"
@@ -516,7 +790,10 @@ class TestCommand:
         with caplog.at_level(logging.INFO):
             cmd.run()
 
-        assert RecordingModule.run_order == ["IndependentModule", "ReplacementModule"]
+        assert [type(module).__name__ for module in cmd.executed] == [
+            "IndependentModule",
+            "ReplacementModule",
+        ]
         assert cmd.module_replacements == {FirstModule: ReplacementModule}
         assert (
             "Module ReplacementModule from" in caplog.text
@@ -532,7 +809,10 @@ class TestCommand:
 
         cmd.run()
 
-        assert RecordingModule.run_order == ["FirstModule", "CustomIOSBackupModule"]
+        assert [type(module).__name__ for module in cmd.executed] == [
+            "FirstModule",
+            "CustomIOSBackupModule",
+        ]
         assert cmd.module_replacements == {}
 
     def test_unavailable_replaced_module_is_ignored(self, caplog):
@@ -545,7 +825,10 @@ class TestCommand:
         with caplog.at_level(logging.INFO):
             cmd.run()
 
-        assert RecordingModule.run_order == ["IndependentModule", "ReplacementModule"]
+        assert [type(module).__name__ for module in cmd.executed] == [
+            "IndependentModule",
+            "ReplacementModule",
+        ]
         assert cmd.module_replacements == {}
         assert "replaces module FirstModule" not in caplog.text
 
@@ -663,7 +946,7 @@ class TestCommand:
         with caplog.at_level(logging.WARNING):
             cmd.run()
 
-        assert RecordingModule.run_order == [
+        assert [type(module).__name__ for module in cmd.executed] == [
             "ReplacementModule",
             "OtherReplacementModule",
         ]
@@ -722,8 +1005,9 @@ class TestCommand:
         assert cmd.module_replacements == {}
         assert logged_substitutions(caplog) == []
 
-    def test_modules_replacing_each_other_all_run(self, caplog):
-        cmd = RecordingCommand()
+    @pytest.mark.parametrize("jobs", [1, 4])
+    def test_modules_replacing_each_other_all_run(self, caplog, jobs):
+        cmd = RecordingCommand(jobs=jobs)
         cmd.platform = "ios"
         cmd.name = "check-backup"
         cmd.custom_modules = [MutualReplacementOne, MutualReplacementTwo]
@@ -731,7 +1015,7 @@ class TestCommand:
         with caplog.at_level(logging.INFO):
             cmd.run()
 
-        assert RecordingModule.run_order == [
+        assert [type(module).__name__ for module in cmd.executed] == [
             "MutualReplacementOne",
             "MutualReplacementTwo",
         ]
@@ -742,8 +1026,9 @@ class TestCommand:
         )
         assert logged_substitutions(caplog) == []
 
-    def test_replacement_cycle_of_three_modules_all_run(self, caplog):
-        cmd = RecordingCommand()
+    @pytest.mark.parametrize("jobs", [1, 4])
+    def test_replacement_cycle_of_three_modules_all_run(self, caplog, jobs):
+        cmd = RecordingCommand(jobs=jobs)
         cmd.platform = "ios"
         cmd.name = "check-backup"
         cmd.custom_modules = [CycleOneModule, CycleTwoModule, CycleThreeModule]
@@ -751,7 +1036,7 @@ class TestCommand:
         with caplog.at_level(logging.INFO):
             cmd.run()
 
-        assert RecordingModule.run_order == [
+        assert [type(module).__name__ for module in cmd.executed] == [
             "CycleOneModule",
             "CycleTwoModule",
             "CycleThreeModule",
@@ -834,7 +1119,7 @@ class TestCommand:
         with caplog.at_level(logging.WARNING):
             cmd.run()
 
-        assert RecordingModule.run_order == [
+        assert [type(module).__name__ for module in cmd.executed] == [
             "SharedSlugModule",
             "OtherSharedSlugModule",
         ]

tests/common/test_indicators.py

@@ -311,3 +311,31 @@ class TestIndicators:
         ind = Indicators(log=logging)
         ind.load_indicators_files([], load_default=False)
         assert ind.total_ioc_count == 9
+
+    def test_check_url_matches_w_prefixed_subdomain(self, tmp_path):
+        import json
+
+        stix_file = tmp_path / "w-domain.stix2"
+        stix_file.write_text(
+            json.dumps(
+                {
+                    "objects": [
+                        {
+                            "type": "indicator",
+                            "pattern": "[domain-name:value = 'web.evil.com']",
+                        }
+                    ]
+                }
+            ),
+            encoding="utf-8",
+        )
+        ind = Indicators(log=logging)
+        ind.load_indicators_files([str(stix_file)], load_default=False)
+
+        for url in (
+            "https://web.evil.com/path",
+            "https://www.web.evil.com/path",
+        ):
+            match = ind.check_url(url)
+            assert match is not None
+            assert match.ioc.value == "web.evil.com"

tests/common/test_url.py

@@ -22,3 +22,23 @@ def test_google_maps_url_is_not_shortened(url):
 
 def test_other_google_short_url_is_shortened():
     assert URL("https://goo.gl/example").check_if_shortened() is True
+
+
+@pytest.mark.parametrize(
+    "url, domain",
+    [
+        ("https://www.example.com/path", "example.com"),
+        # Only the whole "www." prefix comes off, not any leading "w" or "." character.
+        ("https://web.example.com", "web.example.com"),
+        ("https://wow.com", "wow.com"),
+        ("https://wired.com", "wired.com"),
+        ("https://www.wow.com", "wow.com"),
+    ],
+)
+def test_get_domain_strips_only_a_whole_www_prefix(url, domain):
+    assert URL(url).domain == domain
+
+
+def test_shortener_starting_with_w_is_detected():
+    assert URL("https://w3t.org/example").check_if_shortened() is True
+    assert URL("https://www.w3t.org/example").check_if_shortened() is True

tests/ios_backup/test_decrypt.py

@@ -7,6 +7,7 @@ import logging
 import threading
 from pathlib import Path
 
+import pytest
 from Crypto.Cipher import AES
 
 from mvt.ios.decrypt import DecryptBackup, MVTEncryptedBackup
@@ -81,7 +82,10 @@ def test_extract_file_by_id_copies_unencrypted_files(mocker, tmp_path):
     assert output_path.read_bytes() == b"plain content"
 
 
-def test_process_backup_rejects_unsafe_file_ids_and_destinations(mocker, tmp_path):
+@pytest.mark.parametrize("with_symlink", [False, True], ids=["file-id", "symlink"])
+def test_process_backup_rejects_unsafe_file_ids_and_destinations(
+    mocker, tmp_path, with_symlink
+):
     backup_path = tmp_path / "backup"
     destination = tmp_path / "destination"
     outside = tmp_path / "outside"
@@ -92,20 +96,27 @@ def test_process_backup_rejects_unsafe_file_ids_and_destinations(mocker, tmp_pat
     safe_file_id = "ef" + "3" * 38
     unsafe_file_id = "../../outside-file"
     symlink_file_id = "ab" + "4" * 38
-    for file_id in (safe_file_id, symlink_file_id):
+    file_ids = [safe_file_id]
+    if with_symlink:
+        file_ids.append(symlink_file_id)
+    for file_id in file_ids:
         source_path = backup_path / file_id[:2] / file_id
         source_path.parent.mkdir(parents=True, exist_ok=True)
         source_path.write_bytes(b"encrypted")
-    (destination / "ab").symlink_to(outside, target_is_directory=True)
+    if with_symlink:
+        try:
+            (destination / "ab").symlink_to(outside, target_is_directory=True)
+        except OSError:
+            pytest.skip("creating symbolic links is not permitted on this system")
 
     cursor = mocker.MagicMock()
-    cursor.__iter__.return_value = iter(
-        [
-            (safe_file_id, "Domain", "safe", b"plist"),
-            (unsafe_file_id, "Domain", "unsafe", b"plist"),
-            (symlink_file_id, "Domain", "symlink", b"plist"),
-        ]
-    )
+    records = [
+        (safe_file_id, "Domain", "safe", b"plist"),
+        (unsafe_file_id, "Domain", "unsafe", b"plist"),
+    ]
+    if with_symlink:
+        records.append((symlink_file_id, "Domain", "symlink", b"plist"))
+    cursor.__iter__.return_value = iter(records)
     cursor_context = mocker.MagicMock()
     cursor_context.__enter__.return_value = cursor
 
@@ -124,7 +135,8 @@ def test_process_backup_rejects_unsafe_file_ids_and_destinations(mocker, tmp_pat
     decryptor.process_backup()
 
     assert (destination / safe_file_id[:2] / safe_file_id).read_bytes() == b"decrypted"
-    assert not (outside / symlink_file_id).exists()
+    if with_symlink:
+        assert not (outside / symlink_file_id).exists()
     backup.extract_file_by_id.assert_called_once()
     assert backup.extract_file_by_id.call_args.kwargs["file_id"] == safe_file_id
 

tests/ios_backup/test_manifest.py

@@ -5,7 +5,12 @@
 
 import gc
 import logging
+import os
+import shutil
 import warnings
+from pathlib import Path
+
+import pytest
 
 from mvt.common.indicators import Indicators
 from mvt.common.module import run_module
@@ -14,8 +19,58 @@ from mvt.ios.modules.backup.manifest import Manifest
 
 from ..utils import get_ios_backup_folder
 
+# fileID of HomeDomain::Library/SMS/sms.db in the test backup. It is one of the
+# few files the test backup actually stores.
+SMS_FILE_ID = "3d0d7e5fb2ce288813306e4d4636395e047a3d28"
+
+
+@pytest.fixture
+def backup_without_stored_files(tmp_path):
+    """A copy of the test backup with every stored file removed.
+
+    The test backup only ships a handful of the files its manifest lists, so
+    dropping what it does store leaves a backup where every regular file the
+    manifest mentions is missing from the folder.
+    """
+    backup_path = tmp_path / "backup"
+    shutil.copytree(get_ios_backup_folder(), backup_path)
+
+    for file_id_folder in backup_path.iterdir():
+        if not file_id_folder.is_dir():
+            continue
+        for backup_file in file_id_folder.iterdir():
+            backup_file.unlink()
+
+    return str(backup_path)
+
 
 class TestIOSExtraction:
+    @pytest.mark.parametrize("link_directory", [False, True], ids=["file", "directory"])
+    @pytest.mark.parametrize("inside_backup", [False, True], ids=["outside", "inside"])
+    def test_stored_file_inventory_matches_symlink_resolution(
+        self, tmp_path, link_directory, inside_backup
+    ):
+        backup_path = tmp_path / "backup"
+        backup_path.mkdir()
+        destination = (backup_path if inside_backup else tmp_path) / "contents"
+        destination.mkdir()
+        (destination / SMS_FILE_ID).write_bytes(b"backup file")
+        bucket = backup_path / SMS_FILE_ID[:2]
+        try:
+            if link_directory:
+                bucket.symlink_to(destination, target_is_directory=True)
+            else:
+                bucket.mkdir()
+                (bucket / SMS_FILE_ID).symlink_to(destination / SMS_FILE_ID)
+        except OSError:
+            pytest.skip("creating symbolic links is not permitted on this system")
+
+        m = IOSExtraction(target_path=str(backup_path))
+        assert bool(m._get_backup_file_from_id(SMS_FILE_ID)) is inside_backup
+        assert m._get_stored_backup_file_ids() == (
+            {SMS_FILE_ID} if inside_backup else set()
+        )
+
     def test_get_backup_files_from_manifest_closes_connection(self):
         m = IOSExtraction(target_path=get_ios_backup_folder())
 
@@ -41,6 +96,103 @@ class TestManifestModule:
         assert len(m.timeline) == 5881
         assert len(m.alertstore.alerts) == 0
 
+    def test_manifest_flags_the_files_missing_from_an_incomplete_backup(self):
+        m = Manifest(target_path=get_ios_backup_folder())
+        run_module(m)
+
+        missing = [result for result in m.results if result.get("missing")]
+        # The test backup only stores a handful of the files its manifest
+        # lists, and every one of the rest is a regular file (flags 1).
+        assert len(missing) == 1079
+        assert all(result["flags"] == 1 for result in missing)
+
+        stored = [result for result in m.results if result["file_id"] == SMS_FILE_ID]
+        assert len(stored) == 1
+        assert "missing" not in stored[0]
+
+    def test_manifest_flags_every_stored_file_removed_from_the_backup_folder(
+        self, backup_without_stored_files
+    ):
+        m = Manifest(target_path=backup_without_stored_files)
+        run_module(m)
+
+        missing = [result for result in m.results if result.get("missing")]
+        assert len(missing) == 1089
+
+    def test_manifest_flags_a_file_removed_from_the_backup_folder(self, tmp_path):
+        backup_path = tmp_path / "backup"
+        shutil.copytree(get_ios_backup_folder(), backup_path)
+        (backup_path / SMS_FILE_ID[:2] / SMS_FILE_ID).unlink()
+
+        m = Manifest(target_path=str(backup_path))
+        run_module(m)
+
+        removed = [result for result in m.results if result["file_id"] == SMS_FILE_ID]
+        assert len(removed) == 1
+        assert removed[0]["missing"] is True
+
+    @pytest.mark.parametrize("failed_folder", ["", "3d"], ids=["root", "bucket"])
+    def test_manifest_skips_missing_check_when_inventory_fails(
+        self, monkeypatch, caplog, failed_folder
+    ):
+        backup_path = Path(get_ios_backup_folder())
+        failed_path = backup_path / failed_folder
+        scandir = os.scandir
+
+        def fail_listing(path):
+            if Path(path) == failed_path:
+                raise PermissionError("cannot list backup folder")
+            return scandir(path)
+
+        monkeypatch.setattr(os, "scandir", fail_listing)
+        m = Manifest(target_path=str(backup_path))
+        with caplog.at_level(logging.INFO):
+            m.run()
+
+        assert len(m.results) == 3721
+        assert m._get_backup_file_from_id(SMS_FILE_ID) is not None
+        assert all("missing" not in result for result in m.results)
+        assert "Skipping the missing-file check" in caplog.text
+        assert "The backup might be incomplete" not in caplog.text
+
+    def test_manifest_ignores_unreadable_unrelated_folders(self, tmp_path, monkeypatch):
+        backup_path = tmp_path / "backup"
+        shutil.copytree(get_ios_backup_folder(), backup_path)
+        unrelated = backup_path / "notes"
+        unrelated.mkdir()
+        scandir = os.scandir
+
+        def fail_listing(path):
+            if Path(path) == unrelated:
+                raise PermissionError("cannot list unrelated folder")
+            return scandir(path)
+
+        monkeypatch.setattr(os, "scandir", fail_listing)
+        m = Manifest(target_path=str(backup_path))
+        m.run()
+
+        assert sum(bool(result.get("missing")) for result in m.results) == 1079
+        stored = next(
+            result for result in m.results if result["file_id"] == SMS_FILE_ID
+        )
+        assert "missing" not in stored
+
+    @pytest.mark.parametrize("wrong_folder", ["ab", "notes"])
+    def test_manifest_flags_files_in_the_wrong_folder(self, tmp_path, wrong_folder):
+        backup_path = tmp_path / "backup"
+        shutil.copytree(get_ios_backup_folder(), backup_path)
+        destination = backup_path / wrong_folder
+        destination.mkdir(exist_ok=True)
+        (backup_path / SMS_FILE_ID[:2] / SMS_FILE_ID).rename(destination / SMS_FILE_ID)
+
+        m = Manifest(target_path=str(backup_path))
+        m.run()
+
+        assert m._get_backup_file_from_id(SMS_FILE_ID) is None
+        moved = next(result for result in m.results if result["file_id"] == SMS_FILE_ID)
+        assert moved["missing"] is True
+        assert sum(bool(result.get("missing")) for result in m.results) == 1080
+
     def test_detection(self, indicator_file):
         m = Manifest(target_path=get_ios_backup_folder())
         ind = Indicators(log=logging.getLogger())

tests/ios_backup/test_sqlite_handling.py

@@ -9,6 +9,8 @@ import plistlib
 import shutil
 import sqlite3
 
+import pytest
+
 from mvt.ios.modules.base import IOSExtraction
 from mvt.ios.modules.fs.analytics import Analytics
 
@@ -45,6 +47,9 @@ def test_open_sqlite_reads_wal_without_modifying_evidence(tmp_path):
     assert not os.path.exists(str(evidence_path) + "-shm")
 
 
+@pytest.mark.skipif(
+    shutil.which("sqlite3") is None, reason="the recovery needs the sqlite3 binary"
+)
 def test_recovery_preserves_source_database(tmp_path):
     database_path = tmp_path / "source.db"
     conn = sqlite3.connect(database_path)

tests/ios_fs/test_filesystem.py

@@ -3,15 +3,45 @@
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 import logging
+import ntpath
+from types import SimpleNamespace
 
 from mvt.common.indicators import Indicators
 from mvt.common.module import run_module
+from mvt.ios.modules.fs import filesystem
 from mvt.ios.modules.fs.filesystem import Filesystem
 
 from ..utils import get_ios_backup_folder
 
 
 class TestFilesystem:
+    def test_windows_paths_are_normalized_for_indicators(
+        self, monkeypatch, indicators_factory
+    ):
+        m = Filesystem(target_path=r"C:\dump")
+        m.indicators = indicators_factory(
+            file_paths=["matched/directory"], processes=["matched"]
+        )
+        monkeypatch.setattr(
+            filesystem,
+            "os",
+            SimpleNamespace(
+                sep="\\",
+                path=ntpath,
+                walk=lambda _: [(r"C:\dump\matched", ["directory"], ["file.txt"])],
+                stat=lambda _: SimpleNamespace(st_mtime=0),
+            ),
+        )
+
+        m.run()
+        m.check_indicators()
+
+        assert {result["path"] for result in m.results} == {
+            "matched/directory",
+            "matched/file.txt",
+        }
+        assert len(m.alertstore.alerts) == 3
+
     def test_filesystem(self):
         m = Filesystem(target_path=get_ios_backup_folder())
         run_module(m)

tests/test_check_android_androidqf.py

@@ -85,7 +85,7 @@ class TestCheckAndroidqfCommand:
     def test_acquisition_context_falls_back_to_public_key_file(self, tmp_path):
         data_path = tmp_path / "androidqf"
         data_path.mkdir()
-        (data_path / "adb_host_key.pub").write_text("QUJDRA== acquisition@host\n")
+        (data_path / "adb_host_key.pub").write_bytes(b"QUJDRA== acquisition@host\n")
         command = CmdAndroidCheckAndroidQF(target_path=str(data_path))
 
         command.init()

tests/test_check_ios_backup.py

@@ -41,3 +41,11 @@ class TestCheckBackupCommand:
         result = runner.invoke(check_backup, [str(tmp_path)])
         assert result.exit_code == 1
         assert "does not appear to be an iTunes backup folder" in caplog.text
+
+    def test_check_rejects_non_positive_jobs(self):
+        result = CliRunner().invoke(
+            check_backup, ["--jobs", "0", get_ios_backup_folder()]
+        )
+
+        assert result.exit_code == 2
+        assert "Invalid value for '--jobs'" in result.output

tests/test_cmd_check_sysdiagnose.py

@@ -116,7 +116,7 @@ def test_archive_is_extracted_once_and_unsafe_members_are_skipped(tmp_path):
         module = SysdiagnoseExtraction()
         command.module_init(module)
         assert module.tar is None
-        assert module.parent_path == str(extracted_path.parent)
+        assert Path(module.parent_path) == extracted_path.parent
     finally:
         command.finish()
 

tests/test_completion.py

@@ -43,6 +43,7 @@ class TestCompletionCommand:
 
     def test_completion_install_updates_bashrc_once(self, tmp_path, monkeypatch):
         monkeypatch.setenv("HOME", str(tmp_path))
+        monkeypatch.setenv("USERPROFILE", str(tmp_path))
         runner = CliRunner()
 
         result = runner.invoke(mvt_cli, ["completion", "bash", "--install"])
@@ -67,6 +68,7 @@ class TestCompletionCommand:
         self, tmp_path, monkeypatch
     ):
         monkeypatch.setenv("HOME", str(tmp_path))
+        monkeypatch.setenv("USERPROFILE", str(tmp_path))
         runner = CliRunner()
 
         result = runner.invoke(mvt_cli, ["completion", "fish", "--install"])

tests/test_custom_modules.py

@@ -288,15 +288,19 @@ def test_androidqf_propagates_custom_modules_to_nested_commands(tmp_path, monkey
     cmd = CmdAndroidCheckAndroidQF(
         target_path=str(tmp_path),
         custom_modules=custom_modules,
+        jobs=7,
     )
 
     def record_available(name):
         def _record(command):
-            records[name] = [
-                module.__name__
-                for module in command._available_modules()
-                if module.__name__.startswith("Nested")
-            ]
+            records[name] = {
+                "jobs": command.jobs,
+                "modules": [
+                    module.__name__
+                    for module in command._available_modules()
+                    if module.__name__.startswith("Nested")
+                ],
+            }
 
         return _record
 
@@ -339,7 +343,7 @@ def test_androidqf_propagates_custom_modules_to_nested_commands(tmp_path, monkey
     assert cmd.run_backup_cmd()
     assert cmd.run_intrusion_logs_cmd()
     assert records == {
-        "bugreport": ["NestedBugreportModule"],
-        "backup": ["NestedBackupModule"],
-        "intrusion_logs": ["NestedIntrusionLogsModule"],
+        "bugreport": {"jobs": 7, "modules": ["NestedBugreportModule"]},
+        "backup": {"jobs": 7, "modules": ["NestedBackupModule"]},
+        "intrusion_logs": {"jobs": 7, "modules": ["NestedIntrusionLogsModule"]},
     }