Drop Python 3.10 support (#976)

Ask for the backup password again when it is wrong

.github/workflows/mypy.yml

@@ -15,7 +15,7 @@ jobs:
       - name: Setup Python
         uses: actions/setup-python@v7
         with:
-          python-version: "3.10"
+          python-version: "3.11"
       - name: Install uv
         uses: astral-sh/setup-uv@v10.0.0
         with:

.github/workflows/ruff.yml

@@ -16,7 +16,7 @@ jobs:
       - name: Setup Python
         uses: actions/setup-python@v7
         with:
-          python-version: "3.10"
+          python-version: "3.11"
       - name: Install uv
         uses: astral-sh/setup-uv@v10.0.0
         with:

.github/workflows/tests.yml

@@ -16,10 +16,10 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        python-version: ['3.10', '3.11', '3.12', '3.13', '3.14']
+        python-version: ['3.11', '3.12', '3.13', '3.14', '3.15']
     env:
       # Takes precedence over .python-version, which otherwise makes `uv run`
-      # rebuild the venv with 3.10 and test every matrix entry on 3.10.
+      # rebuild the venv with 3.11 and test every matrix entry on 3.11.
       UV_PYTHON: ${{ matrix.python-version }}
 
     steps:

.python-version

@@ -1 +1 @@
-3.10
+3.11

Dockerfile

@@ -1,6 +1,6 @@
 # Create main image
 FROM ubuntu:24.04 AS main
-COPY --from=ghcr.io/astral-sh/uv:0.11.8 /uv /uvx /usr/local/bin/
+COPY --from=ghcr.io/astral-sh/uv:0.13.5 /uv /uvx /usr/local/bin/
 
 LABEL org.opencontainers.image.url="https://mvt.re"
 LABEL org.opencontainers.image.documentation="https://docs.mvt.re"
@@ -62,4 +62,4 @@ WORKDIR /home/cases
 RUN echo 'echo "Mobile Verification Toolkit @ Docker\n------------------------------------\n\nYou can find information about how to use this image for Android (https://github.com/mvt-project/mvt/tree/master/docs/android) and iOS (https://github.com/mvt-project/mvt/tree/master/docs/ios) in the official docs of the project.\n"' >> ~/.bashrc \
   && echo 'echo "Note that to perform the debug via USB you might need to give the Docker image access to the USB using \"docker run -it --privileged -v /dev/bus/usb:/dev/bus/usb mvt\" or, preferably, the \"--device=\" parameter.\n"' >> ~/.bashrc
 
-CMD /bin/bash
+CMD [ "/bin/bash" ]

Dockerfile.android

@@ -1,6 +1,6 @@
 # Create main image
-FROM python:3.10.14-alpine3.20 AS main
-COPY --from=ghcr.io/astral-sh/uv:0.11.8 /uv /uvx /usr/local/bin/
+FROM python:3.11.17-alpine3.23 AS main
+COPY --from=ghcr.io/astral-sh/uv:0.13.5 /uv /uvx /usr/local/bin/
 
 LABEL org.opencontainers.image.url="https://mvt.re"
 LABEL org.opencontainers.image.documentation="https://docs.mvt.re"
@@ -8,7 +8,7 @@ LABEL org.opencontainers.image.source="https://github.com/mvt-project/mvt"
 LABEL org.opencontainers.image.title="Mobile Verification Toolkit (Android)"
 LABEL org.opencontainers.image.description="MVT is a forensic tool to look for signs of infection in smartphone devices."
 LABEL org.opencontainers.image.licenses="MVT License 1.1"
-LABEL org.opencontainers.image.base.name=docker.io/library/python:3.10.14-alpine3.20
+LABEL org.opencontainers.image.base.name=docker.io/library/python:3.11.17-alpine3.23
 
 # Install runtime dependencies
 RUN apk add --no-cache \

Dockerfile.ios

@@ -1,7 +1,7 @@
 # Main image
 # ----------
 FROM ubuntu:24.04 AS main
-COPY --from=ghcr.io/astral-sh/uv:0.11.8 /uv /uvx /usr/local/bin/
+COPY --from=ghcr.io/astral-sh/uv:0.13.5 /uv /uvx /usr/local/bin/
 
 LABEL org.opencontainers.image.url="https://mvt.re"
 LABEL org.opencontainers.image.documentation="https://docs.mvt.re"

Makefile

@@ -31,3 +31,4 @@ clean:
 
 dist:
 	$(UV) build
+

docs/android/methodology.md

@@ -62,27 +62,6 @@ AndroidQF will prompt the user to download, decrypt and collect device intrusion
 
 For cases where intrusion logs were collected outside of an AndroidQF acquisition, the standalone `mvt-android check-intrusion-logs` command can analyse them directly. See [Check Android Intrusion Logs](intrusion_logs.md) for details, and the [feature announcment from Amnesty International's Security Lab](https://securitylab.amnesty.org/latest/2026/05/android-intrusion-logging-as-a-new-source-of-data-for-consensual-forensic-analysis/) for background on the data source.
 
-## Browser history
-
-AndroidQF can optionally collect browser `History` databases when a device
-already has working root access. When its acquisition contains the
-`browser_history/manifest.json` file, `mvt-android check-androidqf` parses every
-listed database, including any collected SQLite WAL and SHM sidecars. Browser
-visits are added to the module results, timeline, URL output, and indicator
-checks.
-
-MVT can also inspect the supported database locations in a full Android
-filesystem dump, or inspect one explicitly supplied Chromium `History` file:
-
-```bash
-mvt-android check-fs --output /path/to/results /path/to/filesystem-dump
-mvt-android check-fs --output /path/to/results /path/to/History
-```
-
-The built-in locations cover Chrome, Brave, Microsoft Edge, and Samsung
-Internet. Other Chromium-compatible databases can be supplied explicitly as a
-file without assigning an unverified browser identity.
-
 ## Android Debug Bridge analysis removed
 
 The ability to analyze Android devices directly over ADB has been removed from MVT. Direct extraction of data from ADB was error-prone and frequently resulted in inconsistent data collection between ADB and AndroidQF acquisitions. Use AndroidQF for device acquisition and `mvt-android check-androidqf` for analysis.

docs/install.md

@@ -1,6 +1,6 @@
 # Installation
 
-Before proceeding, please note that MVT requires Python 3.10 or newer to run. While it should be available on most operating systems, please make sure of that before proceeding.
+Before proceeding, please note that MVT requires Python 3.11 or newer to run. While it should be available on most operating systems, please make sure of that before proceeding.
 
 ## Dependencies on Linux
 

mkdocs.yml

@@ -18,8 +18,28 @@ markdown_extensions:
         use_pygments: true
 theme:
     name: material
+    logo: mvt.png
+    favicon: favicon.png
     features:
         - tabs
+    palette:
+    - media: "(prefers-color-scheme)"
+      primary: black
+      toggle:
+        icon: material/link
+        name: Switch to light mode
+    - media: "(prefers-color-scheme: light)"
+      scheme: default
+      primary: black
+      toggle:
+        icon: material/toggle-switch
+        name: Switch to dark mode
+    - media: "(prefers-color-scheme: dark)"
+      scheme: slate
+      primary: black
+      toggle:
+        icon: material/toggle-switch-off
+        name: Switch to system preference
 plugins:
     - search
     - mkdocstrings

pyproject.toml

@@ -36,7 +36,7 @@ dependencies = [
     "python-dateutil==2.9.0.post0",
     "tzdata==2026.3",
 ]
-requires-python = ">= 3.10"
+requires-python = ">= 3.11"
 
 [project.urls]
 homepage = "https://docs.mvt.re/en/latest/"

src/mvt/android/artifacts/browser_history.py

@@ -1,162 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2026 The MVT Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import sqlite3
-import shutil
-import tempfile
-from pathlib import Path
-from typing import Any
-
-from mvt.common.module_types import ModuleAtomicResult, ModuleSerializedResult
-from mvt.common.utils import convert_chrometime_to_datetime, convert_datetime_to_iso
-
-from .artifact import AndroidArtifact
-
-
-class BrowserHistoryArtifact(AndroidArtifact):
-    """Shared Chromium History database parsing and result handling."""
-
-    def _parse_browser_history(
-        self,
-        connection: sqlite3.Connection,
-        *,
-        browser: str,
-        package: str,
-        profile: str,
-        source_path: str,
-    ) -> None:
-        cursor = connection.cursor()
-        try:
-            cursor.execute(
-                """
-                SELECT
-                    urls.id,
-                    urls.url,
-                    urls.title,
-                    urls.visit_count,
-                    urls.typed_count,
-                    visits.id,
-                    visits.visit_time,
-                    visits.from_visit,
-                    visits.transition
-                FROM urls
-                JOIN visits ON visits.url = urls.id
-                ORDER BY visits.visit_time;
-                """
-            )
-            for row in cursor:
-                timestamp = int(row[6])
-                self.results.append(
-                    {
-                        "id": row[0],
-                        "url": row[1],
-                        "title": row[2],
-                        "visit_count": row[3],
-                        "typed_count": row[4],
-                        "visit_id": row[5],
-                        "timestamp": timestamp,
-                        "isodate": convert_datetime_to_iso(
-                            convert_chrometime_to_datetime(timestamp)
-                        ),
-                        "redirect_source": row[7],
-                        "transition": row[8],
-                        "browser": browser,
-                        "package": package,
-                        "profile": profile,
-                        "source_path": source_path,
-                    }
-                )
-        finally:
-            cursor.close()
-
-    def serialize(self, record: ModuleAtomicResult) -> ModuleSerializedResult:
-        return {
-            "timestamp": record["isodate"],
-            "module": self.__class__.__name__,
-            "event": "browser_history",
-            "data": (
-                f"{record['browser']} visit to {record['url']} "
-                f"(visit ID: {record['visit_id']}, profile: {record['profile']})"
-            ),
-        }
-
-    def check_indicators(self) -> None:
-        if not self.indicators:
-            return
-
-        for result, match in zip(
-            self.results,
-            self.indicators.check_url_batches(
-                [[result["url"]] for result in self.results]
-            ),
-        ):
-            if match:
-                self.alertstore.critical(
-                    match.message, "", result, matched_indicator=match.ioc
-                )
-
-    def collect_url_results(self) -> None:
-        for result in self.results:
-            self.add_url_result(result["url"], result.get("isodate"), "browser_history")
-
-
-class TemporarySQLiteConnection(sqlite3.Connection):
-    temporary_directory: tempfile.TemporaryDirectory | None = None
-
-    def close(self) -> None:
-        try:
-            super().close()
-        finally:
-            if self.temporary_directory:
-                self.temporary_directory.cleanup()
-                self.temporary_directory = None
-
-
-def open_browser_history_database(database_path: Path) -> sqlite3.Connection:
-    """Open a staged History database without modifying forensic evidence."""
-    database_uri = database_path.resolve().as_uri()
-    if not Path(f"{database_path}-wal").is_file():
-        return sqlite3.connect(f"{database_uri}?mode=ro&immutable=1", uri=True)
-
-    temporary_directory = tempfile.TemporaryDirectory(prefix="mvt_sqlite_")
-    temporary_path = Path(temporary_directory.name) / database_path.name
-    shutil.copy2(database_path, temporary_path)
-    for suffix in ("-wal", "-shm"):
-        sidecar = Path(f"{database_path}{suffix}")
-        if sidecar.is_file():
-            shutil.copy2(sidecar, Path(f"{temporary_path}{suffix}"))
-
-    try:
-        connection = sqlite3.connect(
-            f"{temporary_path.resolve().as_uri()}?mode=ro",
-            uri=True,
-            factory=TemporarySQLiteConnection,
-        )
-    except Exception:
-        temporary_directory.cleanup()
-        raise
-    connection.temporary_directory = temporary_directory
-    return connection
-
-
-def validate_manifest_database(database: Any) -> dict[str, Any]:
-    if not isinstance(database, dict):
-        raise ValueError("database entry is not an object")
-
-    required = ("browser", "package", "profile", "device_path", "archive_path")
-    for field in required:
-        if not isinstance(database.get(field), str) or not database[field]:
-            raise ValueError(f"database entry has invalid {field}")
-
-    archive_path = database["archive_path"]
-    path = Path(archive_path)
-    if (
-        "\\" in archive_path
-        or path.is_absolute()
-        or ".." in path.parts
-        or path.parts[:1] != ("browser_history",)
-    ):
-        raise ValueError(f"unsafe browser history archive path: {archive_path}")
-    return database

src/mvt/android/cli.py

@@ -21,7 +21,6 @@ from mvt.common.help import (
     HELP_MSG_CHECK_ANDROID_BACKUP,
     HELP_MSG_CHECK_ANDROIDQF,
     HELP_MSG_CHECK_BUGREPORT,
-    HELP_MSG_CHECK_FS,
     HELP_MSG_CHECK_IOCS,
     HELP_MSG_CHECK_INTRUSION_LOGS,
     HELP_MSG_DELAY_CHECKS,
@@ -161,7 +160,9 @@ def check_adb(ctx):
         "zone is read from persist.sys.timezone in the bugreport itself."
     ),
 )
-@click.option("--verbose", "-v", is_flag=True, help=HELP_MSG_VERBOSE_COMMAND)
+@click.option(
+    "--verbose", "-v", is_flag=True, hidden=True, help=HELP_MSG_VERBOSE_COMMAND
+)
 @click.argument("BUGREPORT_PATH", type=click.Path(exists=True))
 @click.pass_context
 def check_bugreport(
@@ -236,7 +237,9 @@ def check_bugreport(
 )
 @click.option("--non-interactive", "-n", is_flag=True, help=HELP_MSG_NONINTERACTIVE)
 @click.option("--backup-password", "-p", help=HELP_MSG_ANDROID_BACKUP_PASSWORD)
-@click.option("--verbose", "-v", is_flag=True, help=HELP_MSG_VERBOSE_COMMAND)
+@click.option(
+    "--verbose", "-v", is_flag=True, hidden=True, help=HELP_MSG_VERBOSE_COMMAND
+)
 @click.argument("BACKUP_PATH", type=click.Path(exists=True))
 @click.pass_context
 def check_backup(
@@ -311,7 +314,9 @@ def check_backup(
 )
 @click.option("--non-interactive", "-n", is_flag=True, help=HELP_MSG_NONINTERACTIVE)
 @click.option("--backup-password", "-p", help=HELP_MSG_ANDROID_BACKUP_PASSWORD)
-@click.option("--verbose", "-v", is_flag=True, help=HELP_MSG_VERBOSE_COMMAND)
+@click.option(
+    "--verbose", "-v", is_flag=True, hidden=True, help=HELP_MSG_VERBOSE_COMMAND
+)
 @click.argument("ANDROIDQF_PATH", type=click.Path(exists=True))
 @click.pass_context
 def check_androidqf(
@@ -362,59 +367,6 @@ def check_androidqf(
     cmd.show_support_message()
 
 
-# ==============================================================================
-# Command: check-fs
-# ==============================================================================
-@cli.command("check-fs", context_settings=CONTEXT_SETTINGS, help=HELP_MSG_CHECK_FS)
-@click.option(
-    "--iocs",
-    "-i",
-    type=click.Path(exists=True),
-    multiple=True,
-    default=[],
-    help=HELP_MSG_IOC,
-)
-@click.option("--output", "-o", type=click.Path(exists=False), help=HELP_MSG_OUTPUT)
-@click.option("--list-modules", "-l", is_flag=True, help=HELP_MSG_LIST_MODULES)
-@click.option("--module", "-m", help=HELP_MSG_MODULE)
-@click.option(
-    "--load-module",
-    type=click.Path(exists=True),
-    multiple=True,
-    default=[],
-    help=HELP_MSG_LOAD_MODULE,
-)
-@click.option("--hashes", "-H", is_flag=True, help=HELP_MSG_HASHES)
-@click.option("--verbose", "-v", is_flag=True, help=HELP_MSG_VERBOSE)
-@click.argument("DUMP_PATH", type=click.Path(exists=True))
-@click.pass_context
-def check_fs(
-    ctx, iocs, output, list_modules, module, load_module, hashes, verbose, dump_path
-):
-    set_verbose_logging(verbose)
-    custom_modules = _load_custom_modules(load_module)
-    from .cmd_check_fs import CmdAndroidCheckFS
-
-    cmd = CmdAndroidCheckFS(
-        target_path=dump_path,
-        results_path=output,
-        ioc_files=iocs,
-        module_name=module,
-        hashes=hashes,
-        disable_version_check=_get_disable_flags(ctx)[0],
-        disable_indicator_check=_get_disable_flags(ctx)[1],
-        custom_modules=custom_modules,
-    )
-    if list_modules:
-        cmd.list_modules()
-        return
-
-    log.info("Checking Android filesystem located at: %s", dump_path)
-    cmd.run()
-    cmd.show_alerts_brief()
-    cmd.show_support_message()
-
-
 # ==============================================================================
 # Command: check-intrusion-logs
 # ==============================================================================
@@ -451,7 +403,9 @@ def check_fs(
         "time instead of UTC."
     ),
 )
-@click.option("--verbose", "-v", is_flag=True, help=HELP_MSG_VERBOSE_COMMAND)
+@click.option(
+    "--verbose", "-v", is_flag=True, hidden=True, help=HELP_MSG_VERBOSE_COMMAND
+)
 @click.argument("LOGS_PATH", type=click.Path(exists=True))
 @click.pass_context
 def check_intrusion_logs(

src/mvt/android/cmd_check_backup.py

@@ -27,6 +27,8 @@ from .modules.backup import BACKUP_MODULES
 
 log = logging.getLogger(__name__)
 
+MAX_BACKUP_PASSWORD_ATTEMPTS = 3
+
 
 class InvalidAndroidBackup(Exception):
     pass
@@ -72,6 +74,15 @@ class CmdAndroidCheckBackup(Command):
         self.__tar: Optional[tarfile.TarFile] = None
         self.__files: List[str] = []
 
+    def _get_backup_password(self) -> str:
+        password = prompt_or_load_android_backup_password(log, self.module_options)
+        if not password:
+            if self.sub_command:
+                raise InvalidAndroidBackup("No backup password provided")
+            log.critical("No backup password provided.")
+            sys.exit(1)
+        return password
+
     def from_ab(self, ab_file_bytes: bytes) -> None:
         self.__type = "ab"
         header = parse_ab_header(ab_file_bytes)
@@ -84,28 +95,40 @@ class CmdAndroidCheckBackup(Command):
             sys.exit(1)
 
         password = None
+        # A password typed at the prompt is asked for again if it is wrong.
+        # One given on the command line or in the environment is not.
+        max_attempts = 1
         if header["encryption"] != "none":
-            password = prompt_or_load_android_backup_password(log, self.module_options)
-            if not password:
+            if not self.module_options.get("backup_password", None):
+                max_attempts = MAX_BACKUP_PASSWORD_ATTEMPTS
+            password = self._get_backup_password()
+        attempt = 1
+        while True:
+            try:
+                tardata = parse_backup_file(ab_file_bytes, password=password)
+                break
+            except InvalidBackupPassword:
+                if attempt < max_attempts:
+                    attempt += 1
+                    log.error(
+                        "Invalid backup password, try again (attempt %d of %d)",
+                        attempt,
+                        max_attempts,
+                    )
+                    password = self._get_backup_password()
+                    continue
                 if self.sub_command:
-                    raise InvalidAndroidBackup("No backup password provided")
-                log.critical("No backup password provided.")
+                    raise InvalidAndroidBackup("Invalid backup password")
+                log.critical("Invalid backup password")
+                sys.exit(1)
+            except AndroidBackupParsingError as exc:
+                if self.sub_command:
+                    raise InvalidAndroidBackup(
+                        f"Impossible to parse this backup file: {exc}"
+                    ) from exc
+                log.critical("Impossible to parse this backup file: %s", exc)
+                log.critical("Please use Android Backup Extractor (ABE) instead")
                 sys.exit(1)
-        try:
-            tardata = parse_backup_file(ab_file_bytes, password=password)
-        except InvalidBackupPassword:
-            if self.sub_command:
-                raise InvalidAndroidBackup("Invalid backup password")
-            log.critical("Invalid backup password")
-            sys.exit(1)
-        except AndroidBackupParsingError as exc:
-            if self.sub_command:
-                raise InvalidAndroidBackup(
-                    f"Impossible to parse this backup file: {exc}"
-                ) from exc
-            log.critical("Impossible to parse this backup file: %s", exc)
-            log.critical("Please use Android Backup Extractor (ABE) instead")
-            sys.exit(1)
 
         dbytes = io.BytesIO(tardata)
         try:

src/mvt/android/cmd_check_fs.py

@@ -1,47 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2026 The MVT Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import logging
-from typing import Optional
-
-from mvt.common.command import Command
-from mvt.common.indicators import Indicators
-from mvt.common.module import MVTModule
-
-from .modules.fs import FS_MODULES
-
-log = logging.getLogger(__name__)
-
-
-class CmdAndroidCheckFS(Command):
-    def __init__(
-        self,
-        target_path: Optional[str] = None,
-        results_path: Optional[str] = None,
-        ioc_files: Optional[list] = None,
-        iocs: Optional[Indicators] = None,
-        module_name: Optional[str] = None,
-        module_options: Optional[dict] = None,
-        hashes: bool = False,
-        disable_version_check: bool = False,
-        disable_indicator_check: bool = False,
-        custom_modules: Optional[list[type[MVTModule]]] = None,
-    ) -> None:
-        super().__init__(
-            target_path=target_path,
-            results_path=results_path,
-            ioc_files=ioc_files,
-            iocs=iocs,
-            module_name=module_name,
-            module_options=module_options,
-            hashes=hashes,
-            log=log,
-            disable_version_check=disable_version_check,
-            disable_indicator_check=disable_indicator_check,
-            custom_modules=custom_modules,
-        )
-        self.platform = "android"
-        self.name = "check-fs"
-        self.modules = FS_MODULES

src/mvt/android/modules/androidqf/__init__.py

@@ -11,7 +11,6 @@ from .aqf_log_timestamps import AQFLogTimestamps
 from .aqf_packages import AQFPackages
 from .aqf_processes import AQFProcesses
 from .aqf_settings import AQFSettings
-from .browser_history import BrowserHistory
 from .mounts import Mounts
 from .root_binaries import RootBinaries
 
@@ -24,5 +23,4 @@ ANDROIDQF_MODULES: list[type[MVTModule]] = [
     AQFLogTimestamps,
     RootBinaries,
     Mounts,
-    BrowserHistory,
 ]

src/mvt/android/modules/androidqf/browser_history.py

@@ -1,115 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2026 The MVT Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import json
-import sqlite3
-import tempfile
-from pathlib import Path, PurePosixPath
-
-from mvt.android.artifacts.browser_history import (
-    BrowserHistoryArtifact,
-    open_browser_history_database,
-    validate_manifest_database,
-)
-
-from .base import AndroidQFModule
-
-
-class BrowserHistory(BrowserHistoryArtifact, AndroidQFModule):
-    """Extract browser visits collected by AndroidQF."""
-
-    supported_commands = (("android", "check-androidqf"),)
-
-    def _find_manifest(self) -> str | None:
-        manifests = [
-            file_path
-            for file_path in self.files
-            if file_path.replace("\\", "/").endswith("browser_history/manifest.json")
-        ]
-        if not manifests:
-            return None
-        if len(manifests) > 1:
-            self.log.warning(
-                "Found multiple browser history manifests; using %s", manifests[0]
-            )
-        return manifests[0]
-
-    def _stage_database(
-        self, archive_path: str, prefix: str, temporary_path: Path
-    ) -> Path:
-        available_files = {
-            str(PurePosixPath(file_path.replace("\\", "/"))): file_path
-            for file_path in self.files
-        }
-        normalized_path = str(PurePosixPath(prefix, archive_path))
-        source_path = available_files.get(normalized_path)
-        if not source_path:
-            raise FileNotFoundError(archive_path)
-
-        staged_path = temporary_path / "History"
-        staged_path.write_bytes(self._get_file_content(source_path))
-        for suffix in ("-wal", "-shm"):
-            sidecar = available_files.get(normalized_path + suffix)
-            if sidecar:
-                Path(f"{staged_path}{suffix}").write_bytes(
-                    self._get_file_content(sidecar)
-                )
-        return staged_path
-
-    def run(self) -> None:
-        manifest_path = self._find_manifest()
-        if not manifest_path:
-            self.log.info("No AndroidQF browser history manifest found")
-            return
-
-        try:
-            manifest = json.loads(self._get_file_content(manifest_path))
-        except (json.JSONDecodeError, OSError, TypeError, UnicodeDecodeError) as exc:
-            self.log.error("Unable to read browser history manifest: %s", exc)
-            return
-
-        if not isinstance(manifest, dict) or manifest.get("schema_version") != 1:
-            self.log.error("Unsupported AndroidQF browser history manifest")
-            return
-        databases = manifest.get("databases", [])
-        if not isinstance(databases, list):
-            self.log.error("Invalid AndroidQF browser history database list")
-            return
-
-        normalized_manifest = manifest_path.replace("\\", "/")
-        marker = "browser_history/manifest.json"
-        prefix = normalized_manifest[: -len(marker)].rstrip("/")
-
-        for raw_database in databases:
-            try:
-                database = validate_manifest_database(raw_database)
-                with tempfile.TemporaryDirectory(prefix="mvt_browser_history_") as temp:
-                    staged_path = self._stage_database(
-                        database["archive_path"], prefix, Path(temp)
-                    )
-                    connection = open_browser_history_database(staged_path)
-                    try:
-                        self._parse_browser_history(
-                            connection,
-                            browser=database["browser"],
-                            package=database["package"],
-                            profile=database["profile"],
-                            source_path=database["device_path"],
-                        )
-                    finally:
-                        connection.close()
-            except (
-                FileNotFoundError,
-                OSError,
-                OverflowError,
-                sqlite3.Error,
-                TypeError,
-                ValueError,
-            ) as exc:
-                self.log.error("Unable to parse browser history database: %s", exc)
-
-        self.log.info(
-            "Extracted a total of %d browser history items", len(self.results)
-        )

src/mvt/android/modules/fs/__init__.py

@@ -1,10 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2026 The MVT Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-from mvt.common.module import MVTModule
-
-from .browser_history import BrowserHistory
-
-FS_MODULES: list[type[MVTModule]] = [BrowserHistory]

src/mvt/android/modules/fs/browser_history.py

@@ -1,115 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2026 The MVT Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import logging
-import sqlite3
-from pathlib import Path
-from typing import Optional
-
-from mvt.android.artifacts.browser_history import (
-    BrowserHistoryArtifact,
-    open_browser_history_database,
-)
-from mvt.common.module import MVTModule
-from mvt.common.module_types import ModuleResults
-
-
-# These locations are deliberately limited to paths backed by public parser
-# fixtures or the historical MVT implementation.
-BROWSER_HISTORY_PATHS = {
-    "data/data/com.android.chrome/app_chrome/Default/History": (
-        "Chrome",
-        "com.android.chrome",
-        "Default",
-    ),
-    "data/data/com.brave.browser/app_chrome/Default/History": (
-        "Brave",
-        "com.brave.browser",
-        "Default",
-    ),
-    "data/data/com.microsoft.emmx/app_chrome/Default/History": (
-        "Microsoft Edge",
-        "com.microsoft.emmx",
-        "Default",
-    ),
-    "data/data/com.sec.android.app.sbrowser/app_sbrowser/Default/History": (
-        "Samsung Internet",
-        "com.sec.android.app.sbrowser",
-        "Default",
-    ),
-}
-
-
-class BrowserHistory(BrowserHistoryArtifact, MVTModule):
-    """Extract supported Chromium History databases from a filesystem dump."""
-
-    supported_commands = (("android", "check-fs"),)
-
-    def __init__(
-        self,
-        file_path: Optional[str] = None,
-        target_path: Optional[str] = None,
-        results_path: Optional[str] = None,
-        module_options: Optional[dict] = None,
-        log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[ModuleResults] = None,
-    ) -> None:
-        super().__init__(
-            file_path=file_path,
-            target_path=target_path,
-            results_path=results_path,
-            module_options=module_options,
-            log=log,
-            results=results,
-        )
-
-    def _database_paths(self) -> list[tuple[Path, str, str, str]]:
-        if not self.target_path:
-            return []
-        target = Path(self.target_path)
-        if target.is_file():
-            normalized_target = target.resolve().as_posix()
-            for relative_path, identity in BROWSER_HISTORY_PATHS.items():
-                if normalized_target.endswith(f"/{relative_path}"):
-                    return [(target, *identity)]
-            return [(target, "Chromium", "unknown", "unknown")]
-
-        databases = []
-        for relative_path, identity in BROWSER_HISTORY_PATHS.items():
-            database_path = target / relative_path
-            if database_path.is_file():
-                databases.append((database_path, *identity))
-        return databases
-
-    def run(self) -> None:
-        for database_path, browser, package, profile in self._database_paths():
-            try:
-                connection = open_browser_history_database(database_path)
-                try:
-                    self._parse_browser_history(
-                        connection,
-                        browser=browser,
-                        package=package,
-                        profile=profile,
-                        source_path=str(database_path),
-                    )
-                finally:
-                    connection.close()
-            except (
-                OSError,
-                OverflowError,
-                sqlite3.Error,
-                TypeError,
-                ValueError,
-            ) as exc:
-                self.log.error(
-                    "Unable to parse browser history database %s: %s",
-                    database_path,
-                    exc,
-                )
-
-        self.log.info(
-            "Extracted a total of %d browser history items", len(self.results)
-        )

src/mvt/common/password.py

@@ -6,7 +6,7 @@
 """Password prompts with masked keyboard feedback.
 
 This is based on the ``echo_char`` support added to :mod:`getpass` in Python
-3.14. MVT supports Python 3.10 and later, so it cannot use that API directly.
+3.14. MVT supports Python 3.11 and later, so it cannot use that API directly.
 """
 
 import contextlib

src/mvt/ios/cli.py

@@ -278,7 +278,9 @@ def extract_key(password, key_file, backup_path):
     help=HELP_MSG_LOAD_MODULE,
 )
 @click.option("--hashes", "-H", is_flag=True, help=HELP_MSG_HASHES)
-@click.option("--verbose", "-v", is_flag=True, help=HELP_MSG_VERBOSE_COMMAND)
+@click.option(
+    "--verbose", "-v", is_flag=True, hidden=True, help=HELP_MSG_VERBOSE_COMMAND
+)
 @click.argument("BACKUP_PATH", type=click.Path(exists=True))
 @click.pass_context
 def check_backup(
@@ -347,7 +349,9 @@ def check_backup(
     help=HELP_MSG_LOAD_MODULE,
 )
 @click.option("--hashes", "-H", is_flag=True, help=HELP_MSG_HASHES)
-@click.option("--verbose", "-v", is_flag=True, help=HELP_MSG_VERBOSE_COMMAND)
+@click.option(
+    "--verbose", "-v", is_flag=True, hidden=True, help=HELP_MSG_VERBOSE_COMMAND
+)
 @click.argument("DUMP_PATH", type=click.Path(exists=True))
 @click.pass_context
 def check_fs(
@@ -416,7 +420,9 @@ def check_fs(
     help=HELP_MSG_LOAD_MODULE,
 )
 @click.option("--hashes", "-H", is_flag=True, help=HELP_MSG_HASHES)
-@click.option("--verbose", "-v", is_flag=True, help=HELP_MSG_VERBOSE_COMMAND)
+@click.option(
+    "--verbose", "-v", is_flag=True, hidden=True, help=HELP_MSG_VERBOSE_COMMAND
+)
 @click.argument("SYSDIAGNOSE_PATH", type=click.Path(exists=True))
 @click.pass_context
 def check_sysdiagnose(

src/mvt/ios/data/ios_versions.json

@@ -1224,6 +1224,10 @@
         "version": "18.7.10",
         "build": "22H374"
     },
+    {
+        "version": "18.7.11",
+        "build": "22H384"
+    },
     {
         "version": "26",
         "build": "23A341"
@@ -1283,5 +1287,13 @@
     {
         "version": "27.0.1",
         "build": "24A446"
+    },
+    {
+        "version": "27.2",
+        "build": "24B91020"
+    },
+    {
+        "version": "27.2",
+        "build": "24B119"
     }
 ]

tests/android/test_browser_history.py

@@ -1,261 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2026 The MVT Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import json
-import sqlite3
-import zipfile
-from pathlib import Path
-
-import pytest
-
-from mvt.android.modules.androidqf.browser_history import (
-    BrowserHistory as AndroidQFBrowserHistory,
-)
-from mvt.android.modules.fs.browser_history import BrowserHistory as FSBrowserHistory
-from mvt.android.cmd_check_fs import CmdAndroidCheckFS
-
-CHROME_TIME = 13_348_540_800_000_000
-URL = "https://example.org/path"
-
-
-def create_history_database(path: Path, *, url: str = URL) -> None:
-    path.parent.mkdir(parents=True, exist_ok=True)
-    with sqlite3.connect(path) as connection:
-        connection.executescript(
-            """
-            CREATE TABLE urls (
-                id INTEGER PRIMARY KEY,
-                url TEXT,
-                title TEXT,
-                visit_count INTEGER,
-                typed_count INTEGER
-            );
-            CREATE TABLE visits (
-                id INTEGER PRIMARY KEY,
-                url INTEGER,
-                visit_time INTEGER,
-                from_visit INTEGER,
-                transition INTEGER
-            );
-            """
-        )
-        connection.execute("INSERT INTO urls VALUES (1, ?, 'Example', 1, 0)", (url,))
-        connection.execute(
-            "INSERT INTO visits VALUES (7, 1, ?, 0, 805306368)",
-            (CHROME_TIME,),
-        )
-
-
-def manifest(database_paths: list[tuple[str, str]]) -> dict:
-    return {
-        "schema_version": 1,
-        "status": "collected",
-        "databases": [
-            {
-                "browser": "Chrome",
-                "package": package,
-                "profile": "Default",
-                "device_path": f"/data/data/{package}/app_chrome/Default/History",
-                "archive_path": archive_path,
-                "sidecars": [],
-            }
-            for package, archive_path in database_paths
-        ],
-    }
-
-
-@pytest.mark.parametrize("use_zip", [False, True])
-def test_androidqf_browser_history_directory_and_zip(tmp_path, use_zip):
-    source_database = tmp_path / "source" / "History"
-    create_history_database(source_database)
-    archive_path = "browser_history/com.android.chrome/Default/History"
-    manifest_data = manifest([("com.android.chrome", archive_path)])
-
-    module = AndroidQFBrowserHistory()
-    if use_zip:
-        acquisition_path = tmp_path / "acquisition.zip"
-        with zipfile.ZipFile(acquisition_path, "w") as archive:
-            archive.write(source_database, archive_path)
-            archive.writestr("browser_history/manifest.json", json.dumps(manifest_data))
-        with zipfile.ZipFile(acquisition_path) as archive:
-            module.from_zip(archive, archive.namelist())
-            module.run()
-    else:
-        acquisition = tmp_path / "acquisition"
-        database_path = acquisition / archive_path
-        database_path.parent.mkdir(parents=True)
-        database_path.write_bytes(source_database.read_bytes())
-        manifest_path = acquisition / "browser_history" / "manifest.json"
-        manifest_path.write_text(json.dumps(manifest_data))
-        files = [
-            path.relative_to(tmp_path).as_posix()
-            for path in acquisition.rglob("*")
-            if path.is_file()
-        ]
-        module.from_dir(str(tmp_path), files)
-        module.run()
-
-    assert len(module.results) == 1
-    assert module.results[0]["url"] == URL
-    assert module.results[0]["browser"] == "Chrome"
-    assert module.results[0]["source_path"].endswith("/History")
-    module.collect_url_results()
-    module.to_timeline()
-    assert module.url_results[0]["url"] == URL
-    assert module.timeline[0]["event"] == "browser_history"
-
-
-@pytest.mark.parametrize("prefix", ["", "./", "acquisition/", "./acquisition/"])
-@pytest.mark.parametrize("separator", ["/", "\\"])
-def test_androidqf_zip_paths_preserve_wal_visits(tmp_path, prefix, separator):
-    database = tmp_path / "History"
-    create_history_database(database)
-    connection = sqlite3.connect(database)
-    connection.execute("PRAGMA journal_mode=WAL")
-    connection.execute("PRAGMA wal_checkpoint(TRUNCATE)")
-    connection.execute(
-        "INSERT INTO urls VALUES (2, ?, 'WAL', 1, 0)", (URL + "/wal",)
-    )
-    connection.execute(
-        "INSERT INTO visits VALUES (8, 2, ?, 0, 805306368)", (CHROME_TIME,)
-    )
-    connection.commit()
-    archive_path = "browser_history/com.android.chrome/Default/History"
-    acquisition = tmp_path / "acquisition.zip"
-    try:
-        with zipfile.ZipFile(acquisition, "w") as archive:
-            for suffix in ("", "-wal", "-shm"):
-                archive.writestr(
-                    (prefix + archive_path + suffix).replace("/", separator),
-                    Path(f"{database}{suffix}").read_bytes(),
-                )
-            archive.writestr(
-                (prefix + "browser_history/manifest.json").replace("/", separator),
-                json.dumps(manifest([("com.android.chrome", archive_path)])),
-            )
-        module = AndroidQFBrowserHistory()
-        with zipfile.ZipFile(acquisition) as archive:
-            module.from_zip(archive, archive.namelist())
-            module.run()
-    finally:
-        connection.close()
-
-    assert {result["url"] for result in module.results} == {URL, URL + "/wal"}
-
-
-def test_androidqf_browser_history_isolates_malformed_database(tmp_path, caplog):
-    acquisition = tmp_path / "acquisition"
-    good_archive_path = "browser_history/com.android.chrome/Default/History"
-    bad_archive_path = "browser_history/com.brave.browser/Default/History"
-    create_history_database(acquisition / good_archive_path)
-    bad_path = acquisition / bad_archive_path
-    bad_path.parent.mkdir(parents=True)
-    bad_path.write_bytes(b"not sqlite")
-    manifest_path = acquisition / "browser_history" / "manifest.json"
-    manifest_path.write_text(
-        json.dumps(
-            manifest(
-                [
-                    ("com.brave.browser", bad_archive_path),
-                    ("com.android.chrome", good_archive_path),
-                ]
-            )
-        )
-    )
-
-    module = AndroidQFBrowserHistory()
-    files = [
-        path.relative_to(tmp_path).as_posix()
-        for path in acquisition.rglob("*")
-        if path.is_file()
-    ]
-    module.from_dir(str(tmp_path), files)
-    module.run()
-
-    assert [result["url"] for result in module.results] == [URL]
-    assert "Unable to parse browser history database" in caplog.text
-
-
-def test_androidqf_browser_history_rejects_unsafe_manifest_path(tmp_path, caplog):
-    acquisition = tmp_path / "acquisition"
-    manifest_path = acquisition / "browser_history" / "manifest.json"
-    manifest_path.parent.mkdir(parents=True)
-    manifest_path.write_text(
-        json.dumps(manifest([("com.android.chrome", "browser_history/../secret")]))
-    )
-    module = AndroidQFBrowserHistory()
-    module.from_dir(str(tmp_path), [manifest_path.relative_to(tmp_path).as_posix()])
-
-    module.run()
-
-    assert module.results == []
-    assert "unsafe browser history archive path" in caplog.text
-
-
-def test_filesystem_browser_history_reads_wal_only_visit(tmp_path):
-    database_path = tmp_path / "History"
-    connection = sqlite3.connect(database_path)
-    connection.execute("PRAGMA journal_mode=WAL")
-    connection.executescript(
-        """
-        CREATE TABLE urls (
-            id INTEGER PRIMARY KEY,
-            url TEXT,
-            title TEXT,
-            visit_count INTEGER,
-            typed_count INTEGER
-        );
-        CREATE TABLE visits (
-            id INTEGER PRIMARY KEY,
-            url INTEGER,
-            visit_time INTEGER,
-            from_visit INTEGER,
-            transition INTEGER
-        );
-        """
-    )
-    connection.commit()
-    connection.execute("PRAGMA wal_checkpoint(TRUNCATE)")
-    connection.execute("INSERT INTO urls VALUES (1, ?, 'WAL', 1, 0)", (URL,))
-    connection.execute(
-        "INSERT INTO visits VALUES (8, 1, ?, 0, 805306368)", (CHROME_TIME,)
-    )
-    connection.commit()
-    try:
-        assert Path(f"{database_path}-wal").stat().st_size > 0
-        module = FSBrowserHistory(target_path=str(database_path))
-        module.run()
-    finally:
-        connection.close()
-
-    assert [result["url"] for result in module.results] == [URL]
-    assert module.results[0]["browser"] == "Chromium"
-
-
-def test_android_check_fs_finds_all_supported_browser_paths(tmp_path):
-    for index, relative_path in enumerate(
-        (
-            "data/data/com.android.chrome/app_chrome/Default/History",
-            "data/data/com.brave.browser/app_chrome/Default/History",
-            "data/data/com.microsoft.emmx/app_chrome/Default/History",
-            "data/data/com.sec.android.app.sbrowser/app_sbrowser/Default/History",
-        )
-    ):
-        create_history_database(
-            tmp_path / relative_path, url=f"https://example.org/{index}"
-        )
-
-    command = CmdAndroidCheckFS(target_path=str(tmp_path), module_name="BrowserHistory")
-    command.run()
-
-    assert len(command.executed) == 1
-    assert {result["package"] for result in command.executed[0].results} == {
-        "com.android.chrome",
-        "com.brave.browser",
-        "com.microsoft.emmx",
-        "com.sec.android.app.sbrowser",
-    }
-    assert len(command.url_results) == 4
-    assert len(command.timeline) == 4

tests/test_check_android_backup.py

@@ -59,6 +59,66 @@ class TestCheckAndroidBackupCommand:
         assert result.exit_code == 1
         assert "Invalid backup password" in caplog.text
 
+    def test_check_encrypted_backup_prompt_retry(self, mocker):
+        """A wrong password at the prompt is asked for again"""
+        prompt_mock = mocker.patch(
+            "mvt.android.modules.backup.helpers.prompt_password",
+            side_effect=["wrong_password", TEST_BACKUP_PASSWORD],
+        )
+        runner = CliRunner()
+        path = os.path.join(get_artifact_folder(), "androidqf_encrypted/backup.ab")
+        result = runner.invoke(check_backup, [path])
+
+        assert prompt_mock.call_count == 2
+        assert result.exit_code == 0
+
+    def test_check_encrypted_backup_prompt_gives_up(self, mocker, caplog):
+        """The prompt gives up after three wrong passwords"""
+        prompt_mock = mocker.patch(
+            "mvt.android.modules.backup.helpers.prompt_password",
+            return_value="wrong_password",
+        )
+        runner = CliRunner()
+        path = os.path.join(get_artifact_folder(), "androidqf_encrypted/backup.ab")
+
+        with caplog.at_level(logging.CRITICAL):
+            result = runner.invoke(check_backup, [path])
+
+        assert prompt_mock.call_count == 3
+        assert result.exit_code == 1
+        assert "Invalid backup password" in caplog.text
+
+    def test_check_encrypted_backup_prompt_retry_empty(self, mocker, caplog):
+        """An empty answer on a retry ends the check"""
+        prompt_mock = mocker.patch(
+            "mvt.android.modules.backup.helpers.prompt_password",
+            side_effect=["wrong_password", ""],
+        )
+        runner = CliRunner()
+        path = os.path.join(get_artifact_folder(), "androidqf_encrypted/backup.ab")
+
+        with caplog.at_level(logging.CRITICAL):
+            result = runner.invoke(check_backup, [path])
+
+        assert prompt_mock.call_count == 2
+        assert result.exit_code == 1
+        assert "No backup password provided" in caplog.text
+
+    def test_check_encrypted_backup_cli_invalid_no_prompt(self, mocker):
+        """A password given on the command line is not asked for again"""
+        prompt_mock = mocker.patch(
+            "mvt.android.modules.backup.helpers.prompt_password",
+            return_value=TEST_BACKUP_PASSWORD,
+        )
+        runner = CliRunner()
+        path = os.path.join(get_artifact_folder(), "androidqf_encrypted/backup.ab")
+        result = runner.invoke(
+            check_backup, ["--backup-password", "invalid_password", path]
+        )
+
+        assert prompt_mock.call_count == 0
+        assert result.exit_code == 1
+
     def test_check_encrypted_backup_env(self, mocker):
         """Provide password as environment variable"""
         prompt_mock = mocker.patch(

tests/test_cli_verbose.py

@@ -100,8 +100,8 @@ class TestVerboseOnTheCheckCommands:
         assert result.exit_code == 0
         assert _console_level() == logging.DEBUG
 
-    def test_the_command_option_says_it_is_kept_for_compatibility(self):
+    def test_the_command_option_is_hidden_from_the_help(self):
         result = CliRunner().invoke(ios_cli, [*OFFLINE, "check-backup", "--help"])
 
         assert result.exit_code == 0
-        assert "kept for compatibility" in result.output
+        assert "--verbose" not in result.output

uv.lock

@@ -1,6 +1,6 @@
 version = 1
 revision = 3
-requires-python = ">=3.10"
+requires-python = ">=3.11"
 resolution-markers = [
     "python_full_version >= '3.15'",
     "python_full_version < '3.15'",