Reorganize code in iOS app module

2026-02-14 17:42:46 +00:00 · 2024-12-14 10:03:23 +01:00
138 changed files with 1459 additions and 4266 deletions
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -1,11 +0,0 @@
-# To get started with Dependabot version updates, you'll need to specify which
-# package ecosystems to update and where the package manifests are located.
-# Please see the documentation for all configuration options:
-# https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
-
-version: 2
-updates:
-  - package-ecosystem: "pip" # See documentation for possible values
-    directory: "/" # Location of package manifests
-    schedule:
-      interval: "weekly"
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -12,7 +12,7 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        python-version: ['3.10', '3.11', '3.12', '3.13', '3.14']
+        python-version: ['3.8', '3.9', '3.10']  # , '3.11']

    steps:
      - uses: actions/checkout@v4
@@ -35,4 +35,4 @@ jobs:
        if: github.event_name == 'pull_request'
        with:
          pytest-coverage-path: ./pytest-coverage.txt
-          junitxml-path: ./pytest.xml
+          junitxml-path: ./pytest.xml
--- a/.github/workflows/update-ios-data.yml
+++ b/.github/workflows/update-ios-data.yml
@@ -21,7 +21,6 @@ jobs:
          title: '[auto] Update iOS releases and versions'
          commit-message: Add new iOS versions and build numbers
          branch: auto/add-new-ios-releases
-          draft: true
          body: |
            This is an automated pull request to update the iOS releases and version numbers.
          add-paths: |
--- a/5
+++ b/5
@@ -103,7 +103,7 @@ RUN git clone https://github.com/libimobiledevice/usbmuxd && cd usbmuxd \


 # Create main image
-FROM ubuntu:24.04 as main
+FROM ubuntu:22.04 as main

 LABEL org.opencontainers.image.url="https://mvt.re"
 LABEL org.opencontainers.image.documentation="https://docs.mvt.re"
@@ -135,7 +135,8 @@ COPY --from=build-usbmuxd /build /
 COPY . mvt/
 RUN apt-get update \
   && apt-get install -y git python3-pip \
-   && PIP_NO_CACHE_DIR=1 pip3 install --break-system-packages ./mvt \
+   && PIP_NO_CACHE_DIR=1 pip3 install --upgrade pip \
+   && PIP_NO_CACHE_DIR=1 pip3 install ./mvt \
   && apt-get remove -y python3-pip git && apt-get autoremove -y \
   && rm -rf /var/lib/apt/lists/* \
   && rm -rf mvt
--- a/14
+++ b/14
@@ -1,9 +1,14 @@
 PWD = $(shell pwd)

+autofix:
+	ruff format .
+	ruff check --fix .
+
 check: ruff mypy

 ruff:
-	ruff check .
+	ruff format --check .
+	ruff check -q .

 mypy:
 	mypy
@@ -18,12 +23,7 @@ install:
 	python3 -m pip install --upgrade -e .

 test-requirements:
-	python3 -m pip install --upgrade --group dev
-
-generate-proto-parsers:
-	# Generate python parsers for protobuf files
-	PROTO_FILES=$$(find src/mvt/android/parsers/proto/ -iname "*.proto"); \
-	protoc -Isrc/mvt/android/parsers/proto/ --python_betterproto_out=src/mvt/android/parsers/proto/ $$PROTO_FILES
+	python3 -m pip install --upgrade -r test-requirements.txt

 clean:
 	rm -rf $(PWD)/build $(PWD)/dist $(PWD)/src/mvt.egg-info
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -2,61 +2,4 @@

 Thank you for your interest in reporting security issues and vulnerabilities! Security research is of utmost importance and we take all reports seriously. If you discover an issue please report it to us right away!

-Please DO NOT file a public issue, instead send your report privately to the MVT maintainers at Amnesty International via `security [at] amnesty [dot] tech`.
-
-You can also write PGP-encrypted emails to key `CFBF9698DCA8EB2A80F48ADEA035A030FA04ED13`. The corresponding PGP public key is lited below.
-
-```
-----BEGIN PGP PUBLIC KEY BLOCK-----
-
-mQINBGlFPwsBEADQ+d7SeHrFPYv3wPOjWs2oMpp0DPdfIyGbg+iYWOC36FegZhKY
-+WeK96GqJWt8wD6kwFUVwQI795WZrjSd1q4a7wR+kj/h7xlRB6ZfVICA6O5DOOm6
-GNMvqy7ESm8g1XZDpb2u1BXmSS9X8f6rjB0e86kYsF1mB5/2USTM63jgDs0GGTkZ
-Q1z4Mq4gYyqH32b3gvXkbb68LeQmONUIM3cgmec9q8/pNc1l7fcoLWhOVADRj17Q
-plisa/EUf/SYqdtk9w7EHGggNenKNwVM235mkPcMqmE72bTpjT6XCxvZY3ByG5yi
-7L+tHJU45ZuXtt62EvX03azxThVfSmH/WbRk8lH8+CW8XMmiWZphG4ydPWqgVKCB
-2UOXm+6CQnKA+7Dt1AeK2t5ciATrv9LvwgSxk5WKc3288XFLA6eGMrTdQygYlLjJ
-+42RSdK/7fCt/qk4q13oUw8ZTVcCia98uZFi704XuuYTH6NrntIB7j/0oucIS4Y9
-cTWNO5LBerez4v8VI4YHcYESPeIWGFkXhvJzo0VMg1zidBLtiPoGF2JKZGwaK7/p
-yY1xALskLp4H+5OY4eB1kf8kl4vGsEK8xA/NNzOiapVmwBXpvVvmXIQJE2k+olNf
-sAuyB8+aO1Ws7tFYt3D+olC7iaprOdK7uA4GCgmYYhq6QQPg+cxfczgHfwARAQAB
-tD1TZWN1cml0eSBMYWIgYXQgQW1uZXN0eSBJbnRlcm5hdGlvbmFsIDxzZWN1cml0
-eUBhbW5lc3R5LnRlY2g+iQJRBBMBCAA7FiEEz7+WmNyo6yqA9IreoDWgMPoE7RMF
-AmlFPwsCGwMFCwkIBwICIgIGFQoJCAsCBBYCAwECHgcCF4AACgkQoDWgMPoE7RNr
-2w//a88uP90uSN6lgeIwKsHr1ri27QIBbzCV6hLN/gZBFR2uaiOn/xfFDbnR0Cjo
-5nMCJCT1k4nrPbMTlfmWLCD+YKELBzVqWlw4J2SOg3nznPl2JrL8QBKjwts0sF+h
-QbRWDsT54wBZnl6ZJJ79eLShNTokBbKnQ7071dMrENr5e2P2sClQXyiIc51ga4FM
-fHyhsx+GsrdiZNd2AH8912ljW1GuEi3epTO7KMZprmr37mjpZSUToiV59Yhl1Gbo
-2pixkYJqi62DG02/gTpCjq9NH3cEMxcxjh4E7yCA8ggLG6+IN6woIvPIdOsnQ+Yj
-d3H4rMNBjPSKoL+bdHILkCnp5HokcbVjNY3QAyOAF4qWhk4GtgpTshwxUmb4Tbay
-tWLJC2bzjuUBxLkGzMVFfU3B96sVS4Fi0sBaEMBtHskl2f45X8LJhSq//Lw/2L/8
-34uP/RxDSn+DPvj/yqMpekdCcmeFSTX1A19xkPcc0rVhMRde4VL338R86vzh0gMI
-1LySDAhXZyVWzrQ5s3n6N3EvCaHCn3qu7ieyFJifCSR7gZqevCEznMQRVpkMTzUt
-rk13Z6NOOb4IlTW7HFoY3omJG8Z5jV4kMIE7n6nb0qpNYQiG+YvjenQ3VrMoISyh
-lpS2De8+oOtwrxBVX3+qKWvQqzufeE3416kw2Z+5mxH7bx25Ag0EaUU/CwEQALyZ
-b+kwLN1yHObTm2yDBEn5HbCT3H1GremvPNmbAaTnfrjUngoKa8MuWWzbX5ptgmZR
-UpYY/ylOYcgGydz58vUNrPlhIZT9UhmiifPgZLEXyd0uFpr/NsbRajHMkK10iEZf
-h5bHNobiB7pGCu4Uj9e1cMiIZ4yEaYeyXYUoNHf6ISP39mJhHy6ov5yIpm9q0wzm
-tGUQPupxGXmEZlOPr3lxqXQ3Ekdv6cWDY5r/oOq71QJ/HUQ13QUuGFIbhnMbT8zd
-zaS6f/v772YKsWPc4NNUhtlf25VnQ4FuUtjCe3p6iYP4OVD8gJm0GvXyvyTuiQbL
-CSk/378JiNT7nZzYXxrWchMwvEoMIU55+/UaBc50HI5xvDQ858CX7PYGiimcdsO1
-EkQzhVxRfjlILfWrC2lgt+H5qhTn4Fah250Xe1PnLjXGHVUQnY/f3MFeiWQgf92b
-02+MfvOeC5OKttP1z5lcx6RFWCIa1E/u8Nj7YrH9hk0ZBRAnBaeAncDFY8dfX2zX
-VMoc0dV16gM7RrZ6i7D3CG3eLLkQlX0jbW9dzTuG/3f098EWB1p8vOfS/RbNCBRX
-jqGiqacL/aFF3Ci3nQ4O5tSv1XipbgrUhvXnwm9pxrLPS/45iaO59WN4RRGWLLQ7
-LHmeBxoa9avv0SdBYUL+eBxY46GXb/j5VLzHYhSnABEBAAGJAjYEGAEIACAWIQTP
-v5aY3KjrKoD0it6gNaAw+gTtEwUCaUU/CwIbDAAKCRCgNaAw+gTtEyvsEACnyFFD
-alOZTrrJTXNnUejuiExLh+qTO3T91p5bte597jpwCZnYGwkxEfffsqqhlY6ftEOf
-d5tNWE5isai4v8XCbplWomz4KBpepxcn2b+9o5dSyr1vohEFuCJziZDsta1J2DX5
-IE9U48kTgLDfdIBhuOyHNRkvXRHP2OVLCaiw4d9q+hlrraR8pehHt2BJSxh+QZoe
-n0iHvIZCBIUA45zLEGmXFpNTGeEf2dKPp3xOkAXOhAMPptE0V1itkF3R7kEW4aFO
-SZo8L3C1aWSz/gQ4/vvW5t1IJxirNMUgTMQFvqEkAwX3fm6GCxlgRSvTTRXdcrS8
-6qyFdH1nkCNsavPahN3N2RGGIlWtODEMTO1Hjy0kZtTYdW+JH9sendliCoJES+yN
-DjM125SgdAgrqlSYm/g8n9knWpxZv1QM6jU/sVz1J+l6/ixugL2i+CAL2d6uv4tT
-QmXnu7Ei4/2kHBUu3Lf59MNgmLHm6F7AhOWErszSeoJKsp+3yA1oTT/npz67sRzY
-VVyxz4NBIollna59a1lz0RhlWzNKqNB27jhylyM4ltdzHB7r4VMAVJyttozmIIOC
-35ucYxl5BHLuapaRSaYHdUId1LOccYyaOOFF/PSyCu9dKzXk7zEz2HNcIboWSkAE
-8ZDExMYM4WVpVCOj+frdsaBvzItHacRWuijtkw==
-=JAXX
-----END PGP PUBLIC KEY BLOCK-----
-```
+Please DO NOT file a public issue, instead send your report privately to *nex [at] nex [dot] sx*. You can also write PGP-encrypted emails to [this key](https://keybase.io/nex/pgp_keys.asc?fingerprint=05216f3b86848a303c2fe37dd166f1667359d880).
--- a/docs/android/adb.md
+++ b/docs/android/adb.md
@@ -16,12 +16,6 @@ Now you can try launching MVT with:
 mvt-android check-adb --output /path/to/results
 ```

-!!! warning
-    The `check-adb` command is deprecated and will be removed in a future release.
-    Whenever possible, prefer acquiring device data using the AndroidQF project (https://github.com/mvt-project/androidqf/) and then analyze those acquisitions with MVT.
-
-    Running `mvt-android check-adb` will also emit a runtime deprecation warning advising you to migrate to AndroidQF.
-
 If you have previously started an adb daemon MVT will alert you and require you to kill it with `adb kill-server` and relaunch the command.

 !!! warning
@@ -43,14 +37,6 @@ mvt-android check-adb --serial 192.168.1.20:5555 --output /path/to/results

 Where `192.168.1.20` is the correct IP address of your device.

-!!! warning
-    The `check-adb` workflow shown above is deprecated. If you can acquire an AndroidQF acquisition from the device (recommended), use the AndroidQF project to create that acquisition: https://github.com/mvt-project/androidqf/
-    
-    AndroidQF acquisitions provide a more stable, reproducible analysis surface and are the preferred workflow going forward.
-
 ## MVT modules requiring root privileges

-!!! warning
-    Deprecated: many `mvt-android check-adb` workflows are deprecated and will be removed in a future release. Whenever possible, prefer acquiring an AndroidQF acquisition using the AndroidQF project (https://github.com/mvt-project/androidqf/). 
-
 Of the currently available `mvt-android check-adb` modules a handful require root privileges to function correctly. This is because certain files, such as browser history and SMS messages databases are not accessible with user privileges through adb. These modules are to be considered OPTIONALLY available in case the device was already jailbroken. **Do NOT jailbreak your own device unless you are sure of what you are doing!** Jailbreaking your phone exposes it to considerable security risks!
--- a/docs/command_completion.md
+++ b/docs/command_completion.md
@@ -1,43 +0,0 @@
-# Command Completion 
-
-MVT utilizes the [Click](https://click.palletsprojects.com/en/stable/) library for creating its command line interface. 
-
-Click provides tab completion support for Bash (version 4.4 and up), Zsh, and Fish.
-
-To enable it, you need to manually register a special function with your shell, which varies depending on the shell you are using.
-
-The following describes how to generate the command completion scripts and add them to your shell configuration. 
-
-> **Note: You will need to start a new shell for the changes to take effect.**
-
-### For Bash
-
-```bash
-# Generates bash completion scripts
-echo "$(_MVT_IOS_COMPLETE=bash_source mvt-ios)" > ~/.mvt-ios-complete.bash &&
-echo "$(_MVT_ANDROID_COMPLETE=bash_source mvt-android)" > ~/.mvt-android-complete.bash
-```
-
-Add the following to `~/.bashrc`:
-```bash
-# source mvt completion scripts
-. ~/.mvt-ios-complete.bash && .  ~/.mvt-android-complete.bash
-```
-
-### For Zsh
-
-```bash
-# Generates zsh completion scripts
-echo "$(_MVT_IOS_COMPLETE=zsh_source mvt-ios)" >  ~/.mvt-ios-complete.zsh &&
-echo "$(_MVT_ANDROID_COMPLETE=zsh_source mvt-android)" > ~/.mvt-android-complete.zsh
-```
-
-Add the following to `~/.zshrc`:
-```bash
-# source mvt completion scripts
-.  ~/.mvt-ios-complete.zsh  && .  ~/.mvt-android-complete.zsh
-```
-
-For more information, visit the official [Click Docs](https://click.palletsprojects.com/en/stable/shell-completion/#enabling-completion).
-
-
--- a/docs/install.md
+++ b/docs/install.md
@@ -98,7 +98,3 @@ You now should have the `mvt-ios` and `mvt-android` utilities installed.
 **Notes:**
 1. The `--force` flag is necessary to force the reinstallation of the package.
 2. To revert to using a PyPI version, it will be necessary to `pipx uninstall mvt` first.
-
-## Setting up command completions
-
-See ["Command completions"](command_completion.md)
--- a/docs/requirements.txt
+++ b/docs/requirements.txt
@@ -1,5 +1,5 @@
 mkdocs==1.6.1
-mkdocs-autorefs==1.4.3
-mkdocs-material==9.6.20
+mkdocs-autorefs==1.2.0
+mkdocs-material==9.5.42
 mkdocs-material-extensions==1.3.1
-mkdocstrings==0.30.1
+mkdocstrings==0.23.0
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -1,11 +1,13 @@
 [project]
 name = "mvt"
 dynamic = ["version"]
-authors = [{ name = "Claudio Guarnieri", email = "nex@nex.sx" }]
+authors = [
+    {name = "Claudio Guarnieri", email = "nex@nex.sx"}
+]
 maintainers = [
-    { name = "Etienne Maynier", email = "tek@randhome.io" },
-    { name = "Donncha Ó Cearbhaill", email = "donncha.ocearbhaill@amnesty.org" },
-    { name = "Rory Flynn", email = "rory.flynn@amnesty.org" },
+    {name = "Etienne Maynier", email = "tek@randhome.io"},
+    {name = "Donncha Ó Cearbhaill", email = "donncha.ocearbhaill@amnesty.org"},
+    {name = "Rory Flynn", email = "rory.flynn@amnesty.org"}
 ]
 description = "Mobile Verification Toolkit"
 readme = "README.md"
@@ -14,61 +16,44 @@ classifiers = [
    "Development Status :: 5 - Production/Stable",
    "Intended Audience :: Information Technology",
    "Operating System :: OS Independent",
-    "Programming Language :: Python",
+    "Programming Language :: Python"
 ]
 dependencies = [
-    "click==8.3.0",
-    "rich==14.1.0",
-    "tld==0.13.1",
-    "requests==2.32.5",
-    "simplejson==3.20.2",
-    "packaging==25.0",
-    "appdirs==1.4.4",
-    "iOSbackup==0.9.925",
-    "adb-shell[usb]==0.4.4",
-    "libusb1==3.3.1",
-    "cryptography==46.0.3",
-    "PyYAML>=6.0.2",
-    "pyahocorasick==2.2.0",
-    "betterproto==1.2.5",
-    "pydantic==2.12.3",
-    "pydantic-settings==2.10.1",
-    "NSKeyedUnArchiver==1.5.2",
-    "python-dateutil==2.9.0.post0",
-    "tzdata==2025.2",
+    "click >=8.1.3",
+    "rich >=12.6.0",
+    "tld >=0.12.6",
+    "requests >=2.28.1",
+    "simplejson >=3.17.6",
+    "packaging >=21.3",
+    "appdirs >=1.4.4",
+    "iOSbackup >=0.9.923",
+    "adb-shell[usb] >=0.4.3",
+    "libusb1 >=3.0.0",
+    "cryptography >=42.0.5",
+    "pyyaml >=6.0",
+    "pyahocorasick >= 2.0.0",
 ]
-requires-python = ">= 3.10"
+requires-python = ">= 3.8"

 [project.urls]
 homepage = "https://docs.mvt.re/en/latest/"
 repository = "https://github.com/mvt-project/mvt"

 [project.scripts]
-mvt-ios = "mvt.ios:cli"
-mvt-android = "mvt.android:cli"
-
-[dependency-groups]
-dev = [
-    "requests>=2.31.0",
-    "pytest>=7.4.3",
-    "pytest-cov>=4.1.0",
-    "pytest-github-actions-annotate-failures>=0.2.0",
-    "pytest-mock>=3.14.0",
-    "stix2>=3.0.1",
-    "ruff>=0.1.6",
-    "mypy>=1.7.1",
-    "betterproto[compiler]",
-]
+    mvt-ios = "mvt.ios:cli"
+    mvt-android = "mvt.android:cli"

 [build-system]
 requires = ["setuptools>=61.0"]
 build-backend = "setuptools.build_meta"

 [tool.coverage.run]
-omit = ["tests/*"]
+omit = [
+    "tests/*",
+]

 [tool.coverage.html]
-directory = "htmlcov"
+directory= "htmlcov"

 [tool.mypy]
 install_types = true
@@ -78,13 +63,15 @@ packages = "src"

 [tool.pytest.ini_options]
 addopts = "-ra -q --cov=mvt --cov-report html --junitxml=pytest.xml --cov-report=term-missing:skip-covered"
-testpaths = ["tests"]
+testpaths = [
+    "tests"
+]

-[tool.ruff]
-select = ["C90", "E", "F", "W"] # flake8 default set
+[tool.ruff.lint]
+select = ["C90", "E", "F", "W"]  # flake8 default set
 ignore = [
-    "E501", # don't enforce line length violations
-    "C901", # complex-structure
+    "E501",  # don't enforce line length violations
+    "C901",  # complex-structure

    # These were previously ignored but don't seem to be required:
    # "E265",  # no-space-after-block-comment
@@ -95,15 +82,15 @@ ignore = [
    # "E203",  # whitespace-before-punctuation
 ]

-[tool.ruff.per-file-ignores]
-"__init__.py" = ["F401"] # unused-import
+[tool.ruff.lint.per-file-ignores]
+"__init__.py" = ["F401"]  # unused-import

-[tool.ruff.mccabe]
+[tool.ruff.lint.mccabe]
 max-complexity = 10

 [tool.setuptools]
 include-package-data = true
-package-dir = { "" = "src" }
+package-dir = {"" = "src"}

 [tool.setuptools.packages.find]
 where = ["src"]
@@ -112,4 +99,4 @@ where = ["src"]
 mvt = ["ios/data/*.json"]

 [tool.setuptools.dynamic]
-version = { attr = "mvt.common.version.MVT_VERSION" }
+version = {attr = "mvt.common.version.MVT_VERSION"}
--- a/src/mvt/android/artifacts/dumpsys_adb.py
+++ b/src/mvt/android/artifacts/dumpsys_adb.py
@@ -4,14 +4,13 @@
 #   https://license.mvt.re/1.1/

 import base64
-import binascii
 import hashlib

 from .artifact import AndroidArtifact


 class DumpsysADBArtifact(AndroidArtifact):
-    multiline_fields = ["user_keys", "keystore"]
+    multiline_fields = ["user_keys"]

    def indented_dump_parser(self, dump_data):
        """
@@ -68,38 +67,14 @@ class DumpsysADBArtifact(AndroidArtifact):

        return res

-    def parse_xml(self, xml_data):
-        """
-        Parse XML data from dumpsys ADB output
-        """
-        import xml.etree.ElementTree as ET
-
-        keystore = []
-        keystore_root = ET.fromstring(xml_data)
-        for adb_key in keystore_root.findall("adbKey"):
-            key_info = self.calculate_key_info(adb_key.get("key").encode("utf-8"))
-            key_info["last_connected"] = adb_key.get("lastConnection")
-            keystore.append(key_info)
-
-        return keystore
-
    @staticmethod
    def calculate_key_info(user_key: bytes) -> str:
-        if b" " in user_key:
-            key_base64, user = user_key.split(b" ", 1)
-        else:
-            key_base64, user = user_key, b""
-
-        try:
-            key_raw = base64.b64decode(key_base64)
-            key_fingerprint = hashlib.md5(key_raw).hexdigest().upper()
-            key_fingerprint_colon = ":".join(
-                [key_fingerprint[i : i + 2] for i in range(0, len(key_fingerprint), 2)]
-            )
-        except binascii.Error:
-            # Impossible to parse base64
-            key_fingerprint_colon = ""
-
+        key_base64, user = user_key.split(b" ", 1)
+        key_raw = base64.b64decode(key_base64)
+        key_fingerprint = hashlib.md5(key_raw).hexdigest().upper()
+        key_fingerprint_colon = ":".join(
+            [key_fingerprint[i : i + 2] for i in range(0, len(key_fingerprint), 2)]
+        )
        return {
            "user": user.decode("utf-8"),
            "fingerprint": key_fingerprint_colon,
@@ -140,24 +115,8 @@ class DumpsysADBArtifact(AndroidArtifact):
        if parsed.get("debugging_manager") is None:
            self.log.error("Unable to find expected ADB entries in dumpsys output")  # noqa
            return
-
-        # Keystore can be in different levels, as the basic parser
-        # is not always consistent due to different dumpsys formats.
-        if parsed.get("keystore"):
-            keystore_data = b"\n".join(parsed["keystore"])
-        elif parsed["debugging_manager"].get("keystore"):
-            keystore_data = b"\n".join(parsed["debugging_manager"]["keystore"])
        else:
-            keystore_data = None
-
-        # Keystore is in XML format on some devices and we need to parse it
-        if keystore_data and keystore_data.startswith(b"<?xml"):
-            parsed["debugging_manager"]["keystore"] = self.parse_xml(keystore_data)
-        else:
-            # Keystore is not XML format
-            parsed["debugging_manager"]["keystore"] = keystore_data
-
-        parsed = parsed["debugging_manager"]
+            parsed = parsed["debugging_manager"]

        # Calculate key fingerprints for better readability
        key_info = []
--- a/src/mvt/android/artifacts/dumpsys_appops.py
+++ b/src/mvt/android/artifacts/dumpsys_appops.py
@@ -11,10 +11,6 @@ from mvt.common.utils import convert_datetime_to_iso
 from .artifact import AndroidArtifact


-RISKY_PERMISSIONS = ["REQUEST_INSTALL_PACKAGES"]
-RISKY_PACKAGES = ["com.android.shell"]
-
-
 class DumpsysAppopsArtifact(AndroidArtifact):
    """
    Parser for dumpsys app ops info
@@ -49,39 +45,15 @@ class DumpsysAppopsArtifact(AndroidArtifact):
                    self.detected.append(result)
                    continue

-            detected_permissions = []
            for perm in result["permissions"]:
                if (
-                    perm["name"] in RISKY_PERMISSIONS
-                    # and perm["access"] == "allow"
+                    perm["name"] == "REQUEST_INSTALL_PACKAGES"
+                    and perm["access"] == "allow"
                ):
-                    detected_permissions.append(perm)
-                    for entry in sorted(perm["entries"], key=lambda x: x["timestamp"]):
-                        self.log.warning(
-                            "Package '%s' had risky permission '%s' set to '%s' at %s",
-                            result["package_name"],
-                            perm["name"],
-                            entry["access"],
-                            entry["timestamp"],
-                        )
-
-                elif result["package_name"] in RISKY_PACKAGES:
-                    detected_permissions.append(perm)
-                    for entry in sorted(perm["entries"], key=lambda x: x["timestamp"]):
-                        self.log.warning(
-                            "Risky package '%s' had '%s' permission set to '%s' at %s",
-                            result["package_name"],
-                            perm["name"],
-                            entry["access"],
-                            entry["timestamp"],
-                        )
-
-            if detected_permissions:
-                # We clean the result to only include the risky permission, otherwise the timeline
-                # will be polluted with all the other irrelevant permissions
-                cleaned_result = result.copy()
-                cleaned_result["permissions"] = detected_permissions
-                self.detected.append(cleaned_result)
+                    self.log.info(
+                        "Package %s with REQUEST_INSTALL_PACKAGES " "permission",
+                        result["package_name"],
+                    )

    def parse(self, output: str) -> None:
        self.results: List[Dict[str, Any]] = []
@@ -149,16 +121,11 @@ class DumpsysAppopsArtifact(AndroidArtifact):
            if line.startswith("          "):
                # Permission entry like:
                # Reject: [fg-s]2021-05-19 22:02:52.054 (-314d1h25m2s33ms)
-                access_type = line.split(":")[0].strip()
-                if access_type not in ["Access", "Reject"]:
-                    # Skipping invalid access type. Some entries are not in the format we expect
-                    continue
-
                if entry:
                    perm["entries"].append(entry)
                    entry = {}

-                entry["access"] = access_type
+                entry["access"] = line.split(":")[0].strip()
                entry["type"] = line[line.find("[") + 1 : line.find("]")]

                try:
--- a/src/mvt/android/artifacts/dumpsys_packages.py
+++ b/src/mvt/android/artifacts/dumpsys_packages.py
@@ -16,7 +16,8 @@ class DumpsysPackagesArtifact(AndroidArtifact):
        for result in self.results:
            if result["package_name"] in ROOT_PACKAGES:
                self.log.warning(
-                    'Found an installed package related to rooting/jailbreaking: "%s"',
+                    "Found an installed package related to "
+                    'rooting/jailbreaking: "%s"',
                    result["package_name"],
                )
                self.detected.append(result)
--- a/src/mvt/android/artifacts/dumpsys_platform_compat.py
+++ b/src/mvt/android/artifacts/dumpsys_platform_compat.py
@@ -1,42 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 The MVT Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-from .artifact import AndroidArtifact
-
-
-class DumpsysPlatformCompatArtifact(AndroidArtifact):
-    """
-    Parser for uninstalled apps listed in platform_compat section.
-    """
-
-    def check_indicators(self) -> None:
-        if not self.indicators:
-            return
-
-        for result in self.results:
-            ioc = self.indicators.check_app_id(result["package_name"])
-            if ioc:
-                result["matched_indicator"] = ioc
-                self.detected.append(result)
-                continue
-
-    def parse(self, data: str) -> None:
-        for line in data.splitlines():
-            if not line.startswith("ChangeId(168419799; name=DOWNSCALED;"):
-                continue
-
-            if line.strip() == "":
-                break
-
-            # Look for rawOverrides field
-            if "rawOverrides={" in line:
-                # Extract the content inside the braces for rawOverrides
-                overrides_field = line.split("rawOverrides={", 1)[1].split("};", 1)[0]
-
-                for entry in overrides_field.split(", "):
-                    # Extract app name
-                    uninstall_app = entry.split("=")[0].strip()
-
-                    self.results.append({"package_name": uninstall_app})
--- a/src/mvt/android/artifacts/file_timestamps.py
+++ b/src/mvt/android/artifacts/file_timestamps.py
@@ -1,43 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 The MVT Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-from typing import Union
-
-from .artifact import AndroidArtifact
-
-
-class FileTimestampsArtifact(AndroidArtifact):
-    def serialize(self, record: dict) -> Union[dict, list]:
-        records = []
-
-        for ts in set(
-            [
-                record.get("access_time"),
-                record.get("changed_time"),
-                record.get("modified_time"),
-            ]
-        ):
-            if not ts:
-                continue
-
-            macb = ""
-            macb += "M" if ts == record.get("modified_time") else "-"
-            macb += "A" if ts == record.get("access_time") else "-"
-            macb += "C" if ts == record.get("changed_time") else "-"
-            macb += "-"
-
-            msg = record["path"]
-            if record.get("context"):
-                msg += f" ({record['context']})"
-
-            records.append(
-                {
-                    "timestamp": ts,
-                    "module": self.__class__.__name__,
-                    "event": macb,
-                    "data": msg,
-                }
-            )
-
-        return records
--- a/src/mvt/android/artifacts/getprop.py
+++ b/src/mvt/android/artifacts/getprop.py
@@ -42,17 +42,6 @@ class GetProp(AndroidArtifact):
            entry = {"name": matches[0][0], "value": matches[0][1]}
            self.results.append(entry)

-    def get_device_timezone(self) -> str:
-        """
-        Get the device timezone from the getprop results
-
-        Used in other moduels to calculate the timezone offset
-        """
-        for entry in self.results:
-            if entry["name"] == "persist.sys.timezone":
-                return entry["value"]
-        return None
-
    def check_indicators(self) -> None:
        for entry in self.results:
            if entry["name"] in INTERESTING_PROPERTIES:
--- a/src/mvt/android/artifacts/mounts.py
+++ b/src/mvt/android/artifacts/mounts.py
@@ -1,186 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 The MVT Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-from typing import Any
-
-from .artifact import AndroidArtifact
-
-SUSPICIOUS_MOUNT_POINTS = [
-    "/system",
-    "/vendor",
-    "/product",
-    "/system_ext",
-]
-
-SUSPICIOUS_OPTIONS = [
-    "rw",
-    "remount",
-    "noatime",
-    "nodiratime",
-]
-
-ALLOWLIST_NOATIME = [
-    "/system_dlkm",
-    "/system_ext",
-    "/product",
-    "/vendor",
-    "/vendor_dlkm",
-]
-
-
-class Mounts(AndroidArtifact):
-    """
-    This artifact parses mount information from /proc/mounts or similar mount data.
-    It can detect potentially suspicious mount configurations that may indicate
-    a rooted or compromised device.
-    """
-
-    def parse(self, entry: str) -> None:
-        """
-        Parse mount information from the provided entry.
-
-        Examples:
-        /dev/block/bootdevice/by-name/system /system ext4 ro,seclabel,relatime 0 0
-        /dev/block/dm-12 on / type ext4 (ro,seclabel,noatime)
-        """
-        self.results: list[dict[str, Any]] = []
-
-        for line in entry.splitlines():
-            line = line.strip()
-            if not line:
-                continue
-
-            device = None
-            mount_point = None
-            filesystem_type = None
-            mount_options = ""
-
-            if " on " in line and " type " in line:
-                try:
-                    # Format: device on mount_point type filesystem_type (options)
-                    device_part, rest = line.split(" on ", 1)
-                    device = device_part.strip()
-
-                    # Split by 'type' to get mount_point and filesystem info
-                    mount_part, fs_part = rest.split(" type ", 1)
-                    mount_point = mount_part.strip()
-
-                    # Parse filesystem and options
-                    if "(" in fs_part and fs_part.endswith(")"):
-                        # Format: filesystem_type (options)
-                        fs_and_opts = fs_part.strip()
-                        paren_idx = fs_and_opts.find("(")
-                        filesystem_type = fs_and_opts[:paren_idx].strip()
-                        mount_options = fs_and_opts[paren_idx + 1 : -1].strip()
-                    else:
-                        # No options in parentheses, just filesystem type
-                        filesystem_type = fs_part.strip()
-                        mount_options = ""
-
-                    # Skip if we don't have essential info
-                    if not device or not mount_point or not filesystem_type:
-                        continue
-
-                    # Parse options into list
-                    options_list = (
-                        [opt.strip() for opt in mount_options.split(",") if opt.strip()]
-                        if mount_options
-                        else []
-                    )
-
-                    # Check if it's a system partition
-                    is_system_partition = mount_point in SUSPICIOUS_MOUNT_POINTS or any(
-                        mount_point.startswith(sp) for sp in SUSPICIOUS_MOUNT_POINTS
-                    )
-
-                    # Check if it's mounted read-write
-                    is_read_write = "rw" in options_list
-
-                    mount_entry = {
-                        "device": device,
-                        "mount_point": mount_point,
-                        "filesystem_type": filesystem_type,
-                        "mount_options": mount_options,
-                        "options_list": options_list,
-                        "is_system_partition": is_system_partition,
-                        "is_read_write": is_read_write,
-                    }
-
-                    self.results.append(mount_entry)
-
-                except ValueError:
-                    # If parsing fails, skip this line
-                    continue
-            else:
-                # Skip lines that don't match expected format
-                continue
-
-    def check_indicators(self) -> None:
-        """
-        Check for suspicious mount configurations that may indicate root access
-        or other security concerns.
-        """
-        system_rw_mounts = []
-        suspicious_mounts = []
-
-        for mount in self.results:
-            mount_point = mount["mount_point"]
-            options = mount["options_list"]
-
-            # Check for system partitions mounted as read-write
-            if mount["is_system_partition"] and mount["is_read_write"]:
-                system_rw_mounts.append(mount)
-                if mount_point == "/system":
-                    self.log.warning(
-                        "Root detected /system partition is mounted as read-write (rw). "
-                    )
-                else:
-                    self.log.warning(
-                        "System partition %s is mounted as read-write (rw). This may indicate system modifications.",
-                        mount_point,
-                    )
-
-            # Check for other suspicious mount options
-            suspicious_opts = [opt for opt in options if opt in SUSPICIOUS_OPTIONS]
-            if suspicious_opts and mount["is_system_partition"]:
-                if (
-                    "noatime" in mount["mount_options"]
-                    and mount["mount_point"] in ALLOWLIST_NOATIME
-                ):
-                    continue
-                suspicious_mounts.append(mount)
-                self.log.warning(
-                    "Suspicious mount options found for %s: %s",
-                    mount_point,
-                    ", ".join(suspicious_opts),
-                )
-
-            # Log interesting mount information
-            if mount_point == "/data" or mount_point.startswith("/sdcard"):
-                self.log.info(
-                    "Data partition: %s mounted as %s with options: %s",
-                    mount_point,
-                    mount["filesystem_type"],
-                    mount["mount_options"],
-                )
-
-        self.log.info("Parsed %d mount entries", len(self.results))
-
-        # Check indicators if available
-        if not self.indicators:
-            return
-
-        for mount in self.results:
-            # Check if any mount points match indicators
-            ioc = self.indicators.check_file_path(mount.get("mount_point", ""))
-            if ioc:
-                mount["matched_indicator"] = ioc
-                self.detected.append(mount)
-
-            # Check device paths for indicators
-            ioc = self.indicators.check_file_path(mount.get("device", ""))
-            if ioc:
-                mount["matched_indicator"] = ioc
-                self.detected.append(mount)
--- a/src/mvt/android/artifacts/settings.py
+++ b/src/mvt/android/artifacts/settings.py
@@ -16,11 +16,6 @@ ANDROID_DANGEROUS_SETTINGS = [
        "key": "package_verifier_enable",
        "safe_value": "1",
    },
-    {
-        "description": "disabled APK package verification",
-        "key": "package_verifier_state",
-        "safe_value": "1",
-    },
    {
        "description": "disabled Google Play Protect",
        "key": "package_verifier_user_consent",
@@ -51,6 +46,11 @@ ANDROID_DANGEROUS_SETTINGS = [
        "key": "send_action_app_error",
        "safe_value": "1",
    },
+    {
+        "description": "enabled installation of non Google Play apps",
+        "key": "install_non_market_apps",
+        "safe_value": "0",
+    },
    {
        "description": "enabled accessibility services",
        "key": "accessibility_enabled",
--- a/src/mvt/android/artifacts/tombstone_crashes.py
+++ b/src/mvt/android/artifacts/tombstone_crashes.py
@@ -1,268 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 The MVT Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import datetime
-from typing import List, Optional, Union
-
-import pydantic
-import betterproto
-from dateutil import parser
-
-from mvt.common.utils import convert_datetime_to_iso
-from mvt.android.parsers.proto.tombstone import Tombstone
-from .artifact import AndroidArtifact
-
-
-TOMBSTONE_DELIMITER = "*** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***"
-
-# Map the legacy crash file keys to the new format.
-TOMBSTONE_TEXT_KEY_MAPPINGS = {
-    "Build fingerprint": "build_fingerprint",
-    "Revision": "revision",
-    "ABI": "arch",
-    "Timestamp": "timestamp",
-    "Process uptime": "process_uptime",
-    "Cmdline": "command_line",
-    "pid": "pid",
-    "tid": "tid",
-    "name": "process_name",
-    "binary_path": "binary_path",
-    "uid": "uid",
-    "signal": "signal_info",
-    "code": "code",
-    "Cause": "cause",
-}
-
-
-class SignalInfo(pydantic.BaseModel):
-    code: int
-    code_name: str
-    name: str
-    number: Optional[int] = None
-
-
-class TombstoneCrashResult(pydantic.BaseModel):
-    """
-    MVT Result model for a tombstone crash result.
-
-    Needed for validation and serialization, and consistency between text and protobuf tombstones.
-    """
-
-    file_name: str
-    file_timestamp: str  # We store the timestamp as a string to avoid timezone issues
-    build_fingerprint: str
-    revision: str
-    arch: Optional[str] = None
-    timestamp: str  # We store the timestamp as a string to avoid timezone issues
-    process_uptime: Optional[int] = None
-    command_line: Optional[List[str]] = None
-    pid: int
-    tid: int
-    process_name: Optional[str] = None
-    binary_path: Optional[str] = None
-    selinux_label: Optional[str] = None
-    uid: int
-    signal_info: SignalInfo
-    cause: Optional[str] = None
-    extra: Optional[str] = None
-
-
-class TombstoneCrashArtifact(AndroidArtifact):
-    """
-    Parser for Android tombstone crash files.
-
-    This parser can parse both text and protobuf tombstone crash files.
-    """
-
-    def serialize(self, record: dict) -> Union[dict, list]:
-        return {
-            "timestamp": record["timestamp"],
-            "module": self.__class__.__name__,
-            "event": "Tombstone",
-            "data": (
-                f"Crash in '{record['process_name']}' process running as UID '{record['uid']}' in file '{record['file_name']}' "
-                f"Crash type '{record['signal_info']['name']}' with code '{record['signal_info']['code_name']}'"
-            ),
-        }
-
-    def check_indicators(self) -> None:
-        if not self.indicators:
-            return
-
-        for result in self.results:
-            ioc = self.indicators.check_process(result["process_name"])
-            if ioc:
-                result["matched_indicator"] = ioc
-                self.detected.append(result)
-                continue
-
-            if result.get("command_line", []):
-                command_name = result.get("command_line")[0].split("/")[-1]
-                ioc = self.indicators.check_process(command_name)
-                if ioc:
-                    result["matched_indicator"] = ioc
-                    self.detected.append(result)
-                    continue
-
-            SUSPICIOUS_UIDS = [
-                0,  # root
-                1000,  # system
-                2000,  # shell
-            ]
-            if result["uid"] in SUSPICIOUS_UIDS:
-                self.log.warning(
-                    f"Potentially suspicious crash in process '{result['process_name']}' "
-                    f"running as UID '{result['uid']}' in tombstone '{result['file_name']}' at {result['timestamp']}"
-                )
-                self.detected.append(result)
-
-    def parse_protobuf(
-        self, file_name: str, file_timestamp: datetime.datetime, data: bytes
-    ) -> None:
-        """Parse Android tombstone crash files from a protobuf object."""
-        tombstone_pb = Tombstone().parse(data)
-        tombstone_dict = tombstone_pb.to_dict(
-            betterproto.Casing.SNAKE, include_default_values=True
-        )
-
-        # Add some extra metadata
-        tombstone_dict["timestamp"] = self._parse_timestamp_string(
-            tombstone_pb.timestamp
-        )
-        tombstone_dict["file_name"] = file_name
-        tombstone_dict["file_timestamp"] = convert_datetime_to_iso(file_timestamp)
-        tombstone_dict["process_name"] = self._proccess_name_from_thread(tombstone_dict)
-
-        # Confirm the tombstone is valid, and matches the output model
-        tombstone = TombstoneCrashResult.model_validate(tombstone_dict)
-        self.results.append(tombstone.model_dump())
-
-    def parse(
-        self, file_name: str, file_timestamp: datetime.datetime, content: bytes
-    ) -> None:
-        """Parse text Android tombstone crash files."""
-        tombstone_dict = {
-            "file_name": file_name,
-            "file_timestamp": convert_datetime_to_iso(file_timestamp),
-        }
-        lines = content.decode("utf-8").splitlines()
-        for line_num, line in enumerate(lines, 1):
-            if not line.strip() or TOMBSTONE_DELIMITER in line:
-                continue
-            try:
-                for key, destination_key in TOMBSTONE_TEXT_KEY_MAPPINGS.items():
-                    if self._parse_tombstone_line(
-                        line, key, destination_key, tombstone_dict
-                    ):
-                        break
-            except Exception as e:
-                raise ValueError(f"Error parsing line {line_num}: {str(e)}")
-
-        # Validate the tombstone and add it to the results
-        tombstone = TombstoneCrashResult.model_validate(tombstone_dict)
-        self.results.append(tombstone.model_dump())
-
-    def _parse_tombstone_line(
-        self, line: str, key: str, destination_key: str, tombstone: dict
-    ) -> bool:
-        if not line.startswith(f"{key}"):
-            return False
-
-        if key == "pid":
-            return self._load_pid_line(line, tombstone)
-        elif key == "signal":
-            return self._load_signal_line(line, tombstone)
-        elif key == "Timestamp":
-            return self._load_timestamp_line(line, tombstone)
-        else:
-            return self._load_key_value_line(line, key, destination_key, tombstone)
-
-    def _load_key_value_line(
-        self, line: str, key: str, destination_key: str, tombstone: dict
-    ) -> bool:
-        line_key, value = line.split(":", 1)
-        if line_key != key:
-            raise ValueError(f"Expected key {key}, got {line_key}")
-
-        value_clean = value.strip().strip("'")
-        if destination_key == "uid":
-            tombstone[destination_key] = int(value_clean)
-        elif destination_key == "process_uptime":
-            # eg. "Process uptime: 40s"
-            tombstone[destination_key] = int(value_clean.rstrip("s"))
-        elif destination_key == "command_line":
-            # XXX: Check if command line should be a single string in a list, or a list of strings.
-            tombstone[destination_key] = [value_clean]
-        else:
-            tombstone[destination_key] = value_clean
-        return True
-
-    def _load_pid_line(self, line: str, tombstone: dict) -> bool:
-        try:
-            parts = line.split(" >>> ") if " >>> " in line else line.split(">>>")
-            process_info = parts[0]
-
-            # Parse pid, tid, name from process info
-            info_parts = [p.strip() for p in process_info.split(",")]
-            for info in info_parts:
-                key, value = info.split(":", 1)
-                key = key.strip()
-                value = value.strip()
-
-                if key == "pid":
-                    tombstone["pid"] = int(value)
-                elif key == "tid":
-                    tombstone["tid"] = int(value)
-                elif key == "name":
-                    tombstone["process_name"] = value
-
-            # Extract binary path if it exists
-            if len(parts) > 1:
-                tombstone["binary_path"] = parts[1].strip().rstrip(" <")
-
-            return True
-
-        except Exception as e:
-            raise ValueError(f"Failed to parse PID line: {str(e)}")
-
-    def _load_signal_line(self, line: str, tombstone: dict) -> bool:
-        signal_part, code_part = map(str.strip, line.split(",")[:2])
-
-        def parse_part(part: str, prefix: str) -> tuple[int, str]:
-            match = part.split(prefix)[1]
-            number = int(match.split()[0])
-            name = match.split("(")[1].split(")")[0] if "(" in match else "UNKNOWN"
-            return number, name
-
-        signal_number, signal_name = parse_part(signal_part, "signal ")
-        code_number, code_name = parse_part(code_part, "code ")
-
-        tombstone["signal_info"] = {
-            "code": code_number,
-            "code_name": code_name,
-            "name": signal_name,
-            "number": signal_number,
-        }
-        return True
-
-    def _load_timestamp_line(self, line: str, tombstone: dict) -> bool:
-        timestamp = line.split(":", 1)[1].strip()
-        tombstone["timestamp"] = self._parse_timestamp_string(timestamp)
-        return True
-
-    @staticmethod
-    def _parse_timestamp_string(timestamp: str) -> str:
-        timestamp_parsed = parser.parse(timestamp)
-        # HACK: Swap the local timestamp to UTC, so keep the original time and avoid timezone conversion.
-        local_timestamp = timestamp_parsed.replace(tzinfo=datetime.timezone.utc)
-        return convert_datetime_to_iso(local_timestamp)
-
-    @staticmethod
-    def _proccess_name_from_thread(tombstone_dict: dict) -> str:
-        if tombstone_dict.get("threads"):
-            for thread in tombstone_dict["threads"].values():
-                if thread.get("id") == tombstone_dict["tid"] and thread.get("name"):
-                    return thread["name"]
-        return "Unknown"
--- a/src/mvt/android/cli.py
+++ b/src/mvt/android/cli.py
@@ -9,30 +9,28 @@ import click

 from mvt.common.cmd_check_iocs import CmdCheckIOCS
 from mvt.common.help import (
-    HELP_MSG_ANDROID_BACKUP_PASSWORD,
+    HELP_MSG_VERSION,
+    HELP_MSG_OUTPUT,
+    HELP_MSG_SERIAL,
+    HELP_MSG_DOWNLOAD_APKS,
+    HELP_MSG_DOWNLOAD_ALL_APKS,
+    HELP_MSG_VIRUS_TOTAL,
    HELP_MSG_APK_OUTPUT,
    HELP_MSG_APKS_FROM_FILE,
+    HELP_MSG_VERBOSE,
    HELP_MSG_CHECK_ADB,
-    HELP_MSG_CHECK_ANDROID_BACKUP,
-    HELP_MSG_CHECK_ANDROIDQF,
-    HELP_MSG_CHECK_BUGREPORT,
-    HELP_MSG_CHECK_IOCS,
-    HELP_MSG_DISABLE_INDICATOR_UPDATE_CHECK,
-    HELP_MSG_DISABLE_UPDATE_CHECK,
-    HELP_MSG_DOWNLOAD_ALL_APKS,
-    HELP_MSG_DOWNLOAD_APKS,
-    HELP_MSG_FAST,
-    HELP_MSG_HASHES,
    HELP_MSG_IOC,
+    HELP_MSG_FAST,
    HELP_MSG_LIST_MODULES,
    HELP_MSG_MODULE,
    HELP_MSG_NONINTERACTIVE,
-    HELP_MSG_OUTPUT,
-    HELP_MSG_SERIAL,
+    HELP_MSG_ANDROID_BACKUP_PASSWORD,
+    HELP_MSG_CHECK_BUGREPORT,
+    HELP_MSG_CHECK_ANDROID_BACKUP,
+    HELP_MSG_CHECK_ANDROIDQF,
+    HELP_MSG_HASHES,
+    HELP_MSG_CHECK_IOCS,
    HELP_MSG_STIX2,
-    HELP_MSG_VERBOSE,
-    HELP_MSG_VERSION,
-    HELP_MSG_VIRUS_TOTAL,
 )
 from mvt.common.logo import logo
 from mvt.common.updates import IndicatorsUpdates
@@ -55,37 +53,12 @@ log = logging.getLogger("mvt")
 CONTEXT_SETTINGS = dict(help_option_names=["-h", "--help"])


-def _get_disable_flags(ctx):
-    """Helper function to safely get disable flags from context."""
-    if ctx.obj is None:
-        return False, False
-    return (
-        ctx.obj.get("disable_version_check", False),
-        ctx.obj.get("disable_indicator_check", False),
-    )
-
-
 # ==============================================================================
 # Main
 # ==============================================================================
@click.group(invoke_without_command=False)
-@click.option(
-    "--disable-update-check", is_flag=True, help=HELP_MSG_DISABLE_UPDATE_CHECK
-)
-@click.option(
-    "--disable-indicator-update-check",
-    is_flag=True,
-    help=HELP_MSG_DISABLE_INDICATOR_UPDATE_CHECK,
-)
-@click.pass_context
-def cli(ctx, disable_update_check, disable_indicator_update_check):
-    ctx.ensure_object(dict)
-    ctx.obj["disable_version_check"] = disable_update_check
-    ctx.obj["disable_indicator_check"] = disable_indicator_update_check
-    logo(
-        disable_version_check=disable_update_check,
-        disable_indicator_check=disable_indicator_update_check,
-    )
+def cli():
+    logo()


 # ==============================================================================
@@ -193,19 +166,12 @@ def check_adb(
        module_name=module,
        serial=serial,
        module_options=module_options,
-        disable_version_check=_get_disable_flags(ctx)[0],
-        disable_indicator_check=_get_disable_flags(ctx)[1],
    )

    if list_modules:
        cmd.list_modules()
        return

-    log.warning(
-        "DEPRECATION: The 'check-adb' command is deprecated and may be removed in a future release. "
-        "Prefer acquiring device data using the AndroidQF project (https://github.com/mvt-project/androidqf/) and analyzing that acquisition with MVT."
-    )
-
    log.info("Checking Android device over debug bridge")

    cmd.run()
@@ -246,8 +212,6 @@ def check_bugreport(ctx, iocs, output, list_modules, module, verbose, bugreport_
        ioc_files=iocs,
        module_name=module,
        hashes=True,
-        disable_version_check=_get_disable_flags(ctx)[0],
-        disable_indicator_check=_get_disable_flags(ctx)[1],
    )

    if list_modules:
@@ -310,8 +274,6 @@ def check_backup(
            "interactive": not non_interactive,
            "backup_password": cli_load_android_backup_password(log, backup_password),
        },
-        disable_version_check=_get_disable_flags(ctx)[0],
-        disable_indicator_check=_get_disable_flags(ctx)[1],
    )

    if list_modules:
@@ -376,8 +338,6 @@ def check_androidqf(
            "interactive": not non_interactive,
            "backup_password": cli_load_android_backup_password(log, backup_password),
        },
-        disable_version_check=_get_disable_flags(ctx)[0],
-        disable_indicator_check=_get_disable_flags(ctx)[1],
    )

    if list_modules:
@@ -412,13 +372,7 @@ def check_androidqf(
@click.argument("FOLDER", type=click.Path(exists=True))
@click.pass_context
 def check_iocs(ctx, iocs, list_modules, module, folder):
-    cmd = CmdCheckIOCS(
-        target_path=folder,
-        ioc_files=iocs,
-        module_name=module,
-        disable_version_check=_get_disable_flags(ctx)[0],
-        disable_indicator_check=_get_disable_flags(ctx)[1],
-    )
+    cmd = CmdCheckIOCS(target_path=folder, ioc_files=iocs, module_name=module)
    cmd.modules = BACKUP_MODULES + ADB_MODULES + BUGREPORT_MODULES

    if list_modules:
--- a/src/mvt/android/cmd_check_adb.py
+++ b/src/mvt/android/cmd_check_adb.py
@@ -7,7 +7,6 @@ import logging
 from typing import Optional

 from mvt.common.command import Command
-from mvt.common.indicators import Indicators

 from .modules.adb import ADB_MODULES

@@ -20,28 +19,18 @@ class CmdAndroidCheckADB(Command):
        target_path: Optional[str] = None,
        results_path: Optional[str] = None,
        ioc_files: Optional[list] = None,
-        iocs: Optional[Indicators] = None,
        module_name: Optional[str] = None,
        serial: Optional[str] = None,
        module_options: Optional[dict] = None,
-        hashes: Optional[bool] = False,
-        sub_command: Optional[bool] = False,
-        disable_version_check: bool = False,
-        disable_indicator_check: bool = False,
    ) -> None:
        super().__init__(
            target_path=target_path,
            results_path=results_path,
            ioc_files=ioc_files,
-            iocs=iocs,
            module_name=module_name,
            serial=serial,
            module_options=module_options,
-            hashes=hashes,
-            sub_command=sub_command,
            log=log,
-            disable_version_check=disable_version_check,
-            disable_indicator_check=disable_indicator_check,
        )

        self.name = "check-adb"
--- a/src/mvt/android/cmd_check_androidqf.py
+++ b/src/mvt/android/cmd_check_androidqf.py
@@ -9,186 +9,59 @@ import zipfile
 from pathlib import Path
 from typing import List, Optional

-from mvt.android.cmd_check_backup import CmdAndroidCheckBackup
-from mvt.android.cmd_check_bugreport import CmdAndroidCheckBugreport
 from mvt.common.command import Command
-from mvt.common.indicators import Indicators

 from .modules.androidqf import ANDROIDQF_MODULES
-from .modules.androidqf.base import AndroidQFModule

 log = logging.getLogger(__name__)


-class NoAndroidQFTargetPath(Exception):
-    pass
-
-
-class NoAndroidQFBugReport(Exception):
-    pass
-
-
-class NoAndroidQFBackup(Exception):
-    pass
-
-
 class CmdAndroidCheckAndroidQF(Command):
    def __init__(
        self,
        target_path: Optional[str] = None,
        results_path: Optional[str] = None,
        ioc_files: Optional[list] = None,
-        iocs: Optional[Indicators] = None,
        module_name: Optional[str] = None,
        serial: Optional[str] = None,
        module_options: Optional[dict] = None,
-        hashes: Optional[bool] = False,
-        sub_command: Optional[bool] = False,
-        disable_version_check: bool = False,
-        disable_indicator_check: bool = False,
+        hashes: bool = False,
    ) -> None:
        super().__init__(
            target_path=target_path,
            results_path=results_path,
            ioc_files=ioc_files,
-            iocs=iocs,
            module_name=module_name,
            serial=serial,
            module_options=module_options,
            hashes=hashes,
-            sub_command=sub_command,
            log=log,
-            disable_version_check=disable_version_check,
-            disable_indicator_check=disable_indicator_check,
        )

        self.name = "check-androidqf"
        self.modules = ANDROIDQF_MODULES

-        self.__format: Optional[str] = None
-        self.__zip: Optional[zipfile.ZipFile] = None
-        self.__files: List[str] = []
+        self.format: Optional[str] = None
+        self.archive: Optional[zipfile.ZipFile] = None
+        self.files: List[str] = []

    def init(self):
        if os.path.isdir(self.target_path):
-            self.__format = "dir"
+            self.format = "dir"
            parent_path = Path(self.target_path).absolute().parent.as_posix()
            target_abs_path = os.path.abspath(self.target_path)
            for root, subdirs, subfiles in os.walk(target_abs_path):
                for fname in subfiles:
                    file_path = os.path.relpath(os.path.join(root, fname), parent_path)
-                    self.__files.append(file_path)
+                    self.files.append(file_path)
        elif os.path.isfile(self.target_path):
-            self.__format = "zip"
-            self.__zip = zipfile.ZipFile(self.target_path)
-            self.__files = self.__zip.namelist()
+            self.format = "zip"
+            self.archive = zipfile.ZipFile(self.target_path)
+            self.files = self.archive.namelist()

-    def module_init(self, module: AndroidQFModule) -> None:  # type: ignore[override]
-        if self.__format == "zip" and self.__zip:
-            module.from_zip(self.__zip, self.__files)
-            return
-
-        if not self.target_path:
-            raise NoAndroidQFTargetPath
-
-        parent_path = Path(self.target_path).absolute().parent.as_posix()
-        module.from_dir(parent_path, self.__files)
-
-    def load_bugreport(self) -> zipfile.ZipFile:
-        bugreport_zip_path = None
-        for file_name in self.__files:
-            if file_name.endswith("bugreport.zip"):
-                bugreport_zip_path = file_name
-                break
+    def module_init(self, module):
+        if self.format == "zip":
+            module.from_zip_file(self.archive, self.files)
        else:
-            raise NoAndroidQFBugReport
-
-        if self.__format == "zip" and self.__zip:
-            handle = self.__zip.open(bugreport_zip_path)
-            return zipfile.ZipFile(handle)
-
-        if self.__format == "dir" and self.target_path:
            parent_path = Path(self.target_path).absolute().parent.as_posix()
-            bug_report_path = os.path.join(parent_path, bugreport_zip_path)
-            return zipfile.ZipFile(bug_report_path)
-
-        raise NoAndroidQFBugReport
-
-    def load_backup(self) -> bytes:
-        backup_ab_path = None
-        for file_name in self.__files:
-            if file_name.endswith("backup.ab"):
-                backup_ab_path = file_name
-                break
-        else:
-            raise NoAndroidQFBackup
-
-        if self.__format == "zip" and self.__zip:
-            backup_file_handle = self.__zip.open(backup_ab_path)
-            return backup_file_handle.read()
-
-        if self.__format == "dir" and self.target_path:
-            parent_path = Path(self.target_path).absolute().parent.as_posix()
-            backup_path = os.path.join(parent_path, backup_ab_path)
-            with open(backup_path, "rb") as backup_file:
-                backup_ab_data = backup_file.read()
-            return backup_ab_data
-
-        raise NoAndroidQFBackup
-
-    def run_bugreport_cmd(self) -> bool:
-        try:
-            bugreport = self.load_bugreport()
-        except NoAndroidQFBugReport:
-            self.log.warning(
-                "Skipping bugreport modules as no bugreport.zip found in AndroidQF data."
-            )
-            return False
-        else:
-            cmd = CmdAndroidCheckBugreport(
-                target_path=None,
-                results_path=self.results_path,
-                ioc_files=self.ioc_files,
-                iocs=self.iocs,
-                module_options=self.module_options,
-                hashes=self.hashes,
-                sub_command=True,
-            )
-            cmd.from_zip(bugreport)
-            cmd.run()
-
-            self.detected_count += cmd.detected_count
-            self.timeline.extend(cmd.timeline)
-            self.timeline_detected.extend(cmd.timeline_detected)
-
-    def run_backup_cmd(self) -> bool:
-        try:
-            backup = self.load_backup()
-        except NoAndroidQFBackup:
-            self.log.warning(
-                "Skipping backup modules as no backup.ab found in AndroidQF data."
-            )
-            return False
-        else:
-            cmd = CmdAndroidCheckBackup(
-                target_path=None,
-                results_path=self.results_path,
-                ioc_files=self.ioc_files,
-                iocs=self.iocs,
-                module_options=self.module_options,
-                hashes=self.hashes,
-                sub_command=True,
-            )
-            cmd.from_ab(backup)
-            cmd.run()
-
-            self.detected_count += cmd.detected_count
-            self.timeline.extend(cmd.timeline)
-            self.timeline_detected.extend(cmd.timeline_detected)
-
-    def finish(self) -> None:
-        """
-        Run the bugreport and backup modules if the respective files are found in the AndroidQF data.
-        """
-        self.run_bugreport_cmd()
-        self.run_backup_cmd()
+            module.from_folder(parent_path, self.files)
--- a/src/mvt/android/cmd_check_backup.py
+++ b/src/mvt/android/cmd_check_backup.py
@@ -20,7 +20,6 @@ from mvt.android.parsers.backup import (
    parse_backup_file,
 )
 from mvt.common.command import Command
-from mvt.common.indicators import Indicators

 from .modules.backup import BACKUP_MODULES

@@ -33,28 +32,20 @@ class CmdAndroidCheckBackup(Command):
        target_path: Optional[str] = None,
        results_path: Optional[str] = None,
        ioc_files: Optional[list] = None,
-        iocs: Optional[Indicators] = None,
        module_name: Optional[str] = None,
        serial: Optional[str] = None,
        module_options: Optional[dict] = None,
-        hashes: Optional[bool] = False,
-        sub_command: Optional[bool] = False,
-        disable_version_check: bool = False,
-        disable_indicator_check: bool = False,
+        hashes: bool = False,
    ) -> None:
        super().__init__(
            target_path=target_path,
            results_path=results_path,
            ioc_files=ioc_files,
-            iocs=iocs,
            module_name=module_name,
            serial=serial,
            module_options=module_options,
            hashes=hashes,
-            sub_command=sub_command,
            log=log,
-            disable_version_check=disable_version_check,
-            disable_indicator_check=disable_indicator_check,
        )

        self.name = "check-backup"
@@ -64,34 +55,6 @@ class CmdAndroidCheckBackup(Command):
        self.backup_archive: Optional[tarfile.TarFile] = None
        self.backup_files: List[str] = []

-    def from_ab(self, ab_file_bytes: bytes) -> None:
-        self.backup_type = "ab"
-        header = parse_ab_header(ab_file_bytes)
-        if not header["backup"]:
-            log.critical("Invalid backup format, file should be in .ab format")
-            sys.exit(1)
-
-        password = None
-        if header["encryption"] != "none":
-            password = prompt_or_load_android_backup_password(log, self.module_options)
-            if not password:
-                log.critical("No backup password provided.")
-                sys.exit(1)
-        try:
-            tardata = parse_backup_file(ab_file_bytes, password=password)
-        except InvalidBackupPassword:
-            log.critical("Invalid backup password")
-            sys.exit(1)
-        except AndroidBackupParsingError as exc:
-            log.critical("Impossible to parse this backup file: %s", exc)
-            log.critical("Please use Android Backup Extractor (ABE) instead")
-            sys.exit(1)
-
-        dbytes = io.BytesIO(tardata)
-        self.backup_archive = tarfile.open(fileobj=dbytes)
-        for member in self.backup_archive:
-            self.backup_files.append(member.name)
-
    def init(self) -> None:
        if not self.target_path:
            return
@@ -99,8 +62,35 @@ class CmdAndroidCheckBackup(Command):
        if os.path.isfile(self.target_path):
            self.backup_type = "ab"
            with open(self.target_path, "rb") as handle:
-                ab_file_bytes = handle.read()
-            self.from_ab(ab_file_bytes)
+                data = handle.read()
+
+            header = parse_ab_header(data)
+            if not header["backup"]:
+                log.critical("Invalid backup format, file should be in .ab format")
+                sys.exit(1)
+
+            password = None
+            if header["encryption"] != "none":
+                password = prompt_or_load_android_backup_password(
+                    log, self.module_options
+                )
+                if not password:
+                    log.critical("No backup password provided.")
+                    sys.exit(1)
+            try:
+                tardata = parse_backup_file(data, password=password)
+            except InvalidBackupPassword:
+                log.critical("Invalid backup password")
+                sys.exit(1)
+            except AndroidBackupParsingError as exc:
+                log.critical("Impossible to parse this backup file: %s", exc)
+                log.critical("Please use Android Backup Extractor (ABE) instead")
+                sys.exit(1)
+
+            dbytes = io.BytesIO(tardata)
+            self.backup_archive = tarfile.open(fileobj=dbytes)
+            for member in self.backup_archive:
+                self.backup_files.append(member.name)

        elif os.path.isdir(self.target_path):
            self.backup_type = "folder"
@@ -119,6 +109,6 @@ class CmdAndroidCheckBackup(Command):

    def module_init(self, module: BackupExtraction) -> None:  # type: ignore[override]
        if self.backup_type == "folder":
-            module.from_dir(self.target_path, self.backup_files)
+            module.from_folder(self.target_path, self.backup_files)
        else:
            module.from_ab(self.target_path, self.backup_archive, self.backup_files)
--- a/src/mvt/android/cmd_check_bugreport.py
+++ b/src/mvt/android/cmd_check_bugreport.py
@@ -11,7 +11,6 @@ from zipfile import ZipFile

 from mvt.android.modules.bugreport.base import BugReportModule
 from mvt.common.command import Command
-from mvt.common.indicators import Indicators

 from .modules.bugreport import BUGREPORT_MODULES

@@ -24,80 +23,54 @@ class CmdAndroidCheckBugreport(Command):
        target_path: Optional[str] = None,
        results_path: Optional[str] = None,
        ioc_files: Optional[list] = None,
-        iocs: Optional[Indicators] = None,
        module_name: Optional[str] = None,
        serial: Optional[str] = None,
        module_options: Optional[dict] = None,
-        hashes: Optional[bool] = False,
-        sub_command: Optional[bool] = False,
-        disable_version_check: bool = False,
-        disable_indicator_check: bool = False,
+        hashes: bool = False,
    ) -> None:
        super().__init__(
            target_path=target_path,
            results_path=results_path,
            ioc_files=ioc_files,
-            iocs=iocs,
            module_name=module_name,
            serial=serial,
            module_options=module_options,
            hashes=hashes,
-            sub_command=sub_command,
            log=log,
-            disable_version_check=disable_version_check,
-            disable_indicator_check=disable_indicator_check,
        )

        self.name = "check-bugreport"
        self.modules = BUGREPORT_MODULES

-        self.__format: str = ""
-        self.__zip: Optional[ZipFile] = None
-        self.__files: List[str] = []
-
-    def from_dir(self, dir_path: str) -> None:
-        """This method is used to initialize the bug report analysis from an
-        uncompressed directory.
-        """
-        self.__format = "dir"
-        self.target_path = dir_path
-        parent_path = Path(dir_path).absolute().as_posix()
-        for root, _, subfiles in os.walk(os.path.abspath(dir_path)):
-            for file_name in subfiles:
-                file_path = os.path.relpath(os.path.join(root, file_name), parent_path)
-                self.__files.append(file_path)
-
-    def from_zip(self, bugreport_zip: ZipFile) -> None:
-        """This method is used to initialize the bug report analysis from a
-        compressed archive.
-        """
-        # NOTE: This will be invoked either by the CLI directly,or by the
-        # check-androidqf command. We need this because we want to support
-        # check-androidqf to analyse compressed archives itself too.
-        # So, we'll need to extract bugreport.zip from a 'androidqf.zip', and
-        # since nothing is written on disk, we need to be able to pass this
-        # command a ZipFile instance in memory.
-
-        self.__format = "zip"
-        self.__zip = bugreport_zip
-        for file_name in self.__zip.namelist():
-            self.__files.append(file_name)
+        self.bugreport_format: str = ""
+        self.bugreport_archive: Optional[ZipFile] = None
+        self.bugreport_files: List[str] = []

    def init(self) -> None:
        if not self.target_path:
            return

        if os.path.isfile(self.target_path):
-            self.from_zip(ZipFile(self.target_path))
+            self.bugreport_format = "zip"
+            self.bugreport_archive = ZipFile(self.target_path)
+            for file_name in self.bugreport_archive.namelist():
+                self.bugreport_files.append(file_name)
        elif os.path.isdir(self.target_path):
-            self.from_dir(self.target_path)
+            self.bugreport_format = "dir"
+            parent_path = Path(self.target_path).absolute().as_posix()
+            for root, _, subfiles in os.walk(os.path.abspath(self.target_path)):
+                for file_name in subfiles:
+                    file_path = os.path.relpath(
+                        os.path.join(root, file_name), parent_path
+                    )
+                    self.bugreport_files.append(file_path)

    def module_init(self, module: BugReportModule) -> None:  # type: ignore[override]
-        if self.__format == "zip":
-            module.from_zip(self.__zip, self.__files)
+        if self.bugreport_format == "zip":
+            module.from_zip(self.bugreport_archive, self.bugreport_files)
        else:
-            module.from_dir(self.target_path, self.__files)
+            module.from_folder(self.target_path, self.bugreport_files)

    def finish(self) -> None:
-        if self.__zip:
-            self.__zip.close()
+        if self.bugreport_archive:
+            self.bugreport_archive.close()
--- a/src/mvt/android/modules/adb/init.py
+++ b/src/mvt/android/modules/adb/init.py
@@ -4,7 +4,15 @@
 #   https://license.mvt.re/1.1/

 from .chrome_history import ChromeHistory
+from .dumpsys_accessibility import DumpsysAccessibility
+from .dumpsys_activities import DumpsysActivities
+from .dumpsys_appops import DumpsysAppOps
+from .dumpsys_battery_daily import DumpsysBatteryDaily
+from .dumpsys_battery_history import DumpsysBatteryHistory
+from .dumpsys_dbinfo import DumpsysDBInfo
+from .dumpsys_adbstate import DumpsysADBState
 from .dumpsys_full import DumpsysFull
+from .dumpsys_receivers import DumpsysReceivers
 from .files import Files
 from .getprop import Getprop
 from .logcat import Logcat
@@ -24,7 +32,15 @@ ADB_MODULES = [
    Getprop,
    Settings,
    SELinuxStatus,
+    DumpsysBatteryHistory,
+    DumpsysBatteryDaily,
+    DumpsysReceivers,
+    DumpsysActivities,
+    DumpsysAccessibility,
+    DumpsysDBInfo,
+    DumpsysADBState,
    DumpsysFull,
+    DumpsysAppOps,
    Packages,
    Logcat,
    RootBinaries,
--- a/src/mvt/android/modules/adb/base.py
+++ b/src/mvt/android/modules/adb/base.py
@@ -326,7 +326,8 @@ class AndroidExtraction(MVTModule):

        if not header["backup"]:
            self.log.error(
-                "Extracting SMS via Android backup failed. No valid backup data found."
+                "Extracting SMS via Android backup failed. "
+                "No valid backup data found."
            )
            return None

--- a/src/mvt/android/modules/adb/dumpsys_accessibility.py
+++ b/src/mvt/android/modules/adb/dumpsys_accessibility.py
@@ -0,0 +1,49 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2023 The MVT Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+import logging
+from typing import Optional
+
+from mvt.android.artifacts.dumpsys_accessibility import DumpsysAccessibilityArtifact
+
+from .base import AndroidExtraction
+
+
+class DumpsysAccessibility(DumpsysAccessibilityArtifact, AndroidExtraction):
+    """This module extracts stats on accessibility."""
+
+    def __init__(
+        self,
+        file_path: Optional[str] = None,
+        target_path: Optional[str] = None,
+        results_path: Optional[str] = None,
+        module_options: Optional[dict] = None,
+        log: logging.Logger = logging.getLogger(__name__),
+        results: Optional[list] = None,
+    ) -> None:
+        super().__init__(
+            file_path=file_path,
+            target_path=target_path,
+            results_path=results_path,
+            module_options=module_options,
+            log=log,
+            results=results,
+        )
+
+    def run(self) -> None:
+        self._adb_connect()
+        output = self._adb_command("dumpsys accessibility")
+        self._adb_disconnect()
+
+        self.parse(output)
+
+        for result in self.results:
+            self.log.info(
+                'Found installed accessibility service "%s"', result.get("service")
+            )
+
+        self.log.info(
+            "Identified a total of %d accessibility services", len(self.results)
+        )
--- a/src/mvt/android/modules/adb/dumpsys_activities.py
+++ b/src/mvt/android/modules/adb/dumpsys_activities.py
@@ -0,0 +1,45 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2023 The MVT Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+import logging
+from typing import Optional
+
+from mvt.android.artifacts.dumpsys_package_activities import (
+    DumpsysPackageActivitiesArtifact,
+)
+
+from .base import AndroidExtraction
+
+
+class DumpsysActivities(DumpsysPackageActivitiesArtifact, AndroidExtraction):
+    """This module extracts details on receivers for risky activities."""
+
+    def __init__(
+        self,
+        file_path: Optional[str] = None,
+        target_path: Optional[str] = None,
+        results_path: Optional[str] = None,
+        module_options: Optional[dict] = None,
+        log: logging.Logger = logging.getLogger(__name__),
+        results: Optional[list] = None,
+    ) -> None:
+        super().__init__(
+            file_path=file_path,
+            target_path=target_path,
+            results_path=results_path,
+            module_options=module_options,
+            log=log,
+            results=results,
+        )
+
+        self.results = results if results else []
+
+    def run(self) -> None:
+        self._adb_connect()
+        output = self._adb_command("dumpsys package")
+        self._adb_disconnect()
+        self.parse(output)
+
+        self.log.info("Extracted %d package activities", len(self.results))
--- a/src/mvt/android/modules/adb/dumpsys_adbstate.py
+++ b/src/mvt/android/modules/adb/dumpsys_adbstate.py
@@ -0,0 +1,45 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2023 The MVT Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+import logging
+from typing import Optional
+
+from mvt.android.artifacts.dumpsys_adb import DumpsysADBArtifact
+
+from .base import AndroidExtraction
+
+
+class DumpsysADBState(DumpsysADBArtifact, AndroidExtraction):
+    """This module extracts ADB keystore state."""
+
+    def __init__(
+        self,
+        file_path: Optional[str] = None,
+        target_path: Optional[str] = None,
+        results_path: Optional[str] = None,
+        module_options: Optional[dict] = None,
+        log: logging.Logger = logging.getLogger(__name__),
+        results: Optional[list] = None,
+    ) -> None:
+        super().__init__(
+            file_path=file_path,
+            target_path=target_path,
+            results_path=results_path,
+            module_options=module_options,
+            log=log,
+            results=results,
+        )
+
+    def run(self) -> None:
+        self._adb_connect()
+        output = self._adb_command("dumpsys adb", decode=False)
+        self._adb_disconnect()
+
+        self.parse(output)
+        if self.results:
+            self.log.info(
+                "Identified a total of %d trusted ADB keys",
+                len(self.results[0].get("user_keys", [])),
+            )
--- a/src/mvt/android/modules/adb/dumpsys_appops.py
+++ b/src/mvt/android/modules/adb/dumpsys_appops.py
@@ -0,0 +1,46 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2023 The MVT Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+import logging
+from typing import Optional
+
+from mvt.android.artifacts.dumpsys_appops import DumpsysAppopsArtifact
+
+from .base import AndroidExtraction
+
+
+class DumpsysAppOps(DumpsysAppopsArtifact, AndroidExtraction):
+    """This module extracts records from App-op Manager."""
+
+    slug = "dumpsys_appops"
+
+    def __init__(
+        self,
+        file_path: Optional[str] = None,
+        target_path: Optional[str] = None,
+        results_path: Optional[str] = None,
+        module_options: Optional[dict] = None,
+        log: logging.Logger = logging.getLogger(__name__),
+        results: Optional[list] = None,
+    ) -> None:
+        super().__init__(
+            file_path=file_path,
+            target_path=target_path,
+            results_path=results_path,
+            module_options=module_options,
+            log=log,
+            results=results,
+        )
+
+    def run(self) -> None:
+        self._adb_connect()
+        output = self._adb_command("dumpsys appops")
+        self._adb_disconnect()
+
+        self.parse(output)
+
+        self.log.info(
+            "Extracted a total of %d records from app-ops manager", len(self.results)
+        )
--- a/src/mvt/android/modules/adb/dumpsys_battery_daily.py
+++ b/src/mvt/android/modules/adb/dumpsys_battery_daily.py
@@ -0,0 +1,44 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2023 The MVT Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+import logging
+from typing import Optional
+
+from mvt.android.artifacts.dumpsys_battery_daily import DumpsysBatteryDailyArtifact
+
+from .base import AndroidExtraction
+
+
+class DumpsysBatteryDaily(DumpsysBatteryDailyArtifact, AndroidExtraction):
+    """This module extracts records from battery daily updates."""
+
+    def __init__(
+        self,
+        file_path: Optional[str] = None,
+        target_path: Optional[str] = None,
+        results_path: Optional[str] = None,
+        module_options: Optional[dict] = None,
+        log: logging.Logger = logging.getLogger(__name__),
+        results: Optional[list] = None,
+    ) -> None:
+        super().__init__(
+            file_path=file_path,
+            target_path=target_path,
+            results_path=results_path,
+            module_options=module_options,
+            log=log,
+            results=results,
+        )
+
+    def run(self) -> None:
+        self._adb_connect()
+        output = self._adb_command("dumpsys batterystats --daily")
+        self._adb_disconnect()
+
+        self.parse(output)
+
+        self.log.info(
+            "Extracted %d records from battery daily stats", len(self.results)
+        )
--- a/src/mvt/android/modules/adb/dumpsys_battery_history.py
+++ b/src/mvt/android/modules/adb/dumpsys_battery_history.py
@@ -0,0 +1,42 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2023 The MVT Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+import logging
+from typing import Optional
+
+from mvt.android.artifacts.dumpsys_battery_history import DumpsysBatteryHistoryArtifact
+
+from .base import AndroidExtraction
+
+
+class DumpsysBatteryHistory(DumpsysBatteryHistoryArtifact, AndroidExtraction):
+    """This module extracts records from battery history events."""
+
+    def __init__(
+        self,
+        file_path: Optional[str] = None,
+        target_path: Optional[str] = None,
+        results_path: Optional[str] = None,
+        module_options: Optional[dict] = None,
+        log: logging.Logger = logging.getLogger(__name__),
+        results: Optional[list] = None,
+    ) -> None:
+        super().__init__(
+            file_path=file_path,
+            target_path=target_path,
+            results_path=results_path,
+            module_options=module_options,
+            log=log,
+            results=results,
+        )
+
+    def run(self) -> None:
+        self._adb_connect()
+        output = self._adb_command("dumpsys batterystats --history")
+        self._adb_disconnect()
+
+        self.parse(output)
+
+        self.log.info("Extracted %d records from battery history", len(self.results))
--- a/src/mvt/android/modules/adb/dumpsys_dbinfo.py
+++ b/src/mvt/android/modules/adb/dumpsys_dbinfo.py
@@ -0,0 +1,47 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2023 The MVT Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+import logging
+from typing import Optional
+
+from mvt.android.artifacts.dumpsys_dbinfo import DumpsysDBInfoArtifact
+
+from .base import AndroidExtraction
+
+
+class DumpsysDBInfo(DumpsysDBInfoArtifact, AndroidExtraction):
+    """This module extracts records from battery daily updates."""
+
+    slug = "dumpsys_dbinfo"
+
+    def __init__(
+        self,
+        file_path: Optional[str] = None,
+        target_path: Optional[str] = None,
+        results_path: Optional[str] = None,
+        module_options: Optional[dict] = None,
+        log: logging.Logger = logging.getLogger(__name__),
+        results: Optional[list] = None,
+    ) -> None:
+        super().__init__(
+            file_path=file_path,
+            target_path=target_path,
+            results_path=results_path,
+            module_options=module_options,
+            log=log,
+            results=results,
+        )
+
+    def run(self) -> None:
+        self._adb_connect()
+        output = self._adb_command("dumpsys dbinfo")
+        self._adb_disconnect()
+
+        self.parse(output)
+
+        self.log.info(
+            "Extracted a total of %d records from database information",
+            len(self.results),
+        )
--- a/src/mvt/android/modules/adb/dumpsys_receivers.py
+++ b/src/mvt/android/modules/adb/dumpsys_receivers.py
@@ -0,0 +1,44 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2023 The MVT Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+import logging
+from typing import Optional
+
+from mvt.android.artifacts.dumpsys_receivers import DumpsysReceiversArtifact
+
+from .base import AndroidExtraction
+
+
+class DumpsysReceivers(DumpsysReceiversArtifact, AndroidExtraction):
+    """This module extracts details on receivers for risky activities."""
+
+    def __init__(
+        self,
+        file_path: Optional[str] = None,
+        target_path: Optional[str] = None,
+        results_path: Optional[str] = None,
+        module_options: Optional[dict] = None,
+        log: logging.Logger = logging.getLogger(__name__),
+        results: Optional[list] = None,
+    ) -> None:
+        super().__init__(
+            file_path=file_path,
+            target_path=target_path,
+            results_path=results_path,
+            module_options=module_options,
+            log=log,
+            results=results,
+        )
+
+        self.results = results if results else {}
+
+    def run(self) -> None:
+        self._adb_connect()
+
+        output = self._adb_command("dumpsys package")
+        self.parse(output)
+
+        self._adb_disconnect()
+        self.log.info("Extracted receivers for %d intents", len(self.results))
--- a/src/mvt/android/modules/adb/packages.py
+++ b/src/mvt/android/modules/adb/packages.py
@@ -75,7 +75,8 @@ class Packages(AndroidExtraction):
        for result in self.results:
            if result["package_name"] in ROOT_PACKAGES:
                self.log.warning(
-                    'Found an installed package related to rooting/jailbreaking: "%s"',
+                    "Found an installed package related to "
+                    'rooting/jailbreaking: "%s"',
                    result["package_name"],
                )
                self.detected.append(result)
@@ -107,7 +108,8 @@ class Packages(AndroidExtraction):
                    result["matched_indicator"] = ioc
                    self.detected.append(result)

-    def check_virustotal(self, packages: list) -> None:
+    @staticmethod
+    def check_virustotal(packages: list) -> None:
        hashes = []
        for package in packages:
            for file in package.get("files", []):
@@ -142,15 +144,8 @@ class Packages(AndroidExtraction):

        for package in packages:
            for file in package.get("files", []):
-                if "package_name" in package:
-                    row = [package["package_name"], file["path"]]
-                elif "name" in package:
-                    row = [package["name"], file["path"]]
-                else:
-                    self.log.error(
-                        f"Package {package} has no name or package_name. packages.json or apks.json is malformed"
-                    )
-                    continue
+                row = [package["package_name"], file["path"]]
+
                if file["sha256"] in detections:
                    detection = detections[file["sha256"]]
                    positives = detection.split("/")[0]
--- a/src/mvt/android/modules/adb/sms.py
+++ b/src/mvt/android/modules/adb/sms.py
@@ -70,7 +70,7 @@ class SMS(AndroidExtraction):
            "timestamp": record["isodate"],
            "module": self.__class__.__name__,
            "event": f"sms_{record['direction']}",
-            "data": f'{record.get("address", "unknown source")}: "{body}"',
+            "data": f"{record.get('address', 'unknown source')}: \"{body}\"",
        }

    def check_indicators(self) -> None:
--- a/src/mvt/android/modules/androidqf/init.py
+++ b/src/mvt/android/modules/androidqf/init.py
@@ -3,22 +3,36 @@
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/

-from .aqf_files import AQFFiles
-from .aqf_getprop import AQFGetProp
-from .aqf_packages import AQFPackages
-from .aqf_processes import AQFProcesses
-from .aqf_settings import AQFSettings
-from .mounts import Mounts
-from .root_binaries import RootBinaries
+from .dumpsys_accessibility import DumpsysAccessibility
+from .dumpsys_activities import DumpsysActivities
+from .dumpsys_appops import DumpsysAppops
+from .dumpsys_battery_daily import DumpsysBatteryDaily
+from .dumpsys_battery_history import DumpsysBatteryHistory
+from .dumpsys_dbinfo import DumpsysDBInfo
+from .dumpsys_packages import DumpsysPackages
+from .dumpsys_receivers import DumpsysReceivers
+from .dumpsys_adb import DumpsysADBState
+from .getprop import Getprop
+from .packages import Packages
+from .processes import Processes
+from .settings import Settings
 from .sms import SMS
+from .files import Files

 ANDROIDQF_MODULES = [
-    AQFPackages,
-    AQFProcesses,
-    AQFGetProp,
-    AQFSettings,
-    AQFFiles,
+    DumpsysActivities,
+    DumpsysReceivers,
+    DumpsysAccessibility,
+    DumpsysAppops,
+    DumpsysDBInfo,
+    DumpsysBatteryDaily,
+    DumpsysBatteryHistory,
+    DumpsysADBState,
+    Packages,
+    Processes,
+    Getprop,
+    Settings,
    SMS,
-    RootBinaries,
-    Mounts,
+    DumpsysPackages,
+    Files,
 ]
--- a/src/mvt/android/modules/androidqf/aqf_log_timestamps.py
+++ b/src/mvt/android/modules/androidqf/aqf_log_timestamps.py
@@ -1,65 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 The MVT Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import os
-import datetime
-import logging
-from typing import Optional
-
-from mvt.common.utils import convert_datetime_to_iso
-from .base import AndroidQFModule
-from mvt.android.artifacts.file_timestamps import FileTimestampsArtifact
-
-
-class AQFLogTimestamps(FileTimestampsArtifact, AndroidQFModule):
-    """This module creates timeline for log files extracted by AQF."""
-
-    slug = "aqf_log_timestamps"
-
-    def __init__(
-        self,
-        file_path: Optional[str] = None,
-        target_path: Optional[str] = None,
-        results_path: Optional[str] = None,
-        module_options: Optional[dict] = None,
-        log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None,
-    ) -> None:
-        super().__init__(
-            file_path=file_path,
-            target_path=target_path,
-            results_path=results_path,
-            module_options=module_options,
-            log=log,
-            results=results,
-        )
-
-    def _get_file_modification_time(self, file_path: str) -> dict:
-        if self.archive:
-            file_timetuple = self.archive.getinfo(file_path).date_time
-            return datetime.datetime(*file_timetuple)
-        else:
-            file_stat = os.stat(os.path.join(self.parent_path, file_path))
-            return datetime.datetime.fromtimestamp(file_stat.st_mtime)
-
-    def run(self) -> None:
-        filesystem_files = self._get_files_by_pattern("*/logs/*")
-
-        self.results = []
-        for file in filesystem_files:
-            # Only the modification time is available in the zip file metadata.
-            # The timezone is the local timezone of the machine the phone.
-            modification_time = self._get_file_modification_time(file)
-            self.results.append(
-                {
-                    "path": file,
-                    "modified_time": convert_datetime_to_iso(modification_time),
-                }
-            )
-
-        self.log.info(
-            "Extracted a total of %d filesystem timestamps from AndroidQF logs directory.",
-            len(self.results),
-        )
--- a/src/mvt/android/modules/androidqf/base.py
+++ b/src/mvt/android/modules/androidqf/base.py
@@ -37,48 +37,17 @@ class AndroidQFModule(MVTModule):
        self.files: List[str] = []
        self.archive: Optional[zipfile.ZipFile] = None

-    def from_dir(self, parent_path: str, files: List[str]) -> None:
+    def from_folder(self, parent_path: str, files: List[str]):
        self.parent_path = parent_path
        self.files = files

-    def from_zip(self, archive: zipfile.ZipFile, files: List[str]) -> None:
+    def from_zip_file(self, archive: zipfile.ZipFile, files: List[str]):
        self.archive = archive
        self.files = files

    def _get_files_by_pattern(self, pattern: str):
        return fnmatch.filter(self.files, pattern)

-    def _get_device_timezone(self):
-        """
-        Get the device timezone from the getprop.txt file.
-
-        This is needed to map local timestamps stored in some
-        Android log files to UTC/timezone-aware timestamps.
-        """
-        get_prop_files = self._get_files_by_pattern("*/getprop.txt")
-        if not get_prop_files:
-            self.log.warning(
-                "Could not find getprop.txt file. "
-                "Some timestamps and timeline data may be incorrect."
-            )
-            return None
-
-        from mvt.android.artifacts.getprop import GetProp
-
-        properties_artifact = GetProp()
-        prop_data = self._get_file_content(get_prop_files[0]).decode("utf-8")
-        properties_artifact.parse(prop_data)
-        timezone = properties_artifact.get_device_timezone()
-        if timezone:
-            self.log.debug("Identified local phone timezone: %s", timezone)
-            return timezone
-
-        self.log.warning(
-            "Could not find or determine local device timezone. "
-            "Some timestamps and timeline data may be incorrect."
-        )
-        return None
-
    def _get_file_content(self, file_path):
        if self.archive:
            handle = self.archive.open(file_path)
--- a/src/mvt/android/modules/androidqf/dumpsys_accessibility.py
+++ b/src/mvt/android/modules/androidqf/dumpsys_accessibility.py
@@ -0,0 +1,51 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2023 The MVT Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+import logging
+from typing import Optional
+
+from mvt.android.artifacts.dumpsys_accessibility import DumpsysAccessibilityArtifact
+
+from .base import AndroidQFModule
+
+
+class DumpsysAccessibility(DumpsysAccessibilityArtifact, AndroidQFModule):
+    """This module analyses dumpsys accessibility"""
+
+    def __init__(
+        self,
+        file_path: Optional[str] = None,
+        target_path: Optional[str] = None,
+        results_path: Optional[str] = None,
+        module_options: Optional[dict] = None,
+        log: logging.Logger = logging.getLogger(__name__),
+        results: Optional[list] = None,
+    ) -> None:
+        super().__init__(
+            file_path=file_path,
+            target_path=target_path,
+            results_path=results_path,
+            module_options=module_options,
+            log=log,
+            results=results,
+        )
+
+    def run(self) -> None:
+        dumpsys_file = self._get_files_by_pattern("*/dumpsys.txt")
+        if not dumpsys_file:
+            return
+
+        data = self._get_file_content(dumpsys_file[0]).decode("utf-8", errors="replace")
+        content = self.extract_dumpsys_section(data, "DUMP OF SERVICE accessibility:")
+        self.parse(content)
+
+        for result in self.results:
+            self.log.info(
+                'Found installed accessibility service "%s"', result.get("service")
+            )
+
+        self.log.info(
+            "Identified a total of %d accessibility services", len(self.results)
+        )
--- a/src/mvt/android/modules/bugreport/dumpsys_platform_compat.py
+++ b/src/mvt/android/modules/bugreport/dumpsys_platform_compat.py
@@ -6,13 +6,15 @@
 import logging
 from typing import Optional

-from mvt.android.artifacts.dumpsys_platform_compat import DumpsysPlatformCompatArtifact
+from mvt.android.artifacts.dumpsys_package_activities import (
+    DumpsysPackageActivitiesArtifact,
+)

-from mvt.android.modules.bugreport.base import BugReportModule
+from .base import AndroidQFModule


-class DumpsysPlatformCompat(DumpsysPlatformCompatArtifact, BugReportModule):
-    """This module extracts details on uninstalled apps."""
+class DumpsysActivities(DumpsysPackageActivitiesArtifact, AndroidQFModule):
+    """This module extracts details on receivers for risky activities."""

    def __init__(
        self,
@@ -32,17 +34,17 @@ class DumpsysPlatformCompat(DumpsysPlatformCompatArtifact, BugReportModule):
            results=results,
        )

+        self.results = results if results else []
+
    def run(self) -> None:
-        data = self._get_dumpstate_file()
-        if not data:
-            self.log.error(
-                "Unable to find dumpstate file. "
-                "Did you provide a valid bug report archive?"
-            )
+        dumpsys_file = self._get_files_by_pattern("*/dumpsys.txt")
+        if not dumpsys_file:
            return

-        data = data.decode("utf-8", errors="replace")
-        content = self.extract_dumpsys_section(data, "DUMP OF SERVICE platform_compat:")
+        # Get data and extract the dumpsys section
+        data = self._get_file_content(dumpsys_file[0]).decode("utf-8", errors="replace")
+        content = self.extract_dumpsys_section(data, "DUMP OF SERVICE package:")
+        # Parse it
        self.parse(content)

-        self.log.info("Found %d uninstalled apps", len(self.results))
+        self.log.info("Extracted %d package activities", len(self.results))
--- a/src/mvt/android/modules/androidqf/dumpsys_adb.py
+++ b/src/mvt/android/modules/androidqf/dumpsys_adb.py
@@ -0,0 +1,51 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2023 The MVT Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+import logging
+from typing import Optional
+
+from mvt.android.artifacts.dumpsys_adb import DumpsysADBArtifact
+
+from .base import AndroidQFModule
+
+
+class DumpsysADBState(DumpsysADBArtifact, AndroidQFModule):
+    """This module extracts ADB keystore state."""
+
+    def __init__(
+        self,
+        file_path: Optional[str] = None,
+        target_path: Optional[str] = None,
+        results_path: Optional[str] = None,
+        module_options: Optional[dict] = None,
+        log: logging.Logger = logging.getLogger(__name__),
+        results: Optional[list] = None,
+    ) -> None:
+        super().__init__(
+            file_path=file_path,
+            target_path=target_path,
+            results_path=results_path,
+            module_options=module_options,
+            log=log,
+            results=results,
+        )
+
+    def run(self) -> None:
+        dumpsys_file = self._get_files_by_pattern("*/dumpsys.txt")
+        if not dumpsys_file:
+            return
+
+        full_dumpsys = self._get_file_content(dumpsys_file[0])
+        content = self.extract_dumpsys_section(
+            full_dumpsys,
+            b"DUMP OF SERVICE adb:",
+            binary=True,
+        )
+        self.parse(content)
+        if self.results:
+            self.log.info(
+                "Identified a total of %d trusted ADB keys",
+                len(self.results[0].get("user_keys", [])),
+            )
--- a/src/mvt/android/modules/androidqf/dumpsys_appops.py
+++ b/src/mvt/android/modules/androidqf/dumpsys_appops.py
@@ -0,0 +1,46 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2023 The MVT Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+import logging
+from typing import Optional
+
+from mvt.android.artifacts.dumpsys_appops import DumpsysAppopsArtifact
+
+from .base import AndroidQFModule
+
+
+class DumpsysAppops(DumpsysAppopsArtifact, AndroidQFModule):
+    def __init__(
+        self,
+        file_path: Optional[str] = None,
+        target_path: Optional[str] = None,
+        results_path: Optional[str] = None,
+        module_options: Optional[dict] = None,
+        log: logging.Logger = logging.getLogger(__name__),
+        results: Optional[list] = None,
+    ) -> None:
+        super().__init__(
+            file_path=file_path,
+            target_path=target_path,
+            results_path=results_path,
+            module_options=module_options,
+            log=log,
+            results=results,
+        )
+
+    def run(self) -> None:
+        dumpsys_file = self._get_files_by_pattern("*/dumpsys.txt")
+        if not dumpsys_file:
+            return
+
+        # Extract section
+        data = self._get_file_content(dumpsys_file[0])
+        section = self.extract_dumpsys_section(
+            data.decode("utf-8", errors="replace"), "DUMP OF SERVICE appops:"
+        )
+
+        # Parse it
+        self.parse(section)
+        self.log.info("Identified %d applications in AppOps Manager", len(self.results))
--- a/src/mvt/android/modules/androidqf/dumpsys_battery_daily.py
+++ b/src/mvt/android/modules/androidqf/dumpsys_battery_daily.py
@@ -0,0 +1,46 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2023 The MVT Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+import logging
+from typing import Optional
+
+from mvt.android.artifacts.dumpsys_battery_daily import DumpsysBatteryDailyArtifact
+
+from .base import AndroidQFModule
+
+
+class DumpsysBatteryDaily(DumpsysBatteryDailyArtifact, AndroidQFModule):
+    def __init__(
+        self,
+        file_path: Optional[str] = None,
+        target_path: Optional[str] = None,
+        results_path: Optional[str] = None,
+        module_options: Optional[dict] = None,
+        log: logging.Logger = logging.getLogger(__name__),
+        results: Optional[list] = None,
+    ) -> None:
+        super().__init__(
+            file_path=file_path,
+            target_path=target_path,
+            results_path=results_path,
+            module_options=module_options,
+            log=log,
+            results=results,
+        )
+
+    def run(self) -> None:
+        dumpsys_file = self._get_files_by_pattern("*/dumpsys.txt")
+        if not dumpsys_file:
+            return
+
+        # Extract section
+        data = self._get_file_content(dumpsys_file[0])
+        section = self.extract_dumpsys_section(
+            data.decode("utf-8", errors="replace"), "DUMP OF SERVICE batterystats:"
+        )
+
+        # Parse it
+        self.parse(section)
+        self.log.info("Extracted a total of %d battery daily stats", len(self.results))
--- a/src/mvt/android/modules/androidqf/dumpsys_battery_history.py
+++ b/src/mvt/android/modules/androidqf/dumpsys_battery_history.py
@@ -0,0 +1,46 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2023 The MVT Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+import logging
+from typing import Optional
+
+from mvt.android.artifacts.dumpsys_battery_history import DumpsysBatteryHistoryArtifact
+
+from .base import AndroidQFModule
+
+
+class DumpsysBatteryHistory(DumpsysBatteryHistoryArtifact, AndroidQFModule):
+    def __init__(
+        self,
+        file_path: Optional[str] = None,
+        target_path: Optional[str] = None,
+        results_path: Optional[str] = None,
+        module_options: Optional[dict] = None,
+        log: logging.Logger = logging.getLogger(__name__),
+        results: Optional[list] = None,
+    ) -> None:
+        super().__init__(
+            file_path=file_path,
+            target_path=target_path,
+            results_path=results_path,
+            module_options=module_options,
+            log=log,
+            results=results,
+        )
+
+    def run(self) -> None:
+        dumpsys_file = self._get_files_by_pattern("*/dumpsys.txt")
+        if not dumpsys_file:
+            return
+
+        # Extract section
+        data = self._get_file_content(dumpsys_file[0])
+        section = self.extract_dumpsys_section(
+            data.decode("utf-8", errors="replace"), "DUMP OF SERVICE batterystats:"
+        )
+
+        # Parse it
+        self.parse(section)
+        self.log.info("Extracted a total of %d battery daily stats", len(self.results))
--- a/src/mvt/android/modules/androidqf/dumpsys_dbinfo.py
+++ b/src/mvt/android/modules/androidqf/dumpsys_dbinfo.py
@@ -0,0 +1,46 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2023 The MVT Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+import logging
+from typing import Optional
+
+from mvt.android.artifacts.dumpsys_dbinfo import DumpsysDBInfoArtifact
+
+from .base import AndroidQFModule
+
+
+class DumpsysDBInfo(DumpsysDBInfoArtifact, AndroidQFModule):
+    def __init__(
+        self,
+        file_path: Optional[str] = None,
+        target_path: Optional[str] = None,
+        results_path: Optional[str] = None,
+        module_options: Optional[dict] = None,
+        log: logging.Logger = logging.getLogger(__name__),
+        results: Optional[list] = None,
+    ) -> None:
+        super().__init__(
+            file_path=file_path,
+            target_path=target_path,
+            results_path=results_path,
+            module_options=module_options,
+            log=log,
+            results=results,
+        )
+
+    def run(self) -> None:
+        dumpsys_file = self._get_files_by_pattern("*/dumpsys.txt")
+        if not dumpsys_file:
+            return
+
+        # Extract dumpsys DBInfo section
+        data = self._get_file_content(dumpsys_file[0])
+        section = self.extract_dumpsys_section(
+            data.decode("utf-8", errors="replace"), "DUMP OF SERVICE dbinfo:"
+        )
+
+        # Parse it
+        self.parse(section)
+        self.log.info("Identified %d DB Info entries", len(self.results))
--- a/src/mvt/android/modules/androidqf/dumpsys_packages.py
+++ b/src/mvt/android/modules/androidqf/dumpsys_packages.py
@@ -0,0 +1,62 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2023 The MVT Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+import logging
+from typing import Any, Dict, List, Optional
+
+from mvt.android.artifacts.dumpsys_packages import DumpsysPackagesArtifact
+from mvt.android.modules.adb.packages import (
+    DANGEROUS_PERMISSIONS,
+    DANGEROUS_PERMISSIONS_THRESHOLD,
+)
+
+from .base import AndroidQFModule
+
+
+class DumpsysPackages(DumpsysPackagesArtifact, AndroidQFModule):
+    """This module analyse dumpsys packages"""
+
+    def __init__(
+        self,
+        file_path: Optional[str] = None,
+        target_path: Optional[str] = None,
+        results_path: Optional[str] = None,
+        module_options: Optional[dict] = None,
+        log: logging.Logger = logging.getLogger(__name__),
+        results: Optional[List[Dict[str, Any]]] = None,
+    ) -> None:
+        super().__init__(
+            file_path=file_path,
+            target_path=target_path,
+            results_path=results_path,
+            module_options=module_options,
+            log=log,
+            results=results,
+        )
+
+    def run(self) -> None:
+        dumpsys_file = self._get_files_by_pattern("*/dumpsys.txt")
+        if len(dumpsys_file) != 1:
+            self.log.info("Dumpsys file not found")
+            return
+
+        data = self._get_file_content(dumpsys_file[0]).decode("utf-8", errors="replace")
+        content = self.extract_dumpsys_section(data, "DUMP OF SERVICE package:")
+        self.parse(content)
+
+        for result in self.results:
+            dangerous_permissions_count = 0
+            for perm in result["permissions"]:
+                if perm["name"] in DANGEROUS_PERMISSIONS:
+                    dangerous_permissions_count += 1
+
+            if dangerous_permissions_count >= DANGEROUS_PERMISSIONS_THRESHOLD:
+                self.log.info(
+                    'Found package "%s" requested %d potentially dangerous permissions',
+                    result["package_name"],
+                    dangerous_permissions_count,
+                )
+
+        self.log.info("Extracted details on %d packages", len(self.results))
--- a/src/mvt/android/modules/androidqf/dumpsys_receivers.py
+++ b/src/mvt/android/modules/androidqf/dumpsys_receivers.py
@@ -0,0 +1,49 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021-2023 The MVT Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+import logging
+from typing import Any, Dict, List, Optional, Union
+
+from mvt.android.artifacts.dumpsys_receivers import DumpsysReceiversArtifact
+
+from .base import AndroidQFModule
+
+
+class DumpsysReceivers(DumpsysReceiversArtifact, AndroidQFModule):
+    """This module analyse dumpsys receivers"""
+
+    def __init__(
+        self,
+        file_path: Optional[str] = None,
+        target_path: Optional[str] = None,
+        results_path: Optional[str] = None,
+        module_options: Optional[dict] = None,
+        log: logging.Logger = logging.getLogger(__name__),
+        results: Union[List[Any], Dict[str, Any], None] = None,
+    ) -> None:
+        super().__init__(
+            file_path=file_path,
+            target_path=target_path,
+            results_path=results_path,
+            module_options=module_options,
+            log=log,
+            results=results,
+        )
+
+        self.results = results if results else {}
+
+    def run(self) -> None:
+        dumpsys_file = self._get_files_by_pattern("*/dumpsys.txt")
+        if not dumpsys_file:
+            return
+        data = self._get_file_content(dumpsys_file[0])
+
+        dumpsys_section = self.extract_dumpsys_section(
+            data.decode("utf-8", errors="replace"), "DUMP OF SERVICE package:"
+        )
+
+        self.parse(dumpsys_section)
+
+        self.log.info("Extracted receivers for %d intents", len(self.results))
--- a/src/mvt/android/modules/androidqf/aqf_files.py
+++ b/src/mvt/android/modules/androidqf/aqf_files.py
@@ -6,11 +6,6 @@
 import datetime
 import json
 import logging
-
-try:
-    import zoneinfo
-except ImportError:
-    from backports import zoneinfo
 from typing import Optional, Union

 from mvt.android.modules.androidqf.base import AndroidQFModule
@@ -21,13 +16,8 @@ SUSPICIOUS_PATHS = [
 ]


-class AQFFiles(AndroidQFModule):
-    """
-    This module analyzes the files.json dump generated by AndroidQF.
-
-    The format needs to be kept in sync with the AndroidQF module code.
-    https://github.com/mvt-project/androidqf/blob/main/android-collector/cmd/find.go#L28
-    """
+class Files(AndroidQFModule):
+    """This module analyse list of files"""

    def __init__(
        self,
@@ -116,12 +106,6 @@ class AQFFiles(AndroidQFModule):
            # TODO: adds SHA1 and MD5 when available in MVT

    def run(self) -> None:
-        if timezone := self._get_device_timezone():
-            device_timezone = zoneinfo.ZoneInfo(timezone)
-        else:
-            self.log.warning("Unable to determine device timezone, using UTC")
-            device_timezone = zoneinfo.ZoneInfo("UTC")
-
        for file in self._get_files_by_pattern("*/files.json"):
            rawdata = self._get_file_content(file).decode("utf-8", errors="ignore")
            try:
@@ -136,18 +120,11 @@ class AQFFiles(AndroidQFModule):
            for file_data in data:
                for ts in ["access_time", "changed_time", "modified_time"]:
                    if ts in file_data:
-                        utc_timestamp = datetime.datetime.fromtimestamp(
-                            file_data[ts], tz=datetime.timezone.utc
+                        file_data[ts] = convert_datetime_to_iso(
+                            datetime.datetime.fromtimestamp(
+                                file_data[ts], tz=datetime.timezone.utc
+                            )
                        )
-                        # Convert the UTC timestamp to local tiem on Android device's local timezone
-                        local_timestamp = utc_timestamp.astimezone(device_timezone)
-
-                        # HACK: We only output the UTC timestamp in convert_datetime_to_iso, we
-                        # set the timestamp timezone to UTC, to avoid the timezone conversion again.
-                        local_timestamp = local_timestamp.replace(
-                            tzinfo=datetime.timezone.utc
-                        )
-                        file_data[ts] = convert_datetime_to_iso(local_timestamp)

                self.results.append(file_data)

--- a/src/mvt/android/modules/androidqf/aqf_getprop.py
+++ b/src/mvt/android/modules/androidqf/aqf_getprop.py
@@ -11,7 +11,7 @@ from mvt.android.artifacts.getprop import GetProp as GetPropArtifact
 from .base import AndroidQFModule


-class AQFGetProp(GetPropArtifact, AndroidQFModule):
+class Getprop(GetPropArtifact, AndroidQFModule):
    """This module extracts data from get properties."""

    def __init__(
--- a/src/mvt/android/modules/androidqf/mounts.py
+++ b/src/mvt/android/modules/androidqf/mounts.py
@@ -1,74 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 The MVT Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import logging
-import json
-from typing import Optional
-
-from mvt.android.artifacts.mounts import Mounts as MountsArtifact
-
-from .base import AndroidQFModule
-
-
-class Mounts(MountsArtifact, AndroidQFModule):
-    """This module extracts and analyzes mount information from AndroidQF acquisitions."""
-
-    def __init__(
-        self,
-        file_path: Optional[str] = None,
-        target_path: Optional[str] = None,
-        results_path: Optional[str] = None,
-        module_options: Optional[dict] = None,
-        log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None,
-    ) -> None:
-        super().__init__(
-            file_path=file_path,
-            target_path=target_path,
-            results_path=results_path,
-            module_options=module_options,
-            log=log,
-            results=results,
-        )
-        self.results = []
-
-    def run(self) -> None:
-        """
-        Run the mounts analysis module.
-
-        This module looks for mount information files collected by androidqf
-        and analyzes them for suspicious configurations, particularly focusing
-        on detecting root access indicators like /system mounted as read-write.
-        """
-        mount_files = self._get_files_by_pattern("*/mounts.json")
-
-        if not mount_files:
-            self.log.info("No mount information file found")
-            return
-
-        self.log.info("Found mount information file: %s", mount_files[0])
-
-        try:
-            data = self._get_file_content(mount_files[0]).decode(
-                "utf-8", errors="replace"
-            )
-        except Exception as exc:
-            self.log.error("Failed to read mount information file: %s", exc)
-            return
-
-        # Parse the mount data
-        try:
-            json_data = json.loads(data)
-
-            if isinstance(json_data, list):
-                # AndroidQF format: array of strings like
-                # "/dev/block/dm-12 on / type ext4 (ro,seclabel,noatime)"
-                mount_content = "\n".join(json_data)
-            self.parse(mount_content)
-        except Exception as exc:
-            self.log.error("Failed to parse mount information: %s", exc)
-            return
-
-        self.log.info("Extracted a total of %d mount entries", len(self.results))
--- a/src/mvt/android/modules/androidqf/aqf_packages.py
+++ b/src/mvt/android/modules/androidqf/aqf_packages.py
@@ -19,7 +19,7 @@ from mvt.android.utils import (
 from .base import AndroidQFModule


-class AQFPackages(AndroidQFModule):
+class Packages(AndroidQFModule):
    """This module examines the installed packages in packages.json"""

    def __init__(
@@ -44,7 +44,8 @@ class AQFPackages(AndroidQFModule):
        for result in self.results:
            if result["name"] in ROOT_PACKAGES:
                self.log.warning(
-                    'Found an installed package related to rooting/jailbreaking: "%s"',
+                    "Found an installed package related to "
+                    'rooting/jailbreaking: "%s"',
                    result["name"],
                )
                self.detected.append(result)
--- a/src/mvt/android/modules/androidqf/aqf_processes.py
+++ b/src/mvt/android/modules/androidqf/aqf_processes.py
@@ -11,7 +11,7 @@ from mvt.android.artifacts.processes import Processes as ProcessesArtifact
 from .base import AndroidQFModule


-class AQFProcesses(ProcessesArtifact, AndroidQFModule):
+class Processes(ProcessesArtifact, AndroidQFModule):
    """This module analyse running processes"""

    def __init__(
--- a/src/mvt/android/modules/androidqf/root_binaries.py
+++ b/src/mvt/android/modules/androidqf/root_binaries.py
@@ -1,121 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 The MVT Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import json
-import logging
-from typing import Optional
-
-from .base import AndroidQFModule
-
-
-class RootBinaries(AndroidQFModule):
-    """This module analyzes root_binaries.json for root binaries found by androidqf."""
-
-    def __init__(
-        self,
-        file_path: Optional[str] = None,
-        target_path: Optional[str] = None,
-        results_path: Optional[str] = None,
-        module_options: Optional[dict] = None,
-        log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None,
-    ) -> None:
-        super().__init__(
-            file_path=file_path,
-            target_path=target_path,
-            results_path=results_path,
-            module_options=module_options,
-            log=log,
-            results=results,
-        )
-
-    def serialize(self, record: dict) -> dict:
-        return {
-            "timestamp": record.get("timestamp"),
-            "module": self.__class__.__name__,
-            "event": "root_binary_found",
-            "data": f"Root binary found: {record['path']} (binary: {record['binary_name']})",
-        }
-
-    def check_indicators(self) -> None:
-        """Check for indicators of device rooting."""
-        if not self.results:
-            return
-
-        # All found root binaries are considered indicators of rooting
-        for result in self.results:
-            self.log.warning(
-                'Found root binary "%s" at path "%s"',
-                result["binary_name"],
-                result["path"],
-            )
-            self.detected.append(result)
-
-        if self.detected:
-            self.log.warning(
-                "Device shows signs of rooting with %d root binaries found",
-                len(self.detected),
-            )
-
-    def run(self) -> None:
-        """Run the root binaries analysis."""
-        root_binaries_files = self._get_files_by_pattern("*/root_binaries.json")
-
-        if not root_binaries_files:
-            self.log.info("No root_binaries.json file found")
-            return
-
-        rawdata = self._get_file_content(root_binaries_files[0]).decode(
-            "utf-8", errors="ignore"
-        )
-
-        try:
-            root_binary_paths = json.loads(rawdata)
-        except json.JSONDecodeError as e:
-            self.log.error("Failed to parse root_binaries.json: %s", e)
-            return
-
-        if not isinstance(root_binary_paths, list):
-            self.log.error("Expected root_binaries.json to contain a list of paths")
-            return
-
-        # Known root binary names that might be found and their descriptions
-        # This maps the binary name to a human-readable description
-        known_root_binaries = {
-            "su": "SuperUser binary",
-            "busybox": "BusyBox utilities",
-            "supersu": "SuperSU root management",
-            "Superuser.apk": "Superuser app",
-            "KingoUser.apk": "KingRoot app",
-            "SuperSu.apk": "SuperSU app",
-            "magisk": "Magisk root framework",
-            "magiskhide": "Magisk hide utility",
-            "magiskinit": "Magisk init binary",
-            "magiskpolicy": "Magisk policy binary",
-        }
-
-        for path in root_binary_paths:
-            if not path or not isinstance(path, str):
-                continue
-
-            # Extract binary name from path
-            binary_name = path.split("/")[-1].lower()
-
-            # Check if this matches a known root binary by exact name match
-            description = "Unknown root binary"
-            for known_binary in known_root_binaries:
-                if binary_name == known_binary.lower():
-                    description = known_root_binaries[known_binary]
-                    break
-
-            result = {
-                "path": path.strip(),
-                "binary_name": binary_name,
-                "description": description,
-            }
-
-            self.results.append(result)
-
-        self.log.info("Found %d root binaries", len(self.results))
--- a/src/mvt/android/modules/androidqf/aqf_settings.py
+++ b/src/mvt/android/modules/androidqf/aqf_settings.py
@@ -11,7 +11,7 @@ from mvt.android.artifacts.settings import Settings as SettingsArtifact
 from .base import AndroidQFModule


-class AQFSettings(SettingsArtifact, AndroidQFModule):
+class Settings(SettingsArtifact, AndroidQFModule):
    """This module analyse setting files"""

    def __init__(
--- a/src/mvt/android/modules/androidqf/sms.py
+++ b/src/mvt/android/modules/androidqf/sms.py
@@ -19,13 +19,7 @@ from .base import AndroidQFModule


 class SMS(AndroidQFModule):
-    """
-    This module analyse SMS file in backup
-
-    XXX: We should also de-duplicate this AQF module, but first we
-    need to add tests for loading encrypted SMS backups through the backup
-    sub-module.
-    """
+    """This module analyse SMS file in backup"""

    def __init__(
        self,
--- a/src/mvt/android/modules/backup/base.py
+++ b/src/mvt/android/modules/backup/base.py
@@ -37,7 +37,10 @@ class BackupExtraction(MVTModule):
        self.tar = None
        self.files = []

-    def from_dir(self, backup_path: Optional[str], files: List[str]) -> None:
+    def from_folder(self, backup_path: Optional[str], files: List[str]) -> None:
+        """
+        Get all the files and list them
+        """
        self.backup_path = backup_path
        self.files = files

@@ -55,16 +58,14 @@ class BackupExtraction(MVTModule):
        return fnmatch.filter(self.files, pattern)

    def _get_file_content(self, file_path: str) -> bytes:
-        if self.tar:
+        if self.ab:
            try:
                member = self.tar.getmember(file_path)
            except KeyError:
                return None
            handle = self.tar.extractfile(member)
-        elif self.backup_path:
-            handle = open(os.path.join(self.backup_path, file_path), "rb")
        else:
-            raise ValueError("No backup path or tar file provided")
+            handle = open(os.path.join(self.backup_path, file_path), "rb")

        data = handle.read()
        handle.close()
--- a/src/mvt/android/modules/backup/helpers.py
+++ b/src/mvt/android/modules/backup/helpers.py
@@ -3,11 +3,10 @@
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/

+import os

 from rich.prompt import Prompt

-from mvt.common.config import settings
-
 MVT_ANDROID_BACKUP_PASSWORD = "MVT_ANDROID_BACKUP_PASSWORD"


@@ -17,24 +16,24 @@ def cli_load_android_backup_password(log, backup_password):

    Used in MVT CLI command parsers.
    """
-    password_from_env_or_config = settings.ANDROID_BACKUP_PASSWORD
+    password_from_env = os.environ.get(MVT_ANDROID_BACKUP_PASSWORD, None)
    if backup_password:
        log.info(
            "Your password may be visible in the process table because it "
            "was supplied on the command line!"
        )
-        if password_from_env_or_config:
+        if password_from_env:
            log.info(
                "Ignoring %s environment variable, using --backup-password argument instead",
-                "MVT_ANDROID_BACKUP_PASSWORD",
+                MVT_ANDROID_BACKUP_PASSWORD,
            )
        return backup_password
-    elif password_from_env_or_config:
+    elif password_from_env:
        log.info(
-            "Using backup password from %s environment variable or config file",
-            "MVT_ANDROID_BACKUP_PASSWORD",
+            "Using backup password from %s environment variable",
+            MVT_ANDROID_BACKUP_PASSWORD,
        )
-        return password_from_env_or_config
+        return password_from_env


 def prompt_or_load_android_backup_password(log, module_options):
--- a/src/mvt/android/modules/backup/sms.py
+++ b/src/mvt/android/modules/backup/sms.py
@@ -50,13 +50,13 @@ class SMS(BackupExtraction):
    def run(self) -> None:
        sms_path = "apps/com.android.providers.telephony/d_f/*_sms_backup"
        for file in self._get_files_by_pattern(sms_path):
-            self.log.debug("Processing SMS backup file at %s", file)
+            self.log.info("Processing SMS backup file at %s", file)
            data = self._get_file_content(file)
            self.results.extend(parse_sms_file(data))

        mms_path = "apps/com.android.providers.telephony/d_f/*_mms_backup"
        for file in self._get_files_by_pattern(mms_path):
-            self.log.debug("Processing MMS backup file at %s", file)
+            self.log.info("Processing MMS backup file at %s", file)
            data = self._get_file_content(file)
            self.results.extend(parse_sms_file(data))

--- a/src/mvt/android/modules/bugreport/init.py
+++ b/src/mvt/android/modules/bugreport/init.py
@@ -3,32 +3,26 @@
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/

-from .dumpsys_accessibility import DumpsysAccessibility
-from .dumpsys_activities import DumpsysActivities
-from .dumpsys_appops import DumpsysAppops
-from .dumpsys_battery_daily import DumpsysBatteryDaily
-from .dumpsys_battery_history import DumpsysBatteryHistory
-from .dumpsys_dbinfo import DumpsysDBInfo
-from .dumpsys_getprop import DumpsysGetProp
-from .dumpsys_packages import DumpsysPackages
-from .dumpsys_platform_compat import DumpsysPlatformCompat
-from .dumpsys_receivers import DumpsysReceivers
-from .dumpsys_adb_state import DumpsysADBState
-from .fs_timestamps import BugReportTimestamps
-from .tombstones import Tombstones
+from .accessibility import Accessibility
+from .activities import Activities
+from .appops import Appops
+from .battery_daily import BatteryDaily
+from .battery_history import BatteryHistory
+from .dbinfo import DBInfo
+from .getprop import Getprop
+from .packages import Packages
+from .receivers import Receivers
+from .adb_state import DumpsysADBState

 BUGREPORT_MODULES = [
-    DumpsysAccessibility,
-    DumpsysActivities,
-    DumpsysAppops,
-    DumpsysBatteryDaily,
-    DumpsysBatteryHistory,
-    DumpsysDBInfo,
-    DumpsysGetProp,
-    DumpsysPackages,
-    DumpsysPlatformCompat,
-    DumpsysReceivers,
+    Accessibility,
+    Activities,
+    Appops,
+    BatteryDaily,
+    BatteryHistory,
+    DBInfo,
+    Getprop,
+    Packages,
+    Receivers,
    DumpsysADBState,
-    BugReportTimestamps,
-    Tombstones,
 ]
--- a/src/mvt/android/modules/bugreport/dumpsys_accessibility.py
+++ b/src/mvt/android/modules/bugreport/dumpsys_accessibility.py
@@ -11,7 +11,7 @@ from mvt.android.artifacts.dumpsys_accessibility import DumpsysAccessibilityArti
 from .base import BugReportModule


-class DumpsysAccessibility(DumpsysAccessibilityArtifact, BugReportModule):
+class Accessibility(DumpsysAccessibilityArtifact, BugReportModule):
    """This module extracts stats on accessibility."""

    def __init__(
--- a/src/mvt/android/modules/bugreport/dumpsys_activities.py
+++ b/src/mvt/android/modules/bugreport/dumpsys_activities.py
@@ -13,7 +13,7 @@ from mvt.android.artifacts.dumpsys_package_activities import (
 from .base import BugReportModule


-class DumpsysActivities(DumpsysPackageActivitiesArtifact, BugReportModule):
+class Activities(DumpsysPackageActivitiesArtifact, BugReportModule):
    """This module extracts details on receivers for risky activities."""

    def __init__(
--- a/src/mvt/android/modules/bugreport/dumpsys_adb_state.py
+++ b/src/mvt/android/modules/bugreport/dumpsys_adb_state.py
--- a/src/mvt/android/modules/bugreport/dumpsys_appops.py
+++ b/src/mvt/android/modules/bugreport/dumpsys_appops.py
@@ -11,7 +11,7 @@ from mvt.android.artifacts.dumpsys_appops import DumpsysAppopsArtifact
 from .base import BugReportModule


-class DumpsysAppops(DumpsysAppopsArtifact, BugReportModule):
+class Appops(DumpsysAppopsArtifact, BugReportModule):
    """This module extracts information on package from App-Ops Manager."""

    def __init__(
--- a/src/mvt/android/modules/bugreport/base.py
+++ b/src/mvt/android/modules/bugreport/base.py
@@ -2,11 +2,10 @@
 # Copyright (c) 2021-2023 The MVT Authors.
 # See the file 'LICENSE' for usage and copying permissions, or find a copy at
 #   https://github.com/mvt-project/mvt/blob/main/LICENSE
-import datetime
+
 import fnmatch
 import logging
 import os
-
 from typing import List, Optional
 from zipfile import ZipFile

@@ -39,7 +38,9 @@ class BugReportModule(MVTModule):
        self.extract_files: List[str] = []
        self.zip_files: List[str] = []

-    def from_dir(self, extract_path: str, extract_files: List[str]) -> None:
+    def from_folder(
+        self, extract_path: Optional[str], extract_files: List[str]
+    ) -> None:
        self.extract_path = extract_path
        self.extract_files = extract_files

@@ -90,11 +91,3 @@ class BugReportModule(MVTModule):
                return None

            return self._get_file_content(dumpstate_logs[0])
-
-    def _get_file_modification_time(self, file_path: str) -> dict:
-        if self.zip_archive:
-            file_timetuple = self.zip_archive.getinfo(file_path).date_time
-            return datetime.datetime(*file_timetuple)
-        else:
-            file_stat = os.stat(os.path.join(self.extract_path, file_path))
-            return datetime.datetime.fromtimestamp(file_stat.st_mtime)
--- a/src/mvt/android/modules/bugreport/dumpsys_battery_daily.py
+++ b/src/mvt/android/modules/bugreport/dumpsys_battery_daily.py
@@ -11,7 +11,7 @@ from mvt.android.artifacts.dumpsys_battery_daily import DumpsysBatteryDailyArtif
 from .base import BugReportModule


-class DumpsysBatteryDaily(DumpsysBatteryDailyArtifact, BugReportModule):
+class BatteryDaily(DumpsysBatteryDailyArtifact, BugReportModule):
    """This module extracts records from battery daily updates."""

    def __init__(
--- a/src/mvt/android/modules/bugreport/dumpsys_battery_history.py
+++ b/src/mvt/android/modules/bugreport/dumpsys_battery_history.py
@@ -11,7 +11,7 @@ from mvt.android.artifacts.dumpsys_battery_history import DumpsysBatteryHistoryA
 from .base import BugReportModule


-class DumpsysBatteryHistory(DumpsysBatteryHistoryArtifact, BugReportModule):
+class BatteryHistory(DumpsysBatteryHistoryArtifact, BugReportModule):
    """This module extracts records from battery daily updates."""

    def __init__(
--- a/src/mvt/android/modules/bugreport/dumpsys_dbinfo.py
+++ b/src/mvt/android/modules/bugreport/dumpsys_dbinfo.py
@@ -11,7 +11,7 @@ from mvt.android.artifacts.dumpsys_dbinfo import DumpsysDBInfoArtifact
 from .base import BugReportModule


-class DumpsysDBInfo(DumpsysDBInfoArtifact, BugReportModule):
+class DBInfo(DumpsysDBInfoArtifact, BugReportModule):
    """This module extracts records from battery daily updates."""

    slug = "dbinfo"
--- a/src/mvt/android/modules/bugreport/fs_timestamps.py
+++ b/src/mvt/android/modules/bugreport/fs_timestamps.py
@@ -1,55 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 The MVT Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import logging
-from typing import Optional
-
-from mvt.common.utils import convert_datetime_to_iso
-from .base import BugReportModule
-from mvt.android.artifacts.file_timestamps import FileTimestampsArtifact
-
-
-class BugReportTimestamps(FileTimestampsArtifact, BugReportModule):
-    """This module extracts records from battery daily updates."""
-
-    slug = "bugreport_timestamps"
-
-    def __init__(
-        self,
-        file_path: Optional[str] = None,
-        target_path: Optional[str] = None,
-        results_path: Optional[str] = None,
-        module_options: Optional[dict] = None,
-        log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None,
-    ) -> None:
-        super().__init__(
-            file_path=file_path,
-            target_path=target_path,
-            results_path=results_path,
-            module_options=module_options,
-            log=log,
-            results=results,
-        )
-
-    def run(self) -> None:
-        filesystem_files = self._get_files_by_pattern("FS/*")
-
-        self.results = []
-        for file in filesystem_files:
-            # Only the modification time is available in the zip file metadata.
-            # The timezone is the local timezone of the machine the phone.
-            modification_time = self._get_file_modification_time(file)
-            self.results.append(
-                {
-                    "path": file,
-                    "modified_time": convert_datetime_to_iso(modification_time),
-                }
-            )
-
-        self.log.info(
-            "Extracted a total of %d filesystem timestamps from bugreport.",
-            len(self.results),
-        )
--- a/src/mvt/android/modules/bugreport/dumpsys_getprop.py
+++ b/src/mvt/android/modules/bugreport/dumpsys_getprop.py
@@ -11,7 +11,7 @@ from mvt.android.artifacts.getprop import GetProp as GetPropArtifact
 from .base import BugReportModule


-class DumpsysGetProp(GetPropArtifact, BugReportModule):
+class Getprop(GetPropArtifact, BugReportModule):
    """This module extracts device properties from getprop command."""

    def __init__(
--- a/src/mvt/android/modules/bugreport/dumpsys_packages.py
+++ b/src/mvt/android/modules/bugreport/dumpsys_packages.py
@@ -12,7 +12,7 @@ from mvt.android.utils import DANGEROUS_PERMISSIONS, DANGEROUS_PERMISSIONS_THRES
 from .base import BugReportModule


-class DumpsysPackages(DumpsysPackagesArtifact, BugReportModule):
+class Packages(DumpsysPackagesArtifact, BugReportModule):
    """This module extracts details on receivers for risky activities."""

    def __init__(
--- a/src/mvt/android/modules/bugreport/dumpsys_receivers.py
+++ b/src/mvt/android/modules/bugreport/dumpsys_receivers.py
@@ -11,7 +11,7 @@ from mvt.android.artifacts.dumpsys_receivers import DumpsysReceiversArtifact
 from .base import BugReportModule


-class DumpsysReceivers(DumpsysReceiversArtifact, BugReportModule):
+class Receivers(DumpsysReceiversArtifact, BugReportModule):
    """This module extracts details on receivers for risky activities."""

    def __init__(
@@ -34,20 +34,6 @@ class DumpsysReceivers(DumpsysReceiversArtifact, BugReportModule):

        self.results = results if results else {}

-    def check_indicators(self) -> None:
-        for result in self.results:
-            if self.indicators:
-                receiver_name = self.results[result][0]["receiver"]
-
-                # return IoC if the stix2 process name a substring of the receiver name
-                ioc = self.indicators.check_receiver_prefix(receiver_name)
-                if ioc:
-                    self.results[result][0]["matched_indicator"] = ioc
-                    self.detected.append(result)
-                    continue
-
-
-
    def run(self) -> None:
        content = self._get_dumpstate_file()
        if not content:
--- a/src/mvt/android/modules/bugreport/tombstones.py
+++ b/src/mvt/android/modules/bugreport/tombstones.py
@@ -1,64 +0,0 @@
-# Mobile Verification Toolkit (MVT)
-# Copyright (c) 2021-2023 The MVT Authors.
-# Use of this software is governed by the MVT License 1.1 that can be found at
-#   https://license.mvt.re/1.1/
-
-import logging
-from typing import Optional
-
-from mvt.android.artifacts.tombstone_crashes import TombstoneCrashArtifact
-from .base import BugReportModule
-
-
-class Tombstones(TombstoneCrashArtifact, BugReportModule):
-    """This module extracts records from battery daily updates."""
-
-    slug = "tombstones"
-
-    def __init__(
-        self,
-        file_path: Optional[str] = None,
-        target_path: Optional[str] = None,
-        results_path: Optional[str] = None,
-        module_options: Optional[dict] = None,
-        log: logging.Logger = logging.getLogger(__name__),
-        results: Optional[list] = None,
-    ) -> None:
-        super().__init__(
-            file_path=file_path,
-            target_path=target_path,
-            results_path=results_path,
-            module_options=module_options,
-            log=log,
-            results=results,
-        )
-
-    def run(self) -> None:
-        tombstone_files = self._get_files_by_pattern("*/tombstone_*")
-        if not tombstone_files:
-            self.log.error(
-                "Unable to find any tombstone files. "
-                "Did you provide a valid bugreport archive?"
-            )
-            return
-
-        for tombstone_file in sorted(tombstone_files):
-            tombstone_filename = tombstone_file.split("/")[-1]
-            modification_time = self._get_file_modification_time(tombstone_file)
-            tombstone_data = self._get_file_content(tombstone_file)
-
-            try:
-                if tombstone_file.endswith(".pb"):
-                    self.parse_protobuf(
-                        tombstone_filename, modification_time, tombstone_data
-                    )
-                else:
-                    self.parse(tombstone_filename, modification_time, tombstone_data)
-            except ValueError as e:
-                # Catch any exceptions raised during parsing or validation.
-                self.log.error(f"Error parsing tombstone file {tombstone_file}: {e}")
-
-        self.log.info(
-            "Extracted a total of %d tombstone files",
-            len(self.results),
-        )
--- a/src/mvt/android/parsers/backup.py
+++ b/src/mvt/android/parsers/backup.py
@@ -231,7 +231,6 @@ def parse_sms_file(data):
            entry.pop("mms_body")

        body = entry.get("body", None)
-        message_links = None
        if body:
            message_links = check_for_links(entry["body"])

--- a/src/mvt/android/parsers/proto/init.py
+++ b/src/mvt/android/parsers/proto/init.py
--- a/src/mvt/android/parsers/proto/tombstone.proto
+++ b/src/mvt/android/parsers/proto/tombstone.proto
@@ -1,195 +0,0 @@
-// tombstone.proto file from Android source
-// Src: https://android.googlesource.com/platform/system/core/+/refs/heads/main/debuggerd/proto/tombstone.proto
-//
-// Protobuf definition for Android tombstones.
-//
-// An app can get hold of these for any `REASON_CRASH_NATIVE` instance of
-// `android.app.ApplicationExitInfo`.
-//
-// https://developer.android.com/reference/android/app/ApplicationExitInfo#getTraceInputStream()
-//
-syntax = "proto3";
-option java_package = "com.android.server.os";
-option java_outer_classname = "TombstoneProtos";
-// NOTE TO OEMS:
-// If you add custom fields to this proto, do not use numbers in the reserved range.
-message CrashDetail {
-  bytes name = 1;
-  bytes data = 2;
-  reserved 3 to 999;
-}
-message StackHistoryBufferEntry {
-  BacktraceFrame addr = 1;
-  uint64 fp = 2;
-  uint64 tag = 3;
-  reserved 4 to 999;
-}
-message StackHistoryBuffer {
-  uint64 tid = 1;
-  repeated StackHistoryBufferEntry entries = 2;
-  reserved 3 to 999;
-}
-message Tombstone {
-  Architecture arch = 1;
-  Architecture guest_arch = 24;
-  string build_fingerprint = 2;
-  string revision = 3;
-  string timestamp = 4;
-  uint32 pid = 5;
-  uint32 tid = 6;
-  uint32 uid = 7;
-  string selinux_label = 8;
-  repeated string command_line = 9;
-  // Process uptime in seconds.
-  uint32 process_uptime = 20;
-  Signal signal_info = 10;
-  string abort_message = 14;
-  repeated CrashDetail crash_details = 21;
-  repeated Cause causes = 15;
-  map<uint32, Thread> threads = 16;
-  map<uint32, Thread> guest_threads = 25;
-  repeated MemoryMapping memory_mappings = 17;
-  repeated LogBuffer log_buffers = 18;
-  repeated FD open_fds = 19;
-  uint32 page_size = 22;
-  bool has_been_16kb_mode = 23;
-  StackHistoryBuffer stack_history_buffer = 26;
-  reserved 27 to 999;
-}
-enum Architecture {
-  ARM32 = 0;
-  ARM64 = 1;
-  X86 = 2;
-  X86_64 = 3;
-  RISCV64 = 4;
-  NONE = 5;
-  reserved 6 to 999;
-}
-message Signal {
-  int32 number = 1;
-  string name = 2;
-  int32 code = 3;
-  string code_name = 4;
-  bool has_sender = 5;
-  int32 sender_uid = 6;
-  int32 sender_pid = 7;
-  bool has_fault_address = 8;
-  uint64 fault_address = 9;
-  // Note, may or may not contain the dump of the actual memory contents. Currently, on arm64, we
-  // only include metadata, and not the contents.
-  MemoryDump fault_adjacent_metadata = 10;
-  reserved 11 to 999;
-}
-message HeapObject {
-  uint64 address = 1;
-  uint64 size = 2;
-  uint64 allocation_tid = 3;
-  repeated BacktraceFrame allocation_backtrace = 4;
-  uint64 deallocation_tid = 5;
-  repeated BacktraceFrame deallocation_backtrace = 6;
-}
-message MemoryError {
-  enum Tool {
-    GWP_ASAN = 0;
-    SCUDO = 1;
-    reserved 2 to 999;
-  }
-  Tool tool = 1;
-  enum Type {
-    UNKNOWN = 0;
-    USE_AFTER_FREE = 1;
-    DOUBLE_FREE = 2;
-    INVALID_FREE = 3;
-    BUFFER_OVERFLOW = 4;
-    BUFFER_UNDERFLOW = 5;
-    reserved 6 to 999;
-  }
-  Type type = 2;
-  oneof location {
-    HeapObject heap = 3;
-  }
-  reserved 4 to 999;
-}
-message Cause {
-  string human_readable = 1;
-  oneof details {
-    MemoryError memory_error = 2;
-  }
-  reserved 3 to 999;
-}
-message Register {
-  string name = 1;
-  uint64 u64 = 2;
-  reserved 3 to 999;
-}
-message Thread {
-  int32 id = 1;
-  string name = 2;
-  repeated Register registers = 3;
-  repeated string backtrace_note = 7;
-  repeated string unreadable_elf_files = 9;
-  repeated BacktraceFrame current_backtrace = 4;
-  repeated MemoryDump memory_dump = 5;
-  int64 tagged_addr_ctrl = 6;
-  int64 pac_enabled_keys = 8;
-  reserved 10 to 999;
-}
-message BacktraceFrame {
-  uint64 rel_pc = 1;
-  uint64 pc = 2;
-  uint64 sp = 3;
-  string function_name = 4;
-  uint64 function_offset = 5;
-  string file_name = 6;
-  uint64 file_map_offset = 7;
-  string build_id = 8;
-  reserved 9 to 999;
-}
-message ArmMTEMetadata {
-  // One memory tag per granule (e.g. every 16 bytes) of regular memory.
-  bytes memory_tags = 1;
-  reserved 2 to 999;
-}
-message MemoryDump {
-  string register_name = 1;
-  string mapping_name = 2;
-  uint64 begin_address = 3;
-  bytes memory = 4;
-  oneof metadata {
-    ArmMTEMetadata arm_mte_metadata = 6;
-  }
-  reserved 5, 7 to 999;
-}
-message MemoryMapping {
-  uint64 begin_address = 1;
-  uint64 end_address = 2;
-  uint64 offset = 3;
-  bool read = 4;
-  bool write = 5;
-  bool execute = 6;
-  string mapping_name = 7;
-  string build_id = 8;
-  uint64 load_bias = 9;
-  reserved 10 to 999;
-}
-message FD {
-  int32 fd = 1;
-  string path = 2;
-  string owner = 3;
-  uint64 tag = 4;
-  reserved 5 to 999;
-}
-message LogBuffer {
-  string name = 1;
-  repeated LogMessage logs = 2;
-  reserved 3 to 999;
-}
-message LogMessage {
-  string timestamp = 1;
-  uint32 pid = 2;
-  uint32 tid = 3;
-  uint32 priority = 4;
-  string tag = 5;
-  string message = 6;
-  reserved 7 to 999;
-}
--- a/src/mvt/android/parsers/proto/tombstone.py
+++ b/src/mvt/android/parsers/proto/tombstone.py
@@ -1,208 +0,0 @@
-# Generated by the protocol buffer compiler.  DO NOT EDIT!
-# sources: tombstone.proto
-# plugin: python-betterproto
-from dataclasses import dataclass
-from typing import Dict, List
-
-import betterproto
-
-
-class Architecture(betterproto.Enum):
-    ARM32 = 0
-    ARM64 = 1
-    X86 = 2
-    X86_64 = 3
-    RISCV64 = 4
-    NONE = 5
-
-
-class MemoryErrorTool(betterproto.Enum):
-    GWP_ASAN = 0
-    SCUDO = 1
-
-
-class MemoryErrorType(betterproto.Enum):
-    UNKNOWN = 0
-    USE_AFTER_FREE = 1
-    DOUBLE_FREE = 2
-    INVALID_FREE = 3
-    BUFFER_OVERFLOW = 4
-    BUFFER_UNDERFLOW = 5
-
-
-@dataclass
-class CrashDetail(betterproto.Message):
-    """
-    NOTE TO OEMS: If you add custom fields to this proto, do not use numbers in
-    the reserved range.
-    """
-
-    name: bytes = betterproto.bytes_field(1)
-    data: bytes = betterproto.bytes_field(2)
-
-
-@dataclass
-class StackHistoryBufferEntry(betterproto.Message):
-    addr: "BacktraceFrame" = betterproto.message_field(1)
-    fp: int = betterproto.uint64_field(2)
-    tag: int = betterproto.uint64_field(3)
-
-
-@dataclass
-class StackHistoryBuffer(betterproto.Message):
-    tid: int = betterproto.uint64_field(1)
-    entries: List["StackHistoryBufferEntry"] = betterproto.message_field(2)
-
-
-@dataclass
-class Tombstone(betterproto.Message):
-    arch: "Architecture" = betterproto.enum_field(1)
-    guest_arch: "Architecture" = betterproto.enum_field(24)
-    build_fingerprint: str = betterproto.string_field(2)
-    revision: str = betterproto.string_field(3)
-    timestamp: str = betterproto.string_field(4)
-    pid: int = betterproto.uint32_field(5)
-    tid: int = betterproto.uint32_field(6)
-    uid: int = betterproto.uint32_field(7)
-    selinux_label: str = betterproto.string_field(8)
-    command_line: List[str] = betterproto.string_field(9)
-    # Process uptime in seconds.
-    process_uptime: int = betterproto.uint32_field(20)
-    signal_info: "Signal" = betterproto.message_field(10)
-    abort_message: str = betterproto.string_field(14)
-    crash_details: List["CrashDetail"] = betterproto.message_field(21)
-    causes: List["Cause"] = betterproto.message_field(15)
-    threads: Dict[int, "Thread"] = betterproto.map_field(
-        16, betterproto.TYPE_UINT32, betterproto.TYPE_MESSAGE
-    )
-    guest_threads: Dict[int, "Thread"] = betterproto.map_field(
-        25, betterproto.TYPE_UINT32, betterproto.TYPE_MESSAGE
-    )
-    memory_mappings: List["MemoryMapping"] = betterproto.message_field(17)
-    log_buffers: List["LogBuffer"] = betterproto.message_field(18)
-    open_fds: List["FD"] = betterproto.message_field(19)
-    page_size: int = betterproto.uint32_field(22)
-    has_been_16kb_mode: bool = betterproto.bool_field(23)
-    stack_history_buffer: "StackHistoryBuffer" = betterproto.message_field(26)
-
-
-@dataclass
-class Signal(betterproto.Message):
-    number: int = betterproto.int32_field(1)
-    name: str = betterproto.string_field(2)
-    code: int = betterproto.int32_field(3)
-    code_name: str = betterproto.string_field(4)
-    has_sender: bool = betterproto.bool_field(5)
-    sender_uid: int = betterproto.int32_field(6)
-    sender_pid: int = betterproto.int32_field(7)
-    has_fault_address: bool = betterproto.bool_field(8)
-    fault_address: int = betterproto.uint64_field(9)
-    # Note, may or may not contain the dump of the actual memory contents.
-    # Currently, on arm64, we only include metadata, and not the contents.
-    fault_adjacent_metadata: "MemoryDump" = betterproto.message_field(10)
-
-
-@dataclass
-class HeapObject(betterproto.Message):
-    address: int = betterproto.uint64_field(1)
-    size: int = betterproto.uint64_field(2)
-    allocation_tid: int = betterproto.uint64_field(3)
-    allocation_backtrace: List["BacktraceFrame"] = betterproto.message_field(4)
-    deallocation_tid: int = betterproto.uint64_field(5)
-    deallocation_backtrace: List["BacktraceFrame"] = betterproto.message_field(6)
-
-
-@dataclass
-class MemoryError(betterproto.Message):
-    tool: "MemoryErrorTool" = betterproto.enum_field(1)
-    type: "MemoryErrorType" = betterproto.enum_field(2)
-    heap: "HeapObject" = betterproto.message_field(3, group="location")
-
-
-@dataclass
-class Cause(betterproto.Message):
-    human_readable: str = betterproto.string_field(1)
-    memory_error: "MemoryError" = betterproto.message_field(2, group="details")
-
-
-@dataclass
-class Register(betterproto.Message):
-    name: str = betterproto.string_field(1)
-    u64: int = betterproto.uint64_field(2)
-
-
-@dataclass
-class Thread(betterproto.Message):
-    id: int = betterproto.int32_field(1)
-    name: str = betterproto.string_field(2)
-    registers: List["Register"] = betterproto.message_field(3)
-    backtrace_note: List[str] = betterproto.string_field(7)
-    unreadable_elf_files: List[str] = betterproto.string_field(9)
-    current_backtrace: List["BacktraceFrame"] = betterproto.message_field(4)
-    memory_dump: List["MemoryDump"] = betterproto.message_field(5)
-    tagged_addr_ctrl: int = betterproto.int64_field(6)
-    pac_enabled_keys: int = betterproto.int64_field(8)
-
-
-@dataclass
-class BacktraceFrame(betterproto.Message):
-    rel_pc: int = betterproto.uint64_field(1)
-    pc: int = betterproto.uint64_field(2)
-    sp: int = betterproto.uint64_field(3)
-    function_name: str = betterproto.string_field(4)
-    function_offset: int = betterproto.uint64_field(5)
-    file_name: str = betterproto.string_field(6)
-    file_map_offset: int = betterproto.uint64_field(7)
-    build_id: str = betterproto.string_field(8)
-
-
-@dataclass
-class ArmMTEMetadata(betterproto.Message):
-    # One memory tag per granule (e.g. every 16 bytes) of regular memory.
-    memory_tags: bytes = betterproto.bytes_field(1)
-
-
-@dataclass
-class MemoryDump(betterproto.Message):
-    register_name: str = betterproto.string_field(1)
-    mapping_name: str = betterproto.string_field(2)
-    begin_address: int = betterproto.uint64_field(3)
-    memory: bytes = betterproto.bytes_field(4)
-    arm_mte_metadata: "ArmMTEMetadata" = betterproto.message_field(6, group="metadata")
-
-
-@dataclass
-class MemoryMapping(betterproto.Message):
-    begin_address: int = betterproto.uint64_field(1)
-    end_address: int = betterproto.uint64_field(2)
-    offset: int = betterproto.uint64_field(3)
-    read: bool = betterproto.bool_field(4)
-    write: bool = betterproto.bool_field(5)
-    execute: bool = betterproto.bool_field(6)
-    mapping_name: str = betterproto.string_field(7)
-    build_id: str = betterproto.string_field(8)
-    load_bias: int = betterproto.uint64_field(9)
-
-
-@dataclass
-class FD(betterproto.Message):
-    fd: int = betterproto.int32_field(1)
-    path: str = betterproto.string_field(2)
-    owner: str = betterproto.string_field(3)
-    tag: int = betterproto.uint64_field(4)
-
-
-@dataclass
-class LogBuffer(betterproto.Message):
-    name: str = betterproto.string_field(1)
-    logs: List["LogMessage"] = betterproto.message_field(2)
-
-
-@dataclass
-class LogMessage(betterproto.Message):
-    timestamp: str = betterproto.string_field(1)
-    pid: int = betterproto.uint32_field(2)
-    tid: int = betterproto.uint32_field(3)
-    priority: int = betterproto.uint32_field(4)
-    tag: str = betterproto.string_field(5)
-    message: str = betterproto.string_field(6)
--- a/src/mvt/common/cmd_check_iocs.py
+++ b/src/mvt/common/cmd_check_iocs.py
@@ -22,10 +22,6 @@ class CmdCheckIOCS(Command):
        module_name: Optional[str] = None,
        serial: Optional[str] = None,
        module_options: Optional[dict] = None,
-        hashes: Optional[bool] = False,
-        sub_command: Optional[bool] = False,
-        disable_version_check: bool = False,
-        disable_indicator_check: bool = False,
    ) -> None:
        super().__init__(
            target_path=target_path,
@@ -34,11 +30,7 @@ class CmdCheckIOCS(Command):
            module_name=module_name,
            serial=serial,
            module_options=module_options,
-            hashes=hashes,
-            sub_command=sub_command,
            log=log,
-            disable_version_check=disable_version_check,
-            disable_indicator_check=disable_indicator_check,
        )

        self.name = "check-iocs"
@@ -73,10 +65,6 @@ class CmdCheckIOCS(Command):
                m = iocs_module.from_json(
                    file_path, log=logging.getLogger(iocs_module.__module__)
                )
-                if not m:
-                    log.warning("No result from this module, skipping it")
-                    continue
-
                if self.iocs.total_ioc_count > 0:
                    m.indicators = self.iocs
                    m.indicators.log = m.log
--- a/src/mvt/common/command.py
+++ b/src/mvt/common/command.py
@@ -17,7 +17,6 @@ from mvt.common.utils import (
    generate_hashes_from_path,
    get_sha256_from_file_path,
 )
-from mvt.common.config import settings
 from mvt.common.version import MVT_VERSION


@@ -27,15 +26,11 @@ class Command:
        target_path: Optional[str] = None,
        results_path: Optional[str] = None,
        ioc_files: Optional[list] = None,
-        iocs: Optional[Indicators] = None,
        module_name: Optional[str] = None,
        serial: Optional[str] = None,
        module_options: Optional[dict] = None,
-        hashes: Optional[bool] = False,
-        sub_command: Optional[bool] = False,
+        hashes: bool = False,
        log: logging.Logger = logging.getLogger(__name__),
-        disable_version_check: bool = False,
-        disable_indicator_check: bool = False,
    ) -> None:
        self.name = ""
        self.modules = []
@@ -46,9 +41,6 @@ class Command:
        self.module_name = module_name
        self.serial = serial
        self.log = log
-        self.sub_command = sub_command
-        self.disable_version_check = disable_version_check
-        self.disable_indicator_check = disable_indicator_check

        # This dictionary can contain options that will be passed down from
        # the Command to all modules. This can for example be used to pass
@@ -67,12 +59,8 @@ class Command:
        # Load IOCs
        self._create_storage()
        self._setup_logging()
-
-        if iocs is not None:
-            self.iocs = iocs
-        else:
-            self.iocs = Indicators(self.log)
-            self.iocs.load_indicators_files(self.ioc_files)
+        self.iocs = Indicators(log=log)
+        self.iocs.load_indicators_files(self.ioc_files)

    def _create_storage(self) -> None:
        if self.results_path and not os.path.exists(self.results_path):
@@ -93,7 +81,7 @@ class Command:
            os.path.join(self.results_path, "command.log")
        )
        formatter = logging.Formatter(
-            "%(asctime)s - %(name)s - %(levelname)s - %(message)s"
+            "%(asctime)s - %(name)s - " "%(levelname)s - %(message)s"
        )
        file_handler.setLevel(logging.DEBUG)
        file_handler.setFormatter(formatter)
@@ -112,25 +100,15 @@ class Command:
        if not self.results_path:
            return

-        # We use local timestamps in the timeline on Android as many
-        # logs do not contain timezone information.
-        if type(self).__name__.startswith("CmdAndroid"):
-            is_utc = False
-        else:
-            is_utc = True
-
        if len(self.timeline) > 0:
            save_timeline(
-                self.timeline,
-                os.path.join(self.results_path, "timeline.csv"),
-                is_utc=is_utc,
+                self.timeline, os.path.join(self.results_path, "timeline.csv")
            )

        if len(self.timeline_detected) > 0:
            save_timeline(
                self.timeline_detected,
                os.path.join(self.results_path, "timeline_detected.csv"),
-                is_utc=is_utc,
            )

    def _store_info(self) -> None:
@@ -154,7 +132,7 @@ class Command:
            if ioc_file_path and ioc_file_path not in info["ioc_files"]:
                info["ioc_files"].append(ioc_file_path)

-        if self.target_path and (settings.HASH_FILES or self.hashes):
+        if self.target_path and (os.environ.get("MVT_HASH_FILES") or self.hashes):
            self.generate_hashes()

        info["hashes"] = self.hash_values
@@ -163,7 +141,7 @@ class Command:
        with open(info_path, "w+", encoding="utf-8") as handle:
            json.dump(info, handle, indent=4)

-        if self.target_path and (settings.HASH_FILES or self.hashes):
+        if self.target_path and (os.environ.get("MVT_HASH_FILES") or self.hashes):
            info_hash = get_sha256_from_file_path(info_path)
            self.log.info('Reference hash of the info.json file: "%s"', info_hash)

@@ -258,10 +236,6 @@ class Command:
        except NotImplementedError:
            pass

-        # We only store the timeline from the parent/main command
-        if self.sub_command:
-            return
-
        self._store_timeline()
        self._store_info()

--- a/src/mvt/common/config.py
+++ b/src/mvt/common/config.py
@@ -1,105 +0,0 @@
-import os
-import yaml
-import json
-
-from typing import Tuple, Type, Optional
-from appdirs import user_config_dir
-from pydantic import AnyHttpUrl, Field
-from pydantic_settings import (
-    BaseSettings,
-    InitSettingsSource,
-    PydanticBaseSettingsSource,
-    SettingsConfigDict,
-    YamlConfigSettingsSource,
-)
-
-MVT_CONFIG_FOLDER = user_config_dir("mvt")
-MVT_CONFIG_PATH = os.path.join(MVT_CONFIG_FOLDER, "config.yaml")
-
-
-class MVTSettings(BaseSettings):
-    model_config = SettingsConfigDict(
-        env_prefix="MVT_",
-        env_nested_delimiter="_",
-        extra="ignore",
-        nested_model_default_partial_updates=True,
-    )
-    # Allow to decided if want to load environment variables
-    load_env: bool = Field(True, exclude=True)
-
-    # General settings
-    PYPI_UPDATE_URL: AnyHttpUrl = Field(
-        "https://pypi.org/pypi/mvt/json",
-        validate_default=False,
-    )
-    NETWORK_ACCESS_ALLOWED: bool = True
-    NETWORK_TIMEOUT: int = 15
-
-    # Command default settings, all can be specified by MVT_ prefixed environment variables too.
-    IOS_BACKUP_PASSWORD: Optional[str] = Field(
-        None, description="Default password to use to decrypt iOS backups"
-    )
-    ANDROID_BACKUP_PASSWORD: Optional[str] = Field(
-        None, description="Default password to use to decrypt Android backups"
-    )
-    STIX2: Optional[str] = Field(
-        None, description="List of directories where STIX2 files are stored"
-    )
-    VT_API_KEY: Optional[str] = Field(
-        None, description="API key to use for VirusTotal lookups"
-    )
-    PROFILE: bool = Field(False, description="Profile the execution of MVT modules")
-    HASH_FILES: bool = Field(False, description="Should MVT hash output files")
-
-    @classmethod
-    def settings_customise_sources(
-        cls,
-        settings_cls: Type[BaseSettings],
-        init_settings: InitSettingsSource,
-        env_settings: PydanticBaseSettingsSource,
-        dotenv_settings: PydanticBaseSettingsSource,
-        file_secret_settings: PydanticBaseSettingsSource,
-    ) -> Tuple[PydanticBaseSettingsSource, ...]:
-        sources = (
-            YamlConfigSettingsSource(settings_cls, MVT_CONFIG_PATH),
-            init_settings,
-        )
-        # Load env variables if enabled
-        if init_settings.init_kwargs.get("load_env", True):
-            sources = (env_settings,) + sources
-        return sources
-
-    def save_settings(
-        self,
-    ) -> None:
-        """
-        Save the current settings to a file.
-        """
-        if not os.path.isdir(MVT_CONFIG_FOLDER):
-            os.makedirs(MVT_CONFIG_FOLDER)
-
-        # Dump the settings to the YAML file
-        model_serializable = json.loads(self.model_dump_json(exclude_defaults=True))
-        with open(MVT_CONFIG_PATH, "w") as config_file:
-            config_file.write(yaml.dump(model_serializable, default_flow_style=False))
-
-    @classmethod
-    def initialise(cls) -> "MVTSettings":
-        """
-        Initialise the settings file.
-
-        We first initialise the settings (without env variable) and then persist
-        them to file. This way we can update the config file with the default values.
-
-        Afterwards we load the settings again, this time including the env variables.
-        """
-        # Set invalid env prefix to avoid loading env variables.
-        settings = MVTSettings(load_env=False)
-        settings.save_settings()
-
-        # Load the settings again with any ENV variables.
-        settings = MVTSettings(load_env=True)
-        return settings
-
-
-settings = MVTSettings.initialise()
--- a/src/mvt/common/help.py
+++ b/src/mvt/common/help.py
@@ -15,8 +15,6 @@ HELP_MSG_HASHES = "Generate hashes of all the files analyzed"
 HELP_MSG_VERBOSE = "Verbose mode"
 HELP_MSG_CHECK_IOCS = "Compare stored JSON results to provided indicators"
 HELP_MSG_STIX2 = "Download public STIX2 indicators"
-HELP_MSG_DISABLE_UPDATE_CHECK = "Disable MVT version update check"
-HELP_MSG_DISABLE_INDICATOR_UPDATE_CHECK = "Disable indicators update check"

 # IOS Specific
 HELP_MSG_DECRYPT_BACKUP = "Decrypt an encrypted iTunes backup"
@@ -47,7 +45,7 @@ HELP_MSG_APKS_FROM_FILE = (
    "Instead of acquiring APKs from a phone, load an existing packages.json file for "
    "lookups (mainly for debug purposes)"
 )
-HELP_MSG_CHECK_ADB = "Deprecated: Check an Android device over ADB. Prefer using the external AndroidQF project (https://github.com/mvt-project/androidqf) to acquire AndroidQF images for analysis."
+HELP_MSG_CHECK_ADB = "Check an Android device over ADB"
 HELP_MSG_CHECK_BUGREPORT = "Check an Android Bug Report"
 HELP_MSG_CHECK_ANDROID_BACKUP = "Check an Android Backup"
 HELP_MSG_CHECK_ANDROIDQF = "Check data collected with AndroidQF"
--- a/src/mvt/common/indicators.py
+++ b/src/mvt/common/indicators.py
@@ -14,7 +14,6 @@ import ahocorasick
 from appdirs import user_data_dir

 from .url import URL
-from .config import settings

 MVT_DATA_FOLDER = user_data_dir("mvt")
 MVT_INDICATORS_FOLDER = os.path.join(MVT_DATA_FOLDER, "indicators")
@@ -42,12 +41,12 @@ class Indicators:

    def _check_stix2_env_variable(self) -> None:
        """
-        Checks if MVT_STIX2 setting or environment variable contains path to a STIX file. Also recursively searches through dirs in MVT_STIX2
+        Checks if a variable MVT_STIX2 contains path to a STIX file. Also recursively searches through dirs in MVT_STIX2
        """
-        if not settings.STIX2:
+        if "MVT_STIX2" not in os.environ:
            return

-        paths = settings.STIX2.split(":")
+        paths = os.environ["MVT_STIX2"].split(":")
        for path in paths:
            if os.path.isfile(path) and path.lower().endswith(".stix2"):
                self.parse_stix2(path)
@@ -384,7 +383,8 @@ class Indicators:
        for ioc in self.get_iocs("urls"):
            if ioc["value"] == url:
                self.log.warning(
-                    'Found a known suspicious URL %s matching indicator "%s" from "%s"',
+                    "Found a known suspicious URL %s "
+                    'matching indicator "%s" from "%s"',
                    url,
                    ioc["value"],
                    ioc["name"],
@@ -768,30 +768,6 @@ class Indicators:

        return None

-
-    def check_receiver_prefix(self, receiver_name: str) -> Union[dict, None]:
-        """Check the provided receiver name against the list of indicators.
-        An IoC match is detected when a substring of the receiver matches the indicator
-        :param app_id: App ID to check against the list of indicators
-        :type app_id: str
-        :returns: Indicator details if matched, otherwise None
-
-        """
-        if not receiver_name:
-            return None
-
-        for ioc in self.get_iocs("app_ids"):
-            if ioc["value"].lower() in receiver_name.lower():
-                self.log.warning(
-                    'Found a known suspicious receiver with name "%s" '
-                    'matching indicators from "%s"',
-                    receiver_name,
-                    ioc["name"],
-                )
-                return ioc
-
-        return None
-
    def check_android_property_name(self, property_name: str) -> Optional[dict]:
        """Check the android property name against the list of indicators.

--- a/src/mvt/common/logo.py
+++ b/src/mvt/common/logo.py
@@ -12,85 +12,74 @@ from .updates import IndicatorsUpdates, MVTUpdates
 from .version import MVT_VERSION


-def check_updates(
-    disable_version_check: bool = False, disable_indicator_check: bool = False
-) -> None:
+def check_updates() -> None:
    log = logging.getLogger("mvt")
-
    # First we check for MVT version updates.
-    if not disable_version_check:
-        try:
-            mvt_updates = MVTUpdates()
-            latest_version = mvt_updates.check()
-        except (requests.exceptions.ConnectionError, requests.exceptions.Timeout):
+    try:
+        mvt_updates = MVTUpdates()
+        latest_version = mvt_updates.check()
+    except (requests.exceptions.ConnectionError, requests.exceptions.Timeout):
+        rich_print(
+            "\t\t[bold]Note: Could not check for MVT updates.[/bold] "
+            "You may be working offline. Please update MVT regularly."
+        )
+    except Exception as e:
+        log.error("Error encountered when trying to check latest MVT version: %s", e)
+    else:
+        if latest_version:
            rich_print(
-                "\t\t[bold]Note: Could not check for MVT updates.[/bold] "
-                "You may be working offline. Please update MVT regularly."
+                f"\t\t[bold]Version {latest_version} is available! "
+                "Upgrade mvt with `pip3 install -U mvt`[/bold]"
            )
-        except Exception as e:
-            log.error(
-                "Error encountered when trying to check latest MVT version: %s", e
-            )
-        else:
-            if latest_version:
-                rich_print(
-                    f"\t\t[bold]Version {latest_version} is available! "
-                    "Upgrade mvt with `pip3 install -U mvt` or with `pipx upgrade mvt`[/bold]"
-                )

    # Then we check for indicators files updates.
-    if not disable_indicator_check:
-        ioc_updates = IndicatorsUpdates()
+    ioc_updates = IndicatorsUpdates()

-        # Before proceeding, we check if we have downloaded an indicators index.
-        # If not, there's no point in proceeding with the updates check.
-        if ioc_updates.get_latest_update() == 0:
-            rich_print(
-                "\t\t[bold]You have not yet downloaded any indicators, check "
-                "the `download-iocs` command![/bold]"
-            )
-            return
+    # Before proceeding, we check if we have downloaded an indicators index.
+    # If not, there's no point in proceeding with the updates check.
+    if ioc_updates.get_latest_update() == 0:
+        rich_print(
+            "\t\t[bold]You have not yet downloaded any indicators, check "
+            "the `download-iocs` command![/bold]"
+        )
+        return

-        # We only perform this check at a fixed frequency, in order to not
-        # overburden the user with too many lookups if the command is being run
-        # multiple times.
-        should_check, hours = ioc_updates.should_check()
-        if not should_check:
-            rich_print(
-                f"\t\tIndicators updates checked recently, next automatic check "
-                f"in {int(hours)} hours"
-            )
-            return
+    # We only perform this check at a fixed frequency, in order to not
+    # overburden the user with too many lookups if the command is being run
+    # multiple times.
+    should_check, hours = ioc_updates.should_check()
+    if not should_check:
+        rich_print(
+            f"\t\tIndicators updates checked recently, next automatic check "
+            f"in {int(hours)} hours"
+        )
+        return

-        try:
-            ioc_to_update = ioc_updates.check()
-        except (requests.exceptions.ConnectionError, requests.exceptions.Timeout):
+    try:
+        ioc_to_update = ioc_updates.check()
+    except (requests.exceptions.ConnectionError, requests.exceptions.Timeout):
+        rich_print(
+            "\t\t[bold]Note: Could not check for indicator updates.[/bold] "
+            "You may be working offline. Please update MVT indicators regularly."
+        )
+    except Exception as e:
+        log.error("Error encountered when trying to check latest MVT indicators: %s", e)
+    else:
+        if ioc_to_update:
            rich_print(
-                "\t\t[bold]Note: Could not check for indicator updates.[/bold] "
-                "You may be working offline. Please update MVT indicators regularly."
-            )
-        except Exception as e:
-            log.error(
-                "Error encountered when trying to check latest MVT indicators: %s", e
+                "\t\t[bold]There are updates to your indicators files! "
+                "Run the `download-iocs` command to update![/bold]"
            )
        else:
-            if ioc_to_update:
-                rich_print(
-                    "\t\t[bold]There are updates to your indicators files! "
-                    "Run the `download-iocs` command to update![/bold]"
-                )
-            else:
-                rich_print("\t\tYour indicators files seem to be up to date.")
+            rich_print("\t\tYour indicators files seem to be up to date.")


-def logo(
-    disable_version_check: bool = False, disable_indicator_check: bool = False
-) -> None:
+def logo() -> None:
    rich_print("\n")
    rich_print("\t[bold]MVT[/bold] - Mobile Verification Toolkit")
    rich_print("\t\thttps://mvt.re")
    rich_print(f"\t\tVersion: {MVT_VERSION}")

-    check_updates(disable_version_check, disable_indicator_check)
+    check_updates()

    rich_print("\n")
--- a/src/mvt/common/module.py
+++ b/src/mvt/common/module.py
@@ -69,14 +69,10 @@ class MVTModule:
    @classmethod
    def from_json(cls, json_path: str, log: logging.Logger):
        with open(json_path, "r", encoding="utf-8") as handle:
-            try:
-                results = json.load(handle)
-                if log:
-                    log.info('Loaded %d results from "%s"', len(results), json_path)
-                return cls(results=results, log=log)
-            except json.decoder.JSONDecodeError as err:
-                log.error('Error to decode the json "%s" file: "%s"', json_path, err)
-                return None
+            results = json.load(handle)
+            if log:
+                log.info('Loaded %d results from "%s"', len(results), json_path)
+            return cls(results=results, log=log)

    @classmethod
    def get_slug(cls) -> str:
@@ -231,7 +227,7 @@ def run_module(module: MVTModule) -> None:
        module.save_to_json()


-def save_timeline(timeline: list, timeline_path: str, is_utc: bool = True) -> None:
+def save_timeline(timeline: list, timeline_path: str) -> None:
    """Save the timeline in a csv file.

    :param timeline: List of records to order and store
@@ -242,12 +238,7 @@ def save_timeline(timeline: list, timeline_path: str, is_utc: bool = True) -> No
        csvoutput = csv.writer(
            handle, delimiter=",", quotechar='"', quoting=csv.QUOTE_ALL, escapechar="\\"
        )
-
-        if is_utc:
-            timestamp_header = "UTC Timestamp"
-        else:
-            timestamp_header = "Device Local Timestamp"
-        csvoutput.writerow([timestamp_header, "Plugin", "Event", "Description"])
+        csvoutput.writerow(["UTC Timestamp", "Plugin", "Event", "Description"])

        for event in sorted(
            timeline, key=lambda x: x["timestamp"] if x["timestamp"] is not None else ""
--- a/src/mvt/common/updates.py
+++ b/src/mvt/common/updates.py
@@ -14,7 +14,6 @@ from packaging import version

 from .indicators import MVT_DATA_FOLDER, MVT_INDICATORS_FOLDER
 from .version import MVT_VERSION
-from .config import settings

 log = logging.getLogger(__name__)

@@ -24,11 +23,7 @@ INDICATORS_CHECK_FREQUENCY = 12

 class MVTUpdates:
    def check(self) -> str:
-        try:
-            res = requests.get(settings.PYPI_UPDATE_URL, timeout=5)
-        except requests.exceptions.RequestException as e:
-            log.error("Failed to check for updates, skipping updates: %s", e)
-            return ""
+        res = requests.get("https://pypi.org/pypi/mvt/json", timeout=15)
        data = res.json()
        latest_version = data.get("info", {}).get("version", "")

@@ -97,12 +92,7 @@ class IndicatorsUpdates:
        url = self.github_raw_url.format(
            self.index_owner, self.index_repo, self.index_branch, self.index_path
        )
-        try:
-            res = requests.get(url, timeout=5)
-        except requests.exceptions.RequestException as e:
-            log.error("Failed to retrieve indicators index from %s: %s", url, e)
-            return None
-
+        res = requests.get(url, timeout=15)
        if res.status_code != 200:
            log.error(
                "Failed to retrieve indicators index located at %s (error %d)",
@@ -114,12 +104,7 @@ class IndicatorsUpdates:
        return yaml.safe_load(res.content)

    def download_remote_ioc(self, ioc_url: str) -> Optional[str]:
-        try:
-            res = requests.get(ioc_url, timeout=15)
-        except requests.exceptions.RequestException as e:
-            log.error("Failed to download indicators file from %s: %s", ioc_url, e)
-            return None
-
+        res = requests.get(ioc_url, timeout=15)
        if res.status_code != 200:
            log.error(
                "Failed to download indicators file from %s (error %d)",
@@ -185,12 +170,7 @@ class IndicatorsUpdates:
        file_commit_url = (
            f"https://api.github.com/repos/{owner}/{repo}/commits?path={path}"
        )
-        try:
-            res = requests.get(file_commit_url, timeout=5)
-        except requests.exceptions.RequestException as e:
-            log.error("Failed to get details about file %s: %s", file_commit_url, e)
-            return -1
-
+        res = requests.get(file_commit_url, timeout=15)
        if res.status_code != 200:
            log.error(
                "Failed to get details about file %s (error %d)",
--- a/src/mvt/common/utils.py
+++ b/src/mvt/common/utils.py
@@ -13,7 +13,6 @@ import re
 from typing import Any, Iterator, Union

 from rich.logging import RichHandler
-from mvt.common.config import settings


 class CustomJSONEncoder(json.JSONEncoder):
@@ -257,7 +256,7 @@ def set_verbose_logging(verbose: bool = False):

 def exec_or_profile(module, globals, locals):
    """Hook for profiling MVT modules"""
-    if settings.PROFILE:
+    if int(os.environ.get("MVT_PROFILE", False)):
        cProfile.runctx(module, globals, locals)
    else:
        exec(module, globals, locals)
--- a/src/mvt/common/version.py
+++ b/src/mvt/common/version.py
@@ -3,4 +3,4 @@
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/

-MVT_VERSION = "2.7.0"
+MVT_VERSION = "2.5.4"
--- a/src/mvt/ios/cli.py
+++ b/src/mvt/ios/cli.py
@@ -37,8 +37,6 @@ from mvt.common.help import (
    HELP_MSG_CHECK_IOCS,
    HELP_MSG_STIX2,
    HELP_MSG_CHECK_IOS_BACKUP,
-    HELP_MSG_DISABLE_UPDATE_CHECK,
-    HELP_MSG_DISABLE_INDICATOR_UPDATE_CHECK,
 )
 from .cmd_check_backup import CmdIOSCheckBackup
 from .cmd_check_fs import CmdIOSCheckFS
@@ -55,37 +53,12 @@ MVT_IOS_BACKUP_PASSWORD = "MVT_IOS_BACKUP_PASSWORD"
 CONTEXT_SETTINGS = dict(help_option_names=["-h", "--help"])


-def _get_disable_flags(ctx):
-    """Helper function to safely get disable flags from context."""
-    if ctx.obj is None:
-        return False, False
-    return (
-        ctx.obj.get("disable_version_check", False),
-        ctx.obj.get("disable_indicator_check", False),
-    )
-
-
 # ==============================================================================
 # Main
 # ==============================================================================
@click.group(invoke_without_command=False)
-@click.option(
-    "--disable-update-check", is_flag=True, help=HELP_MSG_DISABLE_UPDATE_CHECK
-)
-@click.option(
-    "--disable-indicator-update-check",
-    is_flag=True,
-    help=HELP_MSG_DISABLE_INDICATOR_UPDATE_CHECK,
-)
-@click.pass_context
-def cli(ctx, disable_update_check, disable_indicator_update_check):
-    ctx.ensure_object(dict)
-    ctx.obj["disable_version_check"] = disable_update_check
-    ctx.obj["disable_indicator_check"] = disable_indicator_update_check
-    logo(
-        disable_version_check=disable_update_check,
-        disable_indicator_check=disable_indicator_update_check,
-    )
+def cli():
+    logo()


 # ==============================================================================
@@ -127,7 +100,7 @@ def decrypt_backup(ctx, destination, password, key_file, hashes, backup_path):
    if key_file:
        if MVT_IOS_BACKUP_PASSWORD in os.environ:
            log.info(
-                "Ignoring %s environment variable, using --key-file'%s' instead",
+                "Ignoring %s environment variable, using --key-file" "'%s' instead",
                MVT_IOS_BACKUP_PASSWORD,
                key_file,
            )
@@ -141,7 +114,7 @@ def decrypt_backup(ctx, destination, password, key_file, hashes, backup_path):

        if MVT_IOS_BACKUP_PASSWORD in os.environ:
            log.info(
-                "Ignoring %s environment variable, using --passwordargument instead",
+                "Ignoring %s environment variable, using --password" "argument instead",
                MVT_IOS_BACKUP_PASSWORD,
            )

@@ -195,7 +168,8 @@ def extract_key(password, key_file, backup_path):

        if MVT_IOS_BACKUP_PASSWORD in os.environ:
            log.info(
-                "Ignoring %s environment variable, using --password argument instead",
+                "Ignoring %s environment variable, using --password "
+                "argument instead",
                MVT_IOS_BACKUP_PASSWORD,
            )
    elif MVT_IOS_BACKUP_PASSWORD in os.environ:
@@ -246,8 +220,6 @@ def check_backup(
        module_name=module,
        module_options=module_options,
        hashes=hashes,
-        disable_version_check=_get_disable_flags(ctx)[0],
-        disable_indicator_check=_get_disable_flags(ctx)[1],
    )

    if list_modules:
@@ -295,8 +267,6 @@ def check_fs(ctx, iocs, output, fast, list_modules, module, hashes, verbose, dum
        module_name=module,
        module_options=module_options,
        hashes=hashes,
-        disable_version_check=_get_disable_flags(ctx)[0],
-        disable_indicator_check=_get_disable_flags(ctx)[1],
    )

    if list_modules:
@@ -331,13 +301,7 @@ def check_fs(ctx, iocs, output, fast, list_modules, module, hashes, verbose, dum
@click.argument("FOLDER", type=click.Path(exists=True))
@click.pass_context
 def check_iocs(ctx, iocs, list_modules, module, folder):
-    cmd = CmdCheckIOCS(
-        target_path=folder,
-        ioc_files=iocs,
-        module_name=module,
-        disable_version_check=_get_disable_flags(ctx)[0],
-        disable_indicator_check=_get_disable_flags(ctx)[1],
-    )
+    cmd = CmdCheckIOCS(target_path=folder, ioc_files=iocs, module_name=module)
    cmd.modules = BACKUP_MODULES + FS_MODULES + MIXED_MODULES

    if list_modules:
--- a/src/mvt/ios/cmd_check_backup.py
+++ b/src/mvt/ios/cmd_check_backup.py
@@ -7,7 +7,6 @@ import logging
 from typing import Optional

 from mvt.common.command import Command
-from mvt.common.indicators import Indicators

 from .modules.backup import BACKUP_MODULES
 from .modules.mixed import MIXED_MODULES
@@ -21,28 +20,20 @@ class CmdIOSCheckBackup(Command):
        target_path: Optional[str] = None,
        results_path: Optional[str] = None,
        ioc_files: Optional[list] = None,
-        iocs: Optional[Indicators] = None,
        module_name: Optional[str] = None,
        serial: Optional[str] = None,
        module_options: Optional[dict] = None,
        hashes: bool = False,
-        sub_command: bool = False,
-        disable_version_check: bool = False,
-        disable_indicator_check: bool = False,
    ) -> None:
        super().__init__(
            target_path=target_path,
            results_path=results_path,
            ioc_files=ioc_files,
-            iocs=iocs,
            module_name=module_name,
            serial=serial,
            module_options=module_options,
            hashes=hashes,
-            sub_command=sub_command,
            log=log,
-            disable_version_check=disable_version_check,
-            disable_indicator_check=disable_indicator_check,
        )

        self.name = "check-backup"
--- a/src/mvt/ios/cmd_check_fs.py
+++ b/src/mvt/ios/cmd_check_fs.py
@@ -7,7 +7,6 @@ import logging
 from typing import Optional

 from mvt.common.command import Command
-from mvt.common.indicators import Indicators

 from .modules.fs import FS_MODULES
 from .modules.mixed import MIXED_MODULES
@@ -21,27 +20,20 @@ class CmdIOSCheckFS(Command):
        target_path: Optional[str] = None,
        results_path: Optional[str] = None,
        ioc_files: Optional[list] = None,
-        iocs: Optional[Indicators] = None,
        module_name: Optional[str] = None,
        serial: Optional[str] = None,
        module_options: Optional[dict] = None,
        hashes: bool = False,
-        sub_command: bool = False,
-        disable_version_check: bool = False,
-        disable_indicator_check: bool = False,
    ) -> None:
        super().__init__(
            target_path=target_path,
            results_path=results_path,
            ioc_files=ioc_files,
-            iocs=iocs,
            module_name=module_name,
+            serial=serial,
            module_options=module_options,
            hashes=hashes,
-            sub_command=sub_command,
            log=log,
-            disable_version_check=disable_version_check,
-            disable_indicator_check=disable_indicator_check,
        )

        self.name = "check-fs"
--- a/src/mvt/ios/data/ios_models.json
+++ b/src/mvt/ios/data/ios_models.json
@@ -194,41 +194,5 @@
    {
        "identifier": "iPhone16,2",
        "description": "iPhone 15 Pro Max"
-    },
-    {
-        "identifier": "iPhone17,1",
-        "description": "iPhone 16 Pro"
-    },
-    {
-        "identifier": "iPhone17,2",
-        "description": "iPhone 16 Pro Max"
-    },
-    {
-        "identifier": "iPhone17,3",
-        "description": "iPhone 16"
-    },
-    {
-        "identifier": "iPhone17,4",
-        "description": "iPhone 16 Plus"
-    },
-    {
-        "identifier": "iPhone17,5",
-        "description": "iPhone 16e"
-    },
-    {
-        "identifier": "iPhone18,1",
-        "description": "iPhone 17 Pro"
-    },
-    {
-        "identifier": "iPhone18,2",
-        "description": "iPhone 17 Pro Max"
-    },
-    {
-        "identifier": "iPhone18,3",
-        "description": "iPhone 17"
-    },
-    {
-        "identifier": "iPhone18,4",
-        "description": "iPhone Air"
    }
 ]
--- a/src/mvt/ios/data/ios_versions.json
+++ b/src/mvt/ios/data/ios_versions.json
@@ -631,10 +631,6 @@
        "build": "16H81",
        "version": "12.5.7"
    },
-    {
-        "version": "12.5.8",
-        "build": "16H88"
-    },
    {
        "build": "17A577",
        "version": "13.0"
@@ -895,18 +891,6 @@
        "version": "15.8.2",
        "build": "19H384"
    },
-    {
-        "version": "15.8.4",
-        "build": "19H390"
-    },
-    {
-        "version": "15.8.5",
-        "build": "19H394"
-    },
-    {
-        "version": "15.8.6",
-        "build": "19H402"
-    },
    {
        "build": "20A362",
        "version": "16.0"
@@ -1008,18 +992,6 @@
        "version": "16.7.8",
        "build": "20H343"
    },
-    {
-        "version": "16.7.11",
-        "build": "20H360"
-    },
-    {
-        "version": "16.7.12",
-        "build": "20H364"
-    },
-    {
-        "version": "16.7.14",
-        "build": "20H370"
-    },
    {
        "version": "17.0",
        "build": "21A327"
@@ -1104,10 +1076,6 @@
        "version": "17.6.1",
        "build": "21G101"
    },
-    {
-        "version": "17.7.7",
-        "build": "21H433"
-    },
    {
        "version": "18",
        "build": "22A3354"
@@ -1127,77 +1095,5 @@
    {
        "version": "18.2",
        "build": "22C152"
-    },
-    {
-        "version": "18.2.1",
-        "build": "22C161"
-    },
-    {
-        "version": "18.3",
-        "build": "22D63"
-    },
-    {
-        "version": "18.3.1",
-        "build": "22D72"
-    },
-    {
-        "version": "18.4",
-        "build": "22E240"
-    },
-    {
-        "version": "18.4.1",
-        "build": "22E252"
-    },
-    {
-        "version": "18.5",
-        "build": "22F76"
-    },
-    {
-        "version": "18.6",
-        "build": "22G86"
-    },
-    {
-        "version": "18.6.1",
-        "build": "22G90"
-    },
-    {
-        "version": "18.6.2",
-        "build": "22G100"
-    },
-    {
-        "version": "18.7",
-        "build": "22H20"
-    },
-    {
-        "version": "18.7.2",
-        "build": "22H124"
-    },
-    {
-        "version": "18.7.3",
-        "build": "22H217"
-    },
-    {
-        "version": "18.7.4",
-        "build": "22H218"
-    },
-    {
-        "version": "26",
-        "build": "23A341"
-    },
-    {
-        "version": "26.0.1",
-        "build": "23A355"
-    },
-    {
-        "version": "26.1",
-        "build": "23B85"
-    },
-    {
-        "version": "26.2",
-        "build": "23C55"
-    },
-    {
-        "version": "26.2.1",
-        "build": "23C71"
    }
 ]
--- a/src/mvt/ios/modules/backup/backup_info.py
+++ b/src/mvt/ios/modules/backup/backup_info.py
@@ -41,7 +41,7 @@ class BackupInfo(IOSExtraction):
        info_path = os.path.join(self.target_path, "Info.plist")
        if not os.path.exists(info_path):
            raise DatabaseNotFoundError(
-                "No Info.plist at backup path, unable to extract device information"
+                "No Info.plist at backup path, unable to extract device " "information"
            )

        with open(info_path, "rb") as handle:
--- a/src/mvt/ios/modules/backup/manifest.py
+++ b/src/mvt/ios/modules/backup/manifest.py
@@ -110,7 +110,8 @@ class Manifest(IOSExtraction):
                ioc = self.indicators.check_url(part)
                if ioc:
                    self.log.warning(
-                        'Found mention of domain "%s" in a backup file with path: %s',
+                        'Found mention of domain "%s" in a backup file with '
+                        "path: %s",
                        ioc["value"],
                        rel_path,
                    )
--- a/src/mvt/ios/modules/base.py
+++ b/src/mvt/ios/modules/base.py
@@ -74,7 +74,7 @@ class IOSExtraction(MVTModule):

        if not shutil.which("sqlite3"):
            raise DatabaseCorruptedError(
-                "failed to recover without sqlite3 binary: please install sqlite3!"
+                "failed to recover without sqlite3 binary: please install " "sqlite3!"
            )
        if '"' in file_path:
            raise DatabaseCorruptedError(
--- a/src/mvt/ios/modules/mixed/global_preferences.py
+++ b/src/mvt/ios/modules/mixed/global_preferences.py
@@ -43,8 +43,6 @@ class GlobalPreferences(IOSExtraction):
                    self.log.warning("Lockdown mode enabled")
                else:
                    self.log.warning("Lockdown mode disabled")
-                return
-        self.log.warning("Lockdown mode disabled")

    def process_file(self, file_path: str) -> None:
        with open(file_path, "rb") as handle:
--- a/src/mvt/ios/modules/mixed/safari_browserstate.py
+++ b/src/mvt/ios/modules/mixed/safari_browserstate.py
@@ -95,17 +95,14 @@ class SafariBrowserState(IOSExtraction):
            )
        except sqlite3.OperationalError:
            # Old version iOS <12 likely
-            try:
-                cur.execute(
-                    """
-                    SELECT
-                        title, url, user_visible_url, last_viewed_time, session_data
-                    FROM tabs
-                    ORDER BY last_viewed_time;
+            cur.execute(
                """
-                )
-            except sqlite3.OperationalError as e:
-                self.log.error(f"Error executing query: {e}")
+                SELECT
+                    title, url, user_visible_url, last_viewed_time, session_data
+                FROM tabs
+                ORDER BY last_viewed_time;
+            """
+            )

        for row in cur:
            session_entries = []
--- a/src/mvt/ios/modules/mixed/sms.py
+++ b/src/mvt/ios/modules/mixed/sms.py
@@ -43,7 +43,7 @@ class SMS(IOSExtraction):

    def serialize(self, record: dict) -> Union[dict, list]:
        text = record["text"].replace("\n", "\\n")
-        sms_data = f'{record["service"]}: {record["guid"]} "{text}" from {record["phone_number"]} ({record["account"]})'
+        sms_data = f"{record['service']}: {record['guid']} \"{text}\" from {record['phone_number']} ({record['account']})"
        records = [
            {
                "timestamp": record["isodate"],
--- a/src/mvt/ios/modules/mixed/tcc.py
+++ b/src/mvt/ios/modules/mixed/tcc.py
@@ -116,16 +116,13 @@ class TCC(IOSExtraction):
                )
                db_version = "v2"
            except sqlite3.OperationalError:
-                try:
-                    cur.execute(
-                        """SELECT
-                        service, client, client_type, allowed,
-                        prompt_count
-                        FROM access;"""
-                    )
-                    db_version = "v1"
-                except sqlite3.OperationalError as e:
-                    self.log.error(f"Error parsing TCC database: {e}")
+                cur.execute(
+                    """SELECT
+                    service, client, client_type, allowed,
+                    prompt_count
+                    FROM access;"""
+                )
+                db_version = "v1"

        for row in cur:
            service = row[0]
--- a/Show More
+++ b/Show More