Bumped version

Fixed dict decl
Removed newline
2026-02-14 09:32:51 +00:00 · 2021-09-28 15:40:26 +02:00 · 2021-09-28 12:45:15 +02:00 · 2021-09-28 12:44:15 +02:00 · 2021-09-28 12:43:26 +02:00 · 2021-09-28 12:42:57 +02:00
65 changed files with 1259 additions and 589 deletions
--- a/79
+++ b/79
@@ -2,48 +2,56 @@ FROM ubuntu:20.04

 # Ref. https://github.com/mvt-project/mvt

+LABEL url="https://mvt.re"
+LABEL vcs-url="https://github.com/mvt-project/mvt"
+LABEL description="MVT is a forensic tool to look for signs of infection in smartphone devices."
+
+ENV PIP_NO_CACHE_DIR=1
+
 # Fixing major OS dependencies
 # ----------------------------
 RUN apt update \
  && apt install -y python3 python3-pip libusb-1.0-0-dev \
-  && apt install -y wget \ 
-  && apt install -y adb \ 
-  && DEBIAN_FRONTEND=noninteractive apt-get -y install default-jre-headless
+  && apt install -y wget unzip\ 
+  && DEBIAN_FRONTEND=noninteractive apt-get -y install default-jre-headless \

 # Install build tools for libimobiledevice
 # ----------------------------------------
-RUN apt install -y build-essential \
-	checkinstall \
-	git \
-	autoconf \
-	automake \
-	libtool-bin \
-	libplist-dev \
-	libusbmuxd-dev \
-	libssl-dev \
-	sqlite3 \
-    pkg-config
+  build-essential \
+  checkinstall \
+  git \
+  autoconf \
+  automake \
+  libtool-bin \
+  libplist-dev \
+  libusbmuxd-dev \
+  libssl-dev \
+  sqlite3 \
+  pkg-config \

 # Clean up
 # --------
-RUN apt-get clean \
-  && rm -rf /var/lib/apt/lists/*
+  && apt-get clean \
+  && rm -rf /var/lib/apt/lists/* /var/cache/apt


 # Build libimobiledevice
 # ----------------------
-RUN git clone https://github.com/libimobiledevice/libplist
-RUN git clone https://github.com/libimobiledevice/libusbmuxd
-RUN git clone https://github.com/libimobiledevice/libimobiledevice
-RUN git clone https://github.com/libimobiledevice/usbmuxd
+RUN git clone https://github.com/libimobiledevice/libplist \
+  && git clone https://github.com/libimobiledevice/libusbmuxd \
+  && git clone https://github.com/libimobiledevice/libimobiledevice \
+  && git clone https://github.com/libimobiledevice/usbmuxd \

-RUN cd libplist && ./autogen.sh && make && make install && ldconfig
+  && cd libplist && ./autogen.sh && make && make install && ldconfig \

-RUN cd libusbmuxd && PKG_CONFIG_PATH=/usr/local/lib/pkgconfig ./autogen.sh && make && make install && ldconfig
+  && cd ../libusbmuxd && PKG_CONFIG_PATH=/usr/local/lib/pkgconfig ./autogen.sh && make && make install && ldconfig \

-RUN cd libimobiledevice && PKG_CONFIG_PATH=/usr/local/lib/pkgconfig ./autogen.sh --enable-debug && make && make install && ldconfig
+  && cd ../libimobiledevice && PKG_CONFIG_PATH=/usr/local/lib/pkgconfig ./autogen.sh --enable-debug && make && make install && ldconfig \

-RUN cd usbmuxd && PKG_CONFIG_PATH=/usr/local/lib/pkgconfig ./autogen.sh --prefix=/usr --sysconfdir=/etc --localstatedir=/var --runstatedir=/run && make && make install
+  && cd ../usbmuxd && PKG_CONFIG_PATH=/usr/local/lib/pkgconfig ./autogen.sh --prefix=/usr --sysconfdir=/etc --localstatedir=/var --runstatedir=/run && make && make install \
+
+  # Clean up.
+  && cd .. && rm -rf libplist libusbmuxd libimobiledevice usbmuxd

 # Installing MVT
 # --------------
@@ -51,16 +59,29 @@ RUN pip3 install mvt

 # Installing ABE
 # --------------
-RUN mkdir /opt/abe
-RUN wget https://github.com/nelenkov/android-backup-extractor/releases/download/20210709062403-4c55371/abe.jar -O /opt/abe/abe.jar
+RUN mkdir /opt/abe \
+  && wget https://github.com/nelenkov/android-backup-extractor/releases/download/20210709062403-4c55371/abe.jar -O /opt/abe/abe.jar \
 # Create alias for abe
-RUN echo 'alias abe="java -jar /opt/abe/abe.jar"' >> ~/.bashrc
+  && echo 'alias abe="java -jar /opt/abe/abe.jar"' >> ~/.bashrc
+
+# Install Android Platform Tools 
+# ------------------------------ 
+
+RUN mkdir /opt/android \
+  && wget -q https://dl.google.com/android/repository/platform-tools-latest-linux.zip \
+  && unzip platform-tools-latest-linux.zip -d /opt/android \
+# Create alias for adb 
+  && echo 'alias adb="/opt/android/platform-tools/adb"' >> ~/.bashrc 
+
+# Generate adb key folder 
+# ------------------------------ 
+RUN mkdir /root/.android && /opt/android/platform-tools/adb keygen /root/.android/adbkey

 # Setup investigations environment
 # --------------------------------
 RUN mkdir /home/cases
 WORKDIR /home/cases 
-RUN echo 'echo "Mobile Verification Toolkit @ Docker\n------------------------------------\n\nYou can find information about how to use this image for Android (https://github.com/mvt-project/mvt/tree/master/docs/android) and iOS (https://github.com/mvt-project/mvt/tree/master/docs/ios) in the official docs of the project.\n"' >> ~/.bashrc
-RUN echo 'echo "Note that to perform the debug via USB you might need to give the Docker image access to the USB using \"docker run -it --privileged -v /dev/bus/usb:/dev/bus/usb mvt\" or, preferably, the \"--device=\" parameter.\n"' >> ~/.bashrc
+RUN echo 'echo "Mobile Verification Toolkit @ Docker\n------------------------------------\n\nYou can find information about how to use this image for Android (https://github.com/mvt-project/mvt/tree/master/docs/android) and iOS (https://github.com/mvt-project/mvt/tree/master/docs/ios) in the official docs of the project.\n"' >> ~/.bashrc \
+  && echo 'echo "Note that to perform the debug via USB you might need to give the Docker image access to the USB using \"docker run -it --privileged -v /dev/bus/usb:/dev/bus/usb mvt\" or, preferably, the \"--device=\" parameter.\n"' >> ~/.bashrc

 CMD /bin/bash
--- a/README.md
+++ b/README.md
@@ -1,5 +1,5 @@
 <p align="center">
-     <img src="./docs/mvt.png" width="300" />
+     <img src="./docs/mvt.png" width="200" />
 </p>

 # Mobile Verification Toolkit
@@ -27,7 +27,7 @@ Alternatively, you can decide to run MVT and all relevant tools through a [Docke

 ## Usage

-MVT provides two commands `mvt-ios` and `mvt-android`. [Check out the documentation to learn how to use them!](https://docs.mvt.re/).
+MVT provides two commands `mvt-ios` and `mvt-android`. [Check out the documentation to learn how to use them!](https://docs.mvt.re/)

 ## License

--- a/docs/android/adb.md
+++ b/docs/android/adb.md
@@ -1,8 +1,42 @@
 # Check over ADB

-TODO
+In order to check an Android device over the [Android Debug Bridge (adb)](https://developer.android.com/studio/command-line/adb) you will first need to install [Android SDK Platform Tools](https://developer.android.com/studio/releases/platform-tools). If you have installed [Android Studio](https://developer.android.com/studio/) you should already have access to `adb` and other utilities.

-<!-- In order to use `mvt-android` you need to connect your Android device to your computer. You will then need to [enable USB debugging](https://developer.android.com/studio/debug/dev-options#enable>) on the Android device.
+While many Linux distributions already package Android Platform Tools (for example `android-platform-tools-base` on Debian), it is preferable to install the most recent version from the official website. Packaged versions might be outdated and incompatible with most recent Android handsets.

-If this is the first time you connect to this device, you will need to approve the authentication keys through a prompt that will appear on your Android device.
- -->
+Next you will need to enable debugging on the Android device you are testing. [Please follow the official instructions on how to do so.](https://developer.android.com/studio/command-line/adb)
+
+## Connecting over USB
+
+The easiest way to check the device is over a USB transport. You will need to have USB debugging enabled and the device plugged into your computer. If everything is configured appropriately you should see your device when launching the command `adb devices`.
+
+Now you can try launching MVT with:
+
+```bash
+mvt-android check-adb --output /path/to/results
+```
+
+If you have previously started an adb daemon MVT will alert you and require you to kill it with `adb kill-server` and relaunch the command.
+
+!!! warning
+    MVT relies on the Python library [adb-shell](https://pypi.org/project/adb-shell/) to connect to an Android device, which relies on libusb for the USB transport. Because of known driver issues, Windows users [are recommended](https://github.com/JeffLIrion/adb_shell/issues/118) to install appropriate drivers using [Zadig](https://zadig.akeo.ie/). Alternatively, an easier option might be to use the TCP transport and connect over Wi-Fi as describe next.
+
+## Connecting over Wi-FI
+
+When connecting to the device over USB is not possible or not working properly, an alternative option is to connect over the network. In order to do so, first launch an adb daemon at a fixed port number:
+
+```bash
+adb tcpip 5555
+```
+
+Then you can specify the IP address of the phone with the adb port number to MVT like so:
+
+```bash
+mvt-android check-adb --serial 192.168.1.20:5555 --output /path/to/results
+```
+
+Where `192.168.1.20` is the correct IP address of your device.
+
+## MVT modules requiring root privileges
+
+Of the currently available `mvt-android check-adb` modules a handful require root privileges to function correctly. This is because certain files, such as browser history and SMS messages databases are not accessible with user privileges through adb. These modules are to be considered OPTIONALLY available in case the device was already jailbroken. **Do NOT jailbreak your own device unless you are sure of what you are doing!** Jailbreaking your phone exposes it to considerable security risks!
--- a/docs/android/backup.md
+++ b/docs/android/backup.md
@@ -44,4 +44,4 @@ $ mvt-android check-backup --output /path/to/results/ /path/to/backup/
                  64 SMS messages containing links
 ```

-Through the `--iocs` argument you can specify a [STIX2](https://oasis-open.github.io/cti-documentation/stix/intro) file defining a list of malicious indicators to check against the records extracted from the backup by mvt. Any matches will be highlighted in the terminal output.
+Through the `--iocs` argument you can specify a [STIX2](https://oasis-open.github.io/cti-documentation/stix/intro) file defining a list of malicious indicators to check against the records extracted from the backup by MVT. Any matches will be highlighted in the terminal output.
--- a/docs/android/download_apks.md
+++ b/docs/android/download_apks.md
@@ -20,7 +20,7 @@ mvt-android download-apks --output /path/to/folder --virustotal
 mvt-android download-apks --output /path/to/folder --koodous
 ```

-Or, to launch all available lookups::
+Or, to launch all available lookups:

 ```bash
 mvt-android download-apks --output /path/to/folder --all-checks
--- a/docs/android/methodology.md
+++ b/docs/android/methodology.md
@@ -8,13 +8,14 @@ However, not all is lost.

 Because malware attacks over Android typically take the form of malicious or backdoored apps, the very first thing you might want to do is to extract and verify all installed Android packages and triage quickly if there are any which stand out as malicious or which might be atypical.

-While it is out of the scope of this documentation to dwell into details on how to analyze Android apps, MVT does allow to easily and automatically extract information about installed apps, download copies of them, and quickly lookup services such as [VirusTotal](https://www.virustotal.com) or [Koodous](https://www.koodous.com) which might quickly indicate known bad apps.
+While it is out of the scope of this documentation to dwell into details on how to analyze Android apps, MVT does allow to easily and automatically extract information about installed apps, download copies of them, and quickly lookup services such as [VirusTotal](https://www.virustotal.com) or [Koodous](https://koodous.com) which might quickly indicate known bad apps.


 ## Check the device over Android Debug Bridge

-TODO
+Some additional diagnostic information can be extracted from the phone using the [Android Debug Bridge (adb)](https://developer.android.com/studio/command-line/adb). `mvt-android` allows to automatically extract information including [dumpsys](https://developer.android.com/studio/command-line/dumpsys) results, details on installed packages (without download), running processes, presence of root binaries and packages, and more.
+

 ## Check an Android Backup (SMS messages)

-TODO
+Although Android backups are becoming deprecated, it is still possible to generate one. Unfortunately, because apps these days typically favor backup over the cloud, the amount of data available is limited. Currently, `mvt-android check-backup` only supports checking SMS messages containing links.
--- a/docs/index.md
+++ b/docs/index.md
@@ -10,4 +10,4 @@ In this documentation you will find instructions on how to install and run the `

 ## Resources

-[:fontawesome-brands-python: Python Package](https://pypi.org/project/mvt){: .md-button .md-button--primary } [:fontawesome-brands-github: GitHub](https://github.com/mvt-project/mvt){: .md-button }
+[:fontawesome-brands-github: GitHub](https://github.com/mvt-project/mvt){: .md-button .md-button--primary } [:fontawesome-brands-python: Python Package](https://pypi.org/project/mvt){: .md-button }
--- a/docs/install.md
+++ b/docs/install.md
@@ -1,6 +1,6 @@
 # Installation

-Before proceeding, please note that mvt requires Python 3.6+ to run. While it should be available on most operating systems, please make sure of that before proceeding.
+Before proceeding, please note that MVT requires Python 3.6+ to run. While it should be available on most operating systems, please make sure of that before proceeding.

 ## Dependencies on Linux

@@ -14,9 +14,9 @@ sudo apt install python3 python3-pip libusb-1.0-0 sqlite3

 When working with Android devices you should additionally install [Android SDK Platform Tools](https://developer.android.com/studio/releases/platform-tools). If you prefer to install a package made available by your distribution of choice, please make sure the version is recent to ensure compatibility with modern Android devices.

-## Dependencies on Mac
+## Dependencies on macOS

-Running MVT on Mac requires Xcode and [homebrew](https://brew.sh) to be installed.
+Running MVT on macOS requires Xcode and [homebrew](https://brew.sh) to be installed.

 In order to install dependencies use:

@@ -26,7 +26,7 @@ brew install python3 libusb sqlite3

 *libusb* is not required if you intend to only use `mvt-ios` and not `mvt-android`.

-When working with Android devices you should additionally install Android SDK Platform Tools:
+When working with Android devices you should additionally install [Android SDK Platform Tools](https://developer.android.com/studio/releases/platform-tools):

 ```bash
 brew install --cask android-platform-tools
--- a/docs/introduction.md
+++ b/docs/introduction.md
@@ -10,6 +10,8 @@ Mobile Verification Toolkit (MVT) is a collection of utilities designed to facil
 - Generate JSON logs of extracted records, and separate JSON logs of all detected malicious traces.
 - Generate a unified chronological timeline of extracted records, along with a timeline all detected malicious traces.

+MVT is a forensic research tool intended for technologists and investigators. Using it requires understanding the basics of forensic analysis and using command-line tools. MVT is not intended for end-user self-assessment. If you are concerned with the security of your device please seek expert assistance.
+
 ## Consensual Forensics

 While MVT is capable of extracting and processing various types of very personal records typically found on a mobile phone (such as calls history, SMS and WhatsApp messages, etc.), this is intended to help identify potential attack vectors such as malicious SMS messages leading to exploitation.
--- a/docs/ios/backup/itunes.md
+++ b/docs/ios/backup/itunes.md
@@ -1,16 +1,16 @@
 # Backup with iTunes app

-It is possible to do an iPhone backup by using iTunes on Windows or Mac computers (in most recent versions of Mac OS, this feature is included in Finder).
+It is possible to do an iPhone backup by using iTunes on Windows or macOS computers (in most recent versions of macOS, this feature is included in Finder).

 To do that:

 * Make sure iTunes is installed.
 * Connect your iPhone to your computer using a Lightning/USB cable.
-* Open the device in iTunes (or Finder on Mac OS).
+* Open the device in iTunes (or Finder on macOS).
 * If you want to have a more accurate detection, ensure that the encrypted backup option is activated and choose a secure password for the backup.
 * Start the backup and wait for it to finish (this may take up to 30 minutes).

 ![](../../../img/macos-backup.jpg)
 _Source: [Apple Support](https://support.apple.com/en-us/HT211229)_

-* Once the backup is done, find its location and copy it to a place where it can be analyzed by `mvt`. On Windows, the backup can be stored either in `%USERPROFILE%\Apple\MobileSync\` or `%USERPROFILE%\AppData\Roaming\Apple Computer\MobileSync\`. On Mac OS, the backup is stored in `~/Library/Application Support/MobileSync/`.
+* Once the backup is done, find its location and copy it to a place where it can be analyzed by MVT. On Windows, the backup can be stored either in `%USERPROFILE%\Apple\MobileSync\` or `%USERPROFILE%\AppData\Roaming\Apple Computer\MobileSync\`. On macOS, the backup is stored in `~/Library/Application Support/MobileSync/`.
--- a/docs/ios/install.md
+++ b/docs/ios/install.md
@@ -1,6 +1,6 @@
 # Install libimobiledevice

-Before proceeding with doing any acquisition of iOS devices we recommend installing [libimobiledevice](https://www.libimobiledevice.org/) utilities. These utilities will become useful when extracting crash logs and generating iTunes backups. Because the utilities and its libraries are subject to frequent changes in response to new versions of iOS, you might want to consider compiling libimobiledevice utilities from sources. Otherwise, if available, you can try installing packages available in your distribution:
+Before proceeding with doing any acquisition of iOS devices we recommend installing [libimobiledevice](https://libimobiledevice.org/) utilities. These utilities will become useful when extracting crash logs and generating iTunes backups. Because the utilities and its libraries are subject to frequent changes in response to new versions of iOS, you might want to consider compiling libimobiledevice utilities from sources. Otherwise, if available, you can try installing packages available in your distribution:

 ```bash
 sudo apt install libimobiledevice-utils
--- a/docs/ios/methodology.md
+++ b/docs/ios/methodology.md
@@ -12,4 +12,4 @@ If you are not expected to return the phone, you might want to consider to attem

 #### iTunes Backup

-An alternative option is to generate an iTunes backup (in most recent version of mac OS, they are no longer launched from iTunes, but directly from Finder). While backups only provide a subset of the files stored on the device, in many cases it might be sufficient to at least detect some suspicious artifacts. Backups encrypted with a password will have some additional interesting records not available in unencrypted ones, such as Safari history, Safari state, etc.
+An alternative option is to generate an iTunes backup (in most recent version of macOS, they are no longer launched from iTunes, but directly from Finder). While backups only provide a subset of the files stored on the device, in many cases it might be sufficient to at least detect some suspicious artifacts. Backups encrypted with a password will have some additional interesting records not available in unencrypted ones, such as Safari history, Safari state, etc.
--- a/docs/ios/records.md
+++ b/docs/ios/records.md
@@ -29,7 +29,7 @@ If indicators are provided through the command-line, they are checked against th
 ### `calls.json`

 !!! info "Availability"
-    Backup: :material-check:  
+    Backup (if encrypted): :material-check:  
    Full filesystem dump: :material-check:

 This JSON file is created by mvt-ios' `Calls` module. The module extracts records from a SQLite database located at */private/var/mobile/Library/CallHistoryDB/CallHistory.storedata*, which contains records of incoming and outgoing calls, including from messaging apps such as WhatsApp or Skype.
@@ -107,17 +107,19 @@ If indicators a provided through the command-line, they are checked against the
 ### `id_status_cache.json`

 !!! info "Availability"
-    Backup: :material-check:  
+    Backup (before iOS 14.7): :material-check:  
    Full filesystem dump: :material-check:

 This JSON file is created by mvt-ios' `IDStatusCache` module. The module extracts records from a plist file located at */private/var/mobile/Library/Preferences/com.apple.identityservices.idstatuscache.plist*, which contains a cache of Apple user ID authentication. This chance will indicate when apps like Facetime and iMessage first established contacts with other registered Apple IDs. This is significant because it might contain traces of malicious accounts involved in exploitation of those apps.

+Starting from iOS 14.7.0, this file is empty or absent.
+
 ---

 ### `interaction_c.json`

 !!! info "Availability"
-    Backup: :material-check:  
+    Backup (if encrypted): :material-check:  
    Full filesystem dump: :material-check:

 This JSON file is created by mvt-ios' `InteractionC` module. The module extracts records from a SQLite database located at */private/var/mobile/Library/CoreDuet/People/interactionC.db*, which contains details about user interactions with installed apps.
@@ -146,6 +148,18 @@ If indicators are provided through the command-line, they are checked against th

 ---

+### `os_analytics_ad_daily.json`
+
+!!! info "Availability"
+    Backup: :material-check:  
+    Full filesystem dump: :material-check:
+
+This JSON file is created by mvt-ios' `OSAnalyticsADDaily` module. The module extracts records from a plist located *private/var/mobile/Library/Preferences/com.apple.osanalytics.addaily.plist*, which contains a history of data usage by processes running on the system. Besides the network statistics, these records are particularly important because they might show traces of malicious process executions and the relevant timeframe.
+
+If indicators are provided through the command-line, they are checked against the process names. Any matches are stored in *os_analytics_ad_daily_detected.json*.
+
+---
+
 ### `datausage.json`

 !!! info "Availability"
@@ -183,7 +197,7 @@ This JSON file is created by mvt-ios' `ProfileEvents` module. The module extract
 ### `safari_browser_state.json`

 !!! info "Availability"
-    Backup: :material-check:  
+    Backup (if encrypted): :material-check:  
    Full filesystem dump: :material-check:

 This JSON file is created by mvt-ios' `SafariBrowserState` module. The module extracts records from the SQLite databases located at */private/var/mobile/Library/Safari/BrowserState.db* or */private/var/mobile/Containers/Data/Application/\*/Library/Safari/BrowserState.db*, which contain records of opened tabs.
@@ -207,7 +221,7 @@ If indicators are provided through the command-line, they are checked against bo
 ### `safari_history.json`

 !!! info "Availability"
-    Backup: :material-check:  
+    Backup (if encrypted): :material-check:  
    Full filesystem dump: :material-check:

 This JSON file is created by mvt-ios' `SafariHistory` module. The module extracts records from the SQLite databases located at */private/var/mobile/Library/Safari/History.db* or */private/var/mobile/Containers/Data/Application/\*/Library/Safari/History.db*, which contain a history of URL visits.
@@ -216,6 +230,18 @@ If indicators are provided through the command-line, they are checked against th

 ---

+### `shutdown_log.json`
+
+!!! info "Availability"
+    Backup (if encrypted): :material-close:  
+    Full filesystem dump: :material-check:
+
+This JSON file is created by mvt-ios' `ShutdownLog` module. The module extracts records from the shutdown log located at *private/var/db/diagnostics/shutdown.log*. When shutting down an iPhone, a SIGTERM will be sent to all processes runnning. The `shutdown.log` file will log any process (with its pid and path) that did not shut down after the SIGTERM was sent. 
+
+If indicators are provided through the command-line, they are checked against the paths. Any matches are stored in *shutdown_log_detected.json*.
+
+---
+
 ### `sms.json`

 !!! info "Availability"
@@ -238,6 +264,16 @@ This JSON file is created by mvt-ios' `SMSAttachments` module. The module extrac

 ---

+### `tcc.json`
+
+!!! info "Availability"
+    Backup: :material-check:  
+    Full filesystem dump: :material-check:
+
+This JSON file is created by mvt-ios' `TCC` module. The module extracts records from a SQLite database located at */private/var/mobile/Library/TCC/TCC.db*, which contains a list of which services such as microphone, camera, or location, apps have been granted or denied access to.
+
+---
+
 ### `version_history.json`

 !!! info "Availability"
--- a/mvt/android/cli.py
+++ b/mvt/android/cli.py
@@ -9,7 +9,9 @@ import os
 import click
 from rich.logging import RichHandler

+from mvt.common.help import *
 from mvt.common.indicators import Indicators, IndicatorsFileBadFormat
+from mvt.common.logo import logo
 from mvt.common.module import run_module, save_timeline

 from .download_apks import DownloadAPKs
@@ -24,15 +26,19 @@ logging.basicConfig(level="INFO", format=LOG_FORMAT, handlers=[
    RichHandler(show_path=False, log_time_format="%X")])
 log = logging.getLogger(__name__)

-# Help messages of repeating options.
-OUTPUT_HELP_MESSAGE = "Specify a path to a folder where you want to store JSON results"
-SERIAL_HELP_MESSAGE = "Specify a device serial number or HOST:PORT connection string"
-
 #==============================================================================
 # Main
 #==============================================================================
@click.group(invoke_without_command=False)
 def cli():
+    logo()
+
+
+#==============================================================================
+# Command: version
+#==============================================================================
+@cli.command("version", help="Show the currently installed version of MVT")
+def version():
    return


@@ -40,9 +46,9 @@ def cli():
 # Download APKs
 #==============================================================================
@cli.command("download-apks", help="Download all or non-safelisted installed APKs installed on the device")
-@click.option("--serial", "-s", type=str, help=SERIAL_HELP_MESSAGE)
+@click.option("--serial", "-s", type=str, help=HELP_MSG_SERIAL)
@click.option("--all-apks", "-a", is_flag=True,
-              help="Extract all packages installed on the phone, even those marked as safe")
+              help="Extract all packages installed on the phone, including system packages")
@click.option("--virustotal", "-v", is_flag=True, help="Check packages on VirusTotal")
@click.option("--koodous", "-k", is_flag=True, help="Check packages on Koodous")
@click.option("--all-checks", "-A", is_flag=True, help="Run all available checks")
@@ -68,7 +74,8 @@ def download_apks(ctx, all_apks, virustotal, koodous, all_checks, output, from_f
                    log.critical("Unable to create output folder %s: %s", output, e)
                    ctx.exit(1)

-            download = DownloadAPKs(output_folder=output, all_apks=all_apks)
+            download = DownloadAPKs(output_folder=output, all_apks=all_apks,
+                                    log=logging.getLogger(DownloadAPKs.__module__))
            if serial:
                download.serial = serial
            download.run()
@@ -92,13 +99,13 @@ def download_apks(ctx, all_apks, virustotal, koodous, all_checks, output, from_f
 # Checks through ADB
 #==============================================================================
@cli.command("check-adb", help="Check an Android device over adb")
-@click.option("--serial", "-s", type=str, help=SERIAL_HELP_MESSAGE)
+@click.option("--serial", "-s", type=str, help=HELP_MSG_SERIAL)
@click.option("--iocs", "-i", type=click.Path(exists=True), multiple=True,
-              default=[], help="Path to indicators file (can be invoked multiple times)")
+              default=[], help=HELP_MSG_IOC)
@click.option("--output", "-o", type=click.Path(exists=False),
-              help="Specify a path to a folder where you want to store JSON results")
-@click.option("--list-modules", "-l", is_flag=True, help="Print list of available modules and exit")
-@click.option("--module", "-m", help="Name of a single module you would like to run instead of all")
+              help=HELP_MSG_OUTPUT)
+@click.option("--list-modules", "-l", is_flag=True, help=HELP_MSG_LIST_MODULES)
+@click.option("--module", "-m", help=HELP_MSG_MODULE)
@click.pass_context
 def check_adb(ctx, iocs, output, list_modules, module, serial):
    if list_modules:
@@ -155,10 +162,10 @@ def check_adb(ctx, iocs, output, list_modules, module, serial):
 # Check ADB backup
 #==============================================================================
@cli.command("check-backup", help="Check an Android Backup")
-@click.option("--serial", "-s", type=str, help=SERIAL_HELP_MESSAGE)
+@click.option("--serial", "-s", type=str, help=HELP_MSG_SERIAL)
@click.option("--iocs", "-i", type=click.Path(exists=True), multiple=True,
-              default=[], help="Path to indicators file (can be invoked multiple times)")
-@click.option("--output", "-o", type=click.Path(exists=False), help=OUTPUT_HELP_MESSAGE)
+              default=[], help=HELP_MSG_IOC)
+@click.option("--output", "-o", type=click.Path(exists=False), help=HELP_MSG_OUTPUT)
@click.argument("BACKUP_PATH", type=click.Path(exists=True))
@click.pass_context
 def check_backup(ctx, iocs, output, backup_path, serial):
--- a/mvt/android/data/safe_packages.txt
+++ b/mvt/android/data/safe_packages.txt
@@ -1,182 +0,0 @@
-android
-android.auto_generated_rro__
-android.autoinstalls.config.google.nexus
-com.android.backupconfirm
-com.android.bips
-com.android.bluetooth
-com.android.bluetoothmidiservice
-com.android.bookmarkprovider
-com.android.calllogbackup
-com.android.captiveportallogin
-com.android.carrierconfig
-com.android.carrierdefaultapp
-com.android.cellbroadcastreceiver
-com.android.certinstaller
-com.android.chrome
-com.android.companiondevicemanager
-com.android.connectivity.metrics
-com.android.cts.ctsshim
-com.android.cts.priv.ctsshim
-com.android.defcontainer
-com.android.documentsui
-com.android.dreams.basic
-com.android.egg
-com.android.emergency
-com.android.externalstorage
-com.android.facelock
-com.android.hotwordenrollment
-com.android.hotwordenrollment.okgoogle
-com.android.hotwordenrollment.tgoogle
-com.android.hotwordenrollment.xgoogle
-com.android.htmlviewer
-com.android.inputdevices
-com.android.keychain
-com.android.location.fused
-com.android.managedprovisioning
-com.android.mms.service
-com.android.mtp
-com.android.musicfx
-com.android.nfc
-com.android.omadm.service
-com.android.pacprocessor
-com.android.phone
-com.android.printspooler
-com.android.providers.blockednumber
-com.android.providers.calendar
-com.android.providers.contacts
-com.android.providers.downloads
-com.android.providers.downloads.ui
-com.android.providers.media
-com.android.providers.partnerbookmarks
-com.android.providers.settings
-com.android.providers.telephony
-com.android.providers.userdictionary
-com.android.proxyhandler
-com.android.retaildemo
-com.android.safetyregulatoryinfo
-com.android.sdm.plugins.connmo
-com.android.sdm.plugins.dcmo
-com.android.sdm.plugins.diagmon
-com.android.sdm.plugins.sprintdm
-com.android.server.telecom
-com.android.service.ims
-com.android.service.ims.presence
-com.android.settings
-com.android.sharedstoragebackup
-com.android.shell
-com.android.statementservice
-com.android.stk
-com.android.systemui
-com.android.systemui.theme.dark
-com.android.vending
-com.android.vpndialogs
-com.android.vzwomatrigger
-com.android.wallpaperbackup
-com.android.wallpaper.livepicker
-com.breel.wallpapers
-com.customermobile.preload.vzw
-com.google.android.apps.cloudprint
-com.google.android.apps.docs
-com.google.android.apps.docs.editors.docs
-com.google.android.apps.enterprise.dmagent
-com.google.android.apps.gcs
-com.google.android.apps.helprtc
-com.google.android.apps.inputmethod.hindi
-com.google.android.apps.maps
-com.google.android.apps.messaging
-com.google.android.apps.nexuslauncher
-com.google.android.apps.photos
-com.google.android.apps.pixelmigrate
-com.google.android.apps.tachyon
-com.google.android.apps.turbo
-com.google.android.apps.tycho
-com.google.android.apps.wallpaper
-com.google.android.apps.wallpaper.nexus
-com.google.android.apps.work.oobconfig
-com.google.android.apps.youtube.vr
-com.google.android.asdiv
-com.google.android.backuptransport
-com.google.android.calculator
-com.google.android.calendar
-com.google.android.carrier
-com.google.android.carrier.authdialog
-com.google.android.carrierentitlement
-com.google.android.carriersetup
-com.google.android.configupdater
-com.google.android.contacts
-com.google.android.deskclock
-com.google.android.dialer
-com.google.android.euicc
-com.google.android.ext.services
-com.google.android.ext.shared
-com.google.android.feedback
-com.google.android.gm
-com.google.android.gms
-com.google.android.gms.policy_auth
-com.google.android.gms.policy_sidecar_o
-com.google.android.gms.setup
-com.google.android.GoogleCamera
-com.google.android.googlequicksearchbox
-com.google.android.gsf
-com.google.android.gsf.login
-com.google.android.hardwareinfo
-com.google.android.hiddenmenu
-com.google.android.ims
-com.google.android.inputmethod.japanese
-com.google.android.inputmethod.korean
-com.google.android.inputmethod.latin
-com.google.android.inputmethod.pinyin
-com.google.android.instantapps.supervisor
-com.google.android.keep
-com.google.android.marvin.talkback
-com.google.android.music
-com.google.android.nexusicons
-com.google.android.onetimeinitializer
-com.google.android.packageinstaller
-com.google.android.partnersetup
-com.google.android.printservice.recommendation
-com.google.android.setupwizard
-com.google.android.soundpicker
-com.google.android.storagemanager
-com.google.android.syncadapters.contacts
-com.google.android.tag
-com.google.android.talk
-com.google.android.tetheringentitlement
-com.google.android.theme.pixel
-com.google.android.tts
-com.google.android.videos
-com.google.android.vr.home
-com.google.android.vr.inputmethod
-com.google.android.webview
-com.google.android.wfcactivation
-com.google.android.youtube
-com.google.ar.core
-com.google.intelligence.sense
-com.google.modemservice
-com.google.pixel.wahoo.gfxdrv
-com.google.SSRestartDetector
-com.google.tango
-com.google.vr.apps.ornament
-com.google.vr.vrcore
-com.htc.omadm.trigger
-com.qti.qualcomm.datastatusnotification
-com.qualcomm.atfwd
-com.qualcomm.embms
-com.qualcomm.fastdormancy
-com.qualcomm.ltebc_vzw
-com.qualcomm.qcrilmsgtunnel
-com.qualcomm.qti.ims
-com.qualcomm.qti.networksetting
-com.qualcomm.qti.telephonyservice
-com.qualcomm.qti.uceShimService
-com.qualcomm.shutdownlistner
-com.qualcomm.timeservice
-com.qualcomm.vzw_api
-com.quicinc.cne.CNEService
-com.verizon.llkagent
-com.verizon.mips.services
-com.verizon.obdm
-com.verizon.obdm_permissions
-com.verizon.services
-com.vzw.apnlib
-qualcomm.com.vzw_msdc_api
--- a/mvt/android/download_apks.py
+++ b/mvt/android/download_apks.py
@@ -11,9 +11,9 @@ import pkg_resources
 from tqdm import tqdm

 from mvt.common.module import InsufficientPrivileges
-from mvt.common.utils import get_sha256_from_file_path

 from .modules.adb.base import AndroidExtraction
+from .modules.adb.packages import Packages

 log = logging.getLogger(__name__)

@@ -29,94 +29,45 @@ class PullProgress(tqdm):
        self.update(current - self.n)


-class Package:
-    """Package indicates a package name and all the files associated with it."""
-
-    def __init__(self, name, files=None):
-        self.name = name
-        self.files = files or []
-
-
 class DownloadAPKs(AndroidExtraction):
    """DownloadAPKs is the main class operating the download of APKs
-    from the device."""
+    from the device.

-    def __init__(self, output_folder=None, all_apks=False, packages=None):
+
+    """
+
+    def __init__(self, output_folder=None, all_apks=False, log=None,
+                 packages=None):
        """Initialize module.
        :param output_folder: Path to the folder where data should be stored
        :param all_apks: Boolean indicating whether to download all packages
                         or filter known-goods
        :param packages: Provided list of packages, typically for JSON checks
        """
-        super().__init__(file_path=None, base_folder=None,
-                         output_folder=output_folder)
+        super().__init__(output_folder=output_folder, log=log)

-        self.output_folder_apk = None
-        self.packages = packages or []
+        self.packages = packages
        self.all_apks = all_apks
-
-        self._safe_packages = []
+        self.output_folder_apk = None

    @classmethod
    def from_json(cls, json_path):
        """Initialize this class from an existing apks.json file.
+
        :param json_path: Path to the apks.json file to parse.
+
        """
        with open(json_path, "r") as handle:
-            data = json.load(handle)
-
-            packages = []
-            for entry in data:
-                package = Package(entry["name"], entry["files"])
-                packages.append(package)
-
+            packages = json.load(handle)
            return cls(packages=packages)

-    def _load_safe_packages(self):
-        """Load known-good package names.
-        """
-        safe_packages_path = os.path.join("data", "safe_packages.txt")
-        safe_packages_string = pkg_resources.resource_string(__name__, safe_packages_path)
-        safe_packages_list = safe_packages_string.decode("utf-8").split("\n")
-        self._safe_packages.extend(safe_packages_list)
-
-    def _clean_output(self, output):
-        """Clean adb shell command output.
-        :param output: Command output to clean.
-        """
-        return output.strip().replace("package:", "")
-
-    def get_packages(self):
-        """Retrieve package names from the device using adb.
-        """
-        log.info("Retrieving package names ...")
-
-        if not self.all_apks:
-            self._load_safe_packages()
-
-        output = self._adb_command("pm list packages")
-        total = 0
-        for line in output.split("\n"):
-            package_name = self._clean_output(line)
-            if package_name == "":
-                continue
-
-            total += 1
-
-            if not self.all_apks and package_name in self._safe_packages:
-                continue
-
-            if package_name not in self.packages:
-                self.packages.append(Package(package_name))
-
-        log.info("There are %d packages installed on the device. I selected %d for inspection.",
-                 total, len(self.packages))
-
    def pull_package_file(self, package_name, remote_path):
        """Pull files related to specific package from the device.
+
        :param package_name: Name of the package to download
        :param remote_path: Path to the file to download
        :returns: Path to the local copy
+
        """
        log.info("Downloading %s ...", remote_path)

@@ -153,68 +104,82 @@ class DownloadAPKs(AndroidExtraction):

        return local_path

-    def pull_packages(self):
-        """Download all files of all selected packages from the device.
+    def get_packages(self):
+        """Use the Packages adb module to retrieve the list of packages.
+        We reuse the same extraction logic to then download the APKs.
+
+
        """
+        self.log.info("Retrieving list of installed packages...")
+
+        m = Packages()
+        m.log = self.log
+        m.run()
+
+        self.packages = m.results
+
+    def pull_packages(self):
+        """Download all files of all selected packages from the device."""
        log.info("Starting extraction of installed APKs at folder %s", self.output_folder)

        if not os.path.exists(self.output_folder):
            os.mkdir(self.output_folder)

+        # If the user provided the flag --all-apks we select all packages.
+        packages_selection = []
+        if self.all_apks:
+            log.info("Selected all %d available packages", len(self.packages))
+            packages_selection = self.packages
+        else:
+            # Otherwise we loop through the packages and get only those that
+            # are not marked as system.
+            for package in self.packages:
+                if not package.get("system", False):
+                    packages_selection.append(package)
+
+            log.info("Selected only %d packages which are not marked as system",
+                len(packages_selection))
+
+        if len(packages_selection) == 0:
+            log.info("No packages were selected for download")
+            return
+
        log.info("Downloading packages from device. This might take some time ...")

        self.output_folder_apk = os.path.join(self.output_folder, "apks")
        if not os.path.exists(self.output_folder_apk):
            os.mkdir(self.output_folder_apk)

-        total_packages = len(self.packages)
        counter = 0
-        for package in self.packages:
+        for package in packages_selection:
            counter += 1

-            log.info("[%d/%d] Package: %s", counter, total_packages, package.name)
-
-            try:
-                output = self._adb_command(f"pm path {package.name}")
-                output = self._clean_output(output)
-                if not output:
-                    continue
-            except Exception as e:
-                log.exception("Failed to get path of package %s: %s", package.name, e)
-                self._adb_reconnect()
-                continue
+            log.info("[%d/%d] Package: %s", counter, len(packages_selection),
+                     package["package_name"])

            # Sometimes the package path contains multiple lines for multiple apks.
            # We loop through each line and download each file.
-            for path in output.split("\n"):
-                device_path = path.strip()
-                file_path = self.pull_package_file(package.name, device_path)
-                if not file_path:
+            for package_file in package["files"]:
+                device_path = package_file["path"]
+                local_path = self.pull_package_file(package["package_name"],
+                                                    device_path)
+                if not local_path:
                    continue

-                # We add the apk metadata to the package object.
-                package.files.append({
-                    "path": device_path,
-                    "local_name": file_path,
-                    "sha256": get_sha256_from_file_path(file_path),
-                })
+                package_file["local_path"] = local_path
+
+        log.info("Download of selected packages completed")

    def save_json(self):
-        """Save the results to the package.json file.
-        """
+        """Save the results to the package.json file."""
        json_path = os.path.join(self.output_folder, "apks.json")
-        packages = []
-        for package in self.packages:
-            packages.append(package.__dict__)
-
        with open(json_path, "w") as handle:
-            json.dump(packages, handle, indent=4)
+            json.dump(self.packages, handle, indent=4)

    def run(self):
-        """Run all steps of fetch-apk.
-        """
-        self._adb_connect()
+        """Run all steps of fetch-apk."""
        self.get_packages()
+        self._adb_connect()
        self.pull_packages()
        self.save_json()
        self._adb_disconnect()
--- a/mvt/android/lookups/koodous.py
+++ b/mvt/android/lookups/koodous.py
@@ -27,12 +27,12 @@ def koodous_lookup(packages):
    total_packages = len(packages)
    for i in track(range(total_packages), description=f"Looking up {total_packages} packages..."):
        package = packages[i]
-        for file in package.files:
+        for file in package.get("files", []):
            url = f"https://api.koodous.com/apks/{file['sha256']}"
            res = requests.get(url)
            report = res.json()

-            row = [package.name, file["local_name"]]
+            row = [package["package_name"], file["path"]]

            if "package_name" in report:
                trusted = "no"
--- a/mvt/android/lookups/virustotal.py
+++ b/mvt/android/lookups/virustotal.py
@@ -41,7 +41,7 @@ def virustotal_lookup(packages):

    unique_hashes = []
    for package in packages:
-        for file in package.files:
+        for file in package.get("files", []):
            if file["sha256"] not in unique_hashes:
                unique_hashes.append(file["sha256"])

@@ -74,8 +74,8 @@ def virustotal_lookup(packages):
    table.add_column("Detections")

    for package in packages:
-        for file in package.files:
-            row = [package.name, file["local_name"]]
+        for file in package.get("files", []):
+            row = [package["package_name"], file["path"]]

            if file["sha256"] in detections:
                detection = detections[file["sha256"]]
--- a/mvt/android/modules/adb/init.py
+++ b/mvt/android/modules/adb/init.py
@@ -5,8 +5,12 @@

 from .chrome_history import ChromeHistory
 from .dumpsys_batterystats import DumpsysBatterystats
+from .dumpsys_full import DumpsysFull
 from .dumpsys_packages import DumpsysPackages
 from .dumpsys_procstats import DumpsysProcstats
+from .dumpsys_receivers import DumpsysReceivers
+from .files import Files
+from .logcat import Logcat
 from .packages import Packages
 from .processes import Processes
 from .rootbinaries import RootBinaries
@@ -15,4 +19,5 @@ from .whatsapp import Whatsapp

 ADB_MODULES = [ChromeHistory, SMS, Whatsapp, Processes,
               DumpsysBatterystats, DumpsysProcstats,
-               DumpsysPackages, Packages, RootBinaries]
+               DumpsysPackages, DumpsysReceivers, DumpsysFull,
+               Packages, RootBinaries, Logcat, Files]
--- a/mvt/android/modules/adb/base.py
+++ b/mvt/android/modules/adb/base.py
@@ -37,9 +37,12 @@ class AndroidExtraction(MVTModule):
        self.device = None
        self.serial = None

-    def _adb_check_keys(self):
-        """Make sure Android adb keys exist.
-        """
+    @staticmethod
+    def _adb_check_keys():
+        """Make sure Android adb keys exist."""
+        if not os.path.isdir(os.path.dirname(ADB_KEY_PATH)):
+            os.path.makedirs(os.path.dirname(ADB_KEY_PATH))
+
        if not os.path.exists(ADB_KEY_PATH):
            keygen(ADB_KEY_PATH)

@@ -47,8 +50,7 @@ class AndroidExtraction(MVTModule):
            write_public_keyfile(ADB_KEY_PATH, ADB_PUB_KEY_PATH)

    def _adb_connect(self):
-        """Connect to the device over adb.
-        """
+        """Connect to the device over adb."""
        self._adb_check_keys()

        with open(ADB_KEY_PATH, "rb") as handle:
@@ -90,47 +92,53 @@ class AndroidExtraction(MVTModule):
                break

    def _adb_disconnect(self):
-        """Close adb connection to the device.
-        """
+        """Close adb connection to the device."""
        self.device.close()

    def _adb_reconnect(self):
-        """Reconnect to device using adb.
-        """
+        """Reconnect to device using adb."""
        log.info("Reconnecting ...")
        self._adb_disconnect()
        self._adb_connect()

    def _adb_command(self, command):
        """Execute an adb shell command.
+
        :param command: Shell command to execute
        :returns: Output of command
+
        """
        return self.device.shell(command)

    def _adb_check_if_root(self):
        """Check if we have a `su` binary on the Android device.
+
+
        :returns: Boolean indicating whether a `su` binary is present or not
+
        """
        return bool(self._adb_command("command -v su"))

    def _adb_root_or_die(self):
-        """Check if we have a `su` binary, otherwise raise an Exception.
-        """
+        """Check if we have a `su` binary, otherwise raise an Exception."""
        if not self._adb_check_if_root():
            raise InsufficientPrivileges("This module is optionally available in case the device is already rooted. Do NOT root your own device!")

    def _adb_command_as_root(self, command):
        """Execute an adb shell command.
+
        :param command: Shell command to execute as root
        :returns: Output of command
+
        """
        return self._adb_command(f"su -c {command}")
-    
+
    def _adb_check_file_exists(self, file):
        """Verify that a file exists.
+
        :param file: Path of the file
        :returns: Boolean indicating whether the file exists or not
+
        """

        # TODO: Need to support checking files without root privileges as well.
@@ -144,9 +152,12 @@ class AndroidExtraction(MVTModule):

    def _adb_download(self, remote_path, local_path, progress_callback=None, retry_root=True):
        """Download a file form the device.
+
        :param remote_path: Path to download from the device
        :param local_path: Path to where to locally store the copy of the file
-        :param progress_callback: Callback for download progress bar
+        :param progress_callback: Callback for download progress bar (Default value = None)
+        :param retry_root: Default value = True)
+
        """
        try:
            self.device.pull(remote_path, local_path, progress_callback)
@@ -155,7 +166,7 @@ class AndroidExtraction(MVTModule):
                self._adb_download_root(remote_path, local_path, progress_callback)
            else:
                raise Exception(f"Unable to download file {remote_path}: {e}")
-    
+
    def _adb_download_root(self, remote_path, local_path, progress_callback=None):
        try:
            # Check if we have root, if not raise an Exception.
@@ -180,16 +191,18 @@ class AndroidExtraction(MVTModule):

            # Delete the copy on /sdcard/.
            self._adb_command(f"rm -rf {new_remote_path}")
-            
+
        except AdbCommandFailureException as e:
            raise Exception(f"Unable to download file {remote_path}: {e}")

    def _adb_process_file(self, remote_path, process_routine):
        """Download a local copy of a file which is only accessible as root.
        This is a wrapper around process_routine.
+
        :param remote_path: Path of the file on the device to process
        :param process_routine: Function to be called on the local copy of the
                                downloaded file
+
        """
        # Connect to the device over adb.
        self._adb_connect()
@@ -223,6 +236,5 @@ class AndroidExtraction(MVTModule):
        self._adb_disconnect()

    def run(self):
-        """Run the main procedure.
-        """
+        """Run the main procedure."""
        raise NotImplementedError
--- a/mvt/android/modules/adb/chrome_history.py
+++ b/mvt/android/modules/adb/chrome_history.py
@@ -33,9 +33,19 @@ class ChromeHistory(AndroidExtraction):
            "data": f"{record['id']} - {record['url']} (visit ID: {record['visit_id']}, redirect source: {record['redirect_source']})"
        }

+    def check_indicators(self):
+        if not self.indicators:
+            return
+
+        for result in self.results:
+            if self.indicators.check_domain(result["url"]):
+                self.detected.append(result)
+
    def _parse_db(self, db_path):
        """Parse a Chrome History database file.
+
        :param db_path: Path to the History database to process.
+
        """
        conn = sqlite3.connect(db_path)
        cur = conn.cursor()
--- a/mvt/android/modules/adb/dumpsys_full.py
+++ b/mvt/android/modules/adb/dumpsys_full.py
@@ -0,0 +1,35 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021 The MVT Project Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+import logging
+import os
+
+from .base import AndroidExtraction
+
+log = logging.getLogger(__name__)
+
+class DumpsysFull(AndroidExtraction):
+    """This module extracts stats on battery consumption by processes."""
+
+    def __init__(self, file_path=None, base_folder=None, output_folder=None,
+                 serial=None, fast_mode=False, log=None, results=[]):
+        super().__init__(file_path=file_path, base_folder=base_folder,
+                         output_folder=output_folder, fast_mode=fast_mode,
+                         log=log, results=results)
+
+    def run(self):
+        self._adb_connect()
+
+        stats = self._adb_command("dumpsys")
+        if self.output_folder:
+            stats_path = os.path.join(self.output_folder,
+                                      "dumpsys.txt")
+            with open(stats_path, "w") as handle:
+                handle.write(stats)
+
+            log.info("Full dumpsys output stored at %s",
+                      stats_path)
+
+        self._adb_disconnect()
--- a/mvt/android/modules/adb/dumpsys_packages.py
+++ b/mvt/android/modules/adb/dumpsys_packages.py
@@ -10,8 +10,9 @@ from .base import AndroidExtraction

 log = logging.getLogger(__name__)

+
 class DumpsysPackages(AndroidExtraction):
-    """This module extracts stats on installed packages."""
+    """This module extracts details on installed packages."""

    def __init__(self, file_path=None, base_folder=None, output_folder=None,
                 serial=None, fast_mode=False, log=None, results=[]):
@@ -23,6 +24,7 @@ class DumpsysPackages(AndroidExtraction):
        self._adb_connect()

        output = self._adb_command("dumpsys package")
+
        if self.output_folder:
            packages_path = os.path.join(self.output_folder,
                                         "dumpsys_packages.txt")
--- a/mvt/android/modules/adb/dumpsys_receivers.py
+++ b/mvt/android/modules/adb/dumpsys_receivers.py
@@ -0,0 +1,87 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021 The MVT Project Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+import logging
+import os
+
+from .base import AndroidExtraction
+
+log = logging.getLogger(__name__)
+
+ACTION_NEW_OUTGOING_SMS = "android.provider.Telephony.NEW_OUTGOING_SMS"
+ACTION_SMS_RECEIVED = "android.provider.Telephony.SMS_RECEIVED"
+ACTION_DATA_SMS_RECEIVED = "android.intent.action.DATA_SMS_RECEIVED"
+ACTION_PHONE_STATE = "android.intent.action.PHONE_STATE"
+
+class DumpsysReceivers(AndroidExtraction):
+    """This module extracts details on receivers for risky activities."""
+
+    def __init__(self, file_path=None, base_folder=None, output_folder=None,
+                 serial=None, fast_mode=False, log=None, results=[]):
+        super().__init__(file_path=file_path, base_folder=base_folder,
+                         output_folder=output_folder, fast_mode=fast_mode,
+                         log=log, results=results)
+
+    def run(self):
+        self._adb_connect()
+
+        output = self._adb_command("dumpsys package")
+        if not output:
+            return
+
+        activity = None
+        for line in output.split("\n"):
+            # Find activity block markers.
+            if line.strip().startswith(ACTION_NEW_OUTGOING_SMS):
+                activity = ACTION_NEW_OUTGOING_SMS
+                continue
+            elif line.strip().startswith(ACTION_SMS_RECEIVED):
+                activity = ACTION_SMS_RECEIVED
+                continue
+            elif line.strip().startswith(ACTION_PHONE_STATE):
+                activity = ACTION_PHONE_STATE
+                continue
+            elif line.strip().startswith(ACTION_DATA_SMS_RECEIVED):
+                activity = ACTION_DATA_SMS_RECEIVED
+                continue
+
+            # If we are not in an activity block yet, skip.
+            if not activity:
+                continue
+
+            # If we are in a block but the line does not start with 8 spaces
+            # it means the block ended a new one started, so we reset and
+            # continue.
+            if not line.startswith(" " * 8):
+                activity = None
+                continue
+
+            # If we got this far, we are processing receivers for the
+            # activities we are interested in.
+            receiver = line.strip().split(" ")[1]
+            package_name = receiver.split("/")[0]
+            if package_name == "com.google.android.gms":
+                continue
+
+            if activity == ACTION_NEW_OUTGOING_SMS:
+                self.log.info("Found a receiver to intercept outgoing SMS messages: \"%s\"",
+                    receiver)
+            elif activity == ACTION_SMS_RECEIVED:
+                self.log.info("Found a receiver to intercept incoming SMS messages: \"%s\"",
+                    receiver)
+            elif activity == ACTION_DATA_SMS_RECEIVED:
+                self.log.info("Found a receiver to intercept incoming data SMS message: \"%s\"",
+                    receiver)
+            elif activity == ACTION_PHONE_STATE:
+                self.log.info("Found a receiver monitoring telephony state: \"%s\"",
+                    receiver)
+
+            self.results.append({
+                "activity": activity,
+                "package_name": package_name,
+                "receiver": receiver,
+            })
+
+        self._adb_disconnect()
--- a/mvt/android/modules/adb/files.py
+++ b/mvt/android/modules/adb/files.py
@@ -0,0 +1,33 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021 The MVT Project Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+import logging
+import os
+
+from .base import AndroidExtraction
+
+log = logging.getLogger(__name__)
+
+class Files(AndroidExtraction):
+    """This module extracts the list of installed packages."""
+
+    def __init__(self, file_path=None, base_folder=None, output_folder=None,
+                 serial=None, fast_mode=False, log=None, results=[]):
+        super().__init__(file_path=file_path, base_folder=base_folder,
+                         output_folder=output_folder, fast_mode=fast_mode,
+                         log=log, results=results)
+
+    def run(self):
+        self._adb_connect()
+
+        output = self._adb_command("find / -type f 2> /dev/null")
+        if output and self.output_folder:
+            files_txt_path = os.path.join(self.output_folder, "files.txt")
+            with open(files_txt_path, "w") as handle:
+                handle.write(output)
+
+            log.info("List of visible files stored at %s", files_txt_path)
+
+        self._adb_disconnect()
--- a/mvt/android/modules/adb/logcat.py
+++ b/mvt/android/modules/adb/logcat.py
@@ -0,0 +1,48 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021 The MVT Project Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+import logging
+import os
+
+from .base import AndroidExtraction
+
+log = logging.getLogger(__name__)
+
+
+class Logcat(AndroidExtraction):
+    """This module extracts details on installed packages."""
+
+    def __init__(self, file_path=None, base_folder=None, output_folder=None,
+                 serial=None, fast_mode=False, log=None, results=[]):
+        super().__init__(file_path=file_path, base_folder=base_folder,
+                         output_folder=output_folder, fast_mode=fast_mode,
+                         log=log, results=results)
+
+    def run(self):
+        self._adb_connect()
+
+        # Get the current logcat.
+        output = self._adb_command("logcat -d")
+        # Get the locat prior to last reboot.
+        last_output = self._adb_command("logcat -L")
+
+        if self.output_folder:
+            logcat_path = os.path.join(self.output_folder,
+                                       "logcat.txt")
+            with open(logcat_path, "w") as handle:
+                handle.write(output)
+
+            log.info("Current logcat logs stored at %s",
+                     logcat_path)
+
+            logcat_last_path = os.path.join(self.output_folder,
+                                            "logcat_last.txt")
+            with open(logcat_last_path, "w") as handle:
+                handle.write(last_output)
+
+            log.info("Logcat logs prior to last reboot stored at %s",
+                     logcat_last_path)
+
+        self._adb_disconnect()
--- a/mvt/android/modules/adb/packages.py
+++ b/mvt/android/modules/adb/packages.py
@@ -44,16 +44,49 @@ class Packages(AndroidExtraction):
        root_packages_path = os.path.join("..", "..", "data", "root_packages.txt")
        root_packages_string = pkg_resources.resource_string(__name__, root_packages_path)
        root_packages = root_packages_string.decode("utf-8").split("\n")
+        root_packages = [rp.strip() for rp in root_packages]

-        for root_package in root_packages:
-            root_package = root_package.strip()
-            if not root_package:
-                continue

-            if root_package in self.results:
+        for result in self.results:
+            if result["package_name"] in root_packages:
                self.log.warning("Found an installed package related to rooting/jailbreaking: \"%s\"",
-                                 root_package)
-                self.detected.append(root_package)
+                                result["package_name"])
+                self.detected.append(result)
+            if result["package_name"] in self.indicators.ioc_app_ids:
+                self.log.warning("Found a malicious package name: \"%s\"",
+                                 result["package_name"])
+                self.detected.append(result)
+                for file in result["files"]:
+                    if file["sha256"] in self.indicators.ioc_files_sha256:
+                        self.log.warning("Found a malicious APK: \"%s\" %s",
+                                         result["package_name"],
+                                         file["sha256"])
+                        self.detected.append(result)
+
+    def _get_files_for_package(self, package_name):
+        output = self._adb_command(f"pm path {package_name}")
+        output = output.strip().replace("package:", "")
+        if not output:
+            return []
+
+        package_files = []
+        for file_path in output.split("\n"):
+            file_path = file_path.strip()
+
+            md5 = self._adb_command(f"md5sum {file_path}").split(" ")[0]
+            sha1 = self._adb_command(f"sha1sum {file_path}").split(" ")[0]
+            sha256 = self._adb_command(f"sha256sum {file_path}").split(" ")[0]
+            sha512 = self._adb_command(f"sha512sum {file_path}").split(" ")[0]
+
+            package_files.append({
+                "path": file_path,
+                "md5": md5,
+                "sha1": sha1,
+                "sha256": sha256,
+                "sha512": sha512,
+            })
+
+        return package_files

    def run(self):
        self._adb_connect()
@@ -75,13 +108,18 @@ class Packages(AndroidExtraction):
                if installer == "null":
                    installer = None

-            uid = fields[2].split(":")[1].strip()
+            try:
+                uid = fields[2].split(":")[1].strip()
+            except IndexError:
+                uid = None

            dumpsys = self._adb_command(f"dumpsys package {package_name} | grep -A2 timeStamp").split("\n")
            timestamp = dumpsys[0].split("=")[1].strip()
            first_install = dumpsys[1].split("=")[1].strip()
            last_update = dumpsys[2].split("=")[1].strip()

+            package_files = self._get_files_for_package(package_name)
+
            self.results.append({
                "package_name": package_name,
                "file_name": file_name,
@@ -93,6 +131,7 @@ class Packages(AndroidExtraction):
                "disabled": False,
                "system": False,
                "third_party": False,
+                "files": package_files,
            })

        cmds = [
--- a/mvt/android/modules/adb/sms.py
+++ b/mvt/android/modules/adb/sms.py
@@ -71,7 +71,9 @@ class SMS(AndroidExtraction):

    def _parse_db(self, db_path):
        """Parse an Android bugle_db SMS database file.
+
        :param db_path: Path to the Android SMS database file to process
+
        """
        conn = sqlite3.connect(db_path)
        cur = conn.cursor()
--- a/mvt/android/modules/adb/whatsapp.py
+++ b/mvt/android/modules/adb/whatsapp.py
@@ -48,7 +48,9 @@ class Whatsapp(AndroidExtraction):

    def _parse_db(self, db_path):
        """Parse an Android msgstore.db WhatsApp database file.
+
        :param db_path: Path to the Android WhatsApp database file to process
+
        """
        conn = sqlite3.connect(db_path)
        cur = conn.cursor()
--- a/mvt/common/help.py
+++ b/mvt/common/help.py
@@ -0,0 +1,14 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021 The MVT Project Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+# Help messages of repeating options.
+HELP_MSG_OUTPUT = "Specify a path to a folder where you want to store JSON results"
+HELP_MSG_IOC = "Path to indicators file (can be invoked multiple time)"
+HELP_MSG_FAST = "Avoid running time/resource consuming features"
+HELP_MSG_LIST_MODULES = "Print list of available modules and exit"
+HELP_MSG_MODULE = "Name of a single module you would like to run instead of all"
+
+# Android-specific.
+HELP_MSG_SERIAL = "Specify a device serial number or HOST:PORT connection string"
--- a/mvt/common/indicators.py
+++ b/mvt/common/indicators.py
@@ -23,6 +23,8 @@ class Indicators:
        self.ioc_processes = []
        self.ioc_emails = []
        self.ioc_files = []
+        self.ioc_files_sha256 = []
+        self.ioc_app_ids = []
        self.ioc_count = 0

    def _add_indicator(self, ioc, iocs_list):
@@ -32,6 +34,9 @@ class Indicators:

    def parse_stix2(self, file_path):
        """Extract indicators from a STIX2 file.
+
+        :param file_path: Path to the STIX2 file to parse
+        :type file_path: str
        """
        self.log.info("Parsing STIX2 indicators file at path %s",
                      file_path)
@@ -63,10 +68,25 @@ class Indicators:
            elif key == "file:name":
                self._add_indicator(ioc=value,
                                    iocs_list=self.ioc_files)
+            elif key == "app:id":
+                self._add_indicator(ioc=value,
+                                    iocs_list=self.ioc_app_ids)
+            elif key == "file:hashes.sha256":
+                self._add_indicator(ioc=value,
+                                    iocs_list=self.ioc_files_sha256)

-    def check_domain(self, url):
+    def check_domain(self, url) -> bool:
+        """Check if a given URL matches any of the provided domain indicators.
+
+        :param url: URL to match against domain indicators
+        :type url: str
+        :returns: True if the URL matched an indicator, otherwise False
+        :rtype: bool
+        """
        # TODO: If the IOC domain contains a subdomain, it is not currently
        # being matched.
+        if not url:
+            return False

        try:
            # First we use the provided URL.
@@ -124,18 +144,33 @@ class Indicators:

                return True

-    def check_domains(self, urls):
-        """Check the provided list of (suspicious) domains against a list of URLs.
-        :param urls: List of URLs to check
+        return False
+
+    def check_domains(self, urls) -> bool:
+        """Check a list of URLs against the provided list of domain indicators.
+
+        :param urls: List of URLs to check against domain indicators
+        :type urls: list
+        :returns: True if any URL matched an indicator, otherwise False
+        :rtype: bool
        """
+        if not urls:
+            return False
+
        for url in urls:
            if self.check_domain(url):
                return True

-    def check_process(self, process):
+        return False
+
+    def check_process(self, process) -> bool:
        """Check the provided process name against the list of process
        indicators.
-        :param process: Process name to check
+
+        :param process: Process name to check against process indicators
+        :type process: str
+        :returns: True if process matched an indicator, otherwise False
+        :rtype: bool
        """
        if not process:
            return False
@@ -151,18 +186,33 @@ class Indicators:
                    self.log.warning("Found a truncated known suspicious process name \"%s\"", process)
                    return True

-    def check_processes(self, processes):
+        return False
+
+    def check_processes(self, processes) -> bool:
        """Check the provided list of processes against the list of
        process indicators.
-        :param processes: List of processes to check
+
+        :param processes: List of processes to check against process indicators
+        :type processes: list
+        :returns: True if process matched an indicator, otherwise False
+        :rtype: bool
        """
+        if not processes:
+            return False
+
        for process in processes:
            if self.check_process(process):
                return True

-    def check_email(self, email):
+        return False
+
+    def check_email(self, email) -> bool:
        """Check the provided email against the list of email indicators.
-        :param email: Suspicious email to check
+
+        :param email: Email address to check against email indicators
+        :type email: str
+        :returns: True if email address matched an indicator, otherwise False
+        :rtype: bool
        """
        if not email:
            return False
@@ -171,9 +221,16 @@ class Indicators:
            self.log.warning("Found a known suspicious email address: \"%s\"", email)
            return True

-    def check_file(self, file_path):
+        return False
+
+    def check_file(self, file_path) -> bool:
        """Check the provided file path against the list of file indicators.
-        :param file_path: Path or name of the file to check
+
+        :param file_path: File path or file name to check against file
+        indicators
+        :type file_path: str
+        :returns: True if the file path matched an indicator, otherwise False
+        :rtype: bool
        """
        if not file_path:
            return False
@@ -182,3 +239,5 @@ class Indicators:
        if file_name in self.ioc_files:
            self.log.warning("Found a known suspicious file: \"%s\"", file_path)
            return True
+
+        return False
--- a/mvt/common/logo.py
+++ b/mvt/common/logo.py
@@ -0,0 +1,25 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021 The MVT Project Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+from rich import print
+
+from .version import MVT_VERSION, check_for_updates
+
+
+def logo():
+    print("\n")
+    print("\t[bold]MVT[/bold] - Mobile Verification Toolkit")
+    print("\t\thttps://mvt.re")
+    print(f"\t\tVersion: {MVT_VERSION}")
+
+    try:
+        latest_version = check_for_updates()
+    except:
+        pass
+    else:
+        if latest_version:
+            print(f"\t\t[bold]Version {latest_version} is available! Upgrade mvt![/bold]")
+
+    print("\n")
--- a/mvt/common/module.py
+++ b/mvt/common/module.py
@@ -4,7 +4,6 @@
 #   https://license.mvt.re/1.1/

 import csv
-import glob
 import io
 import os
 import re
@@ -24,7 +23,8 @@ class InsufficientPrivileges(Exception):
    pass

 class MVTModule(object):
-    """This class provides a base for all extraction modules."""
+    """This class provides a base for all extraction modules.
+    """

    enabled = True
    slug = None
@@ -32,12 +32,18 @@ class MVTModule(object):
    def __init__(self, file_path=None, base_folder=None, output_folder=None,
                 fast_mode=False, log=None, results=[]):
        """Initialize module.
-        :param file_path: Path to the module's database file, if there is any.
+
+        :param file_path: Path to the module's database file, if there is any
+        :type file_path: str
        :param base_folder: Path to the base folder (backup or filesystem dump)
+        :type file_path: str
        :param output_folder: Folder where results will be stored
+        :type output_folder: str
        :param fast_mode: Flag to enable or disable slow modules
+        :type fast_mode: bool
        :param log: Handle to logger
        :param results: Provided list of results entries
+        :type results: list
        """
        self.file_path = file_path
        self.base_folder = base_folder
@@ -60,18 +66,18 @@ class MVTModule(object):
            return cls(results=results, log=log)

    def get_slug(self):
+        """Use the module's class name to retrieve a slug
+        """
        if self.slug:
            return self.slug

        sub = re.sub("(.)([A-Z][a-z]+)", r"\1_\2", self.__class__.__name__)
        return re.sub("([a-z0-9])([A-Z])", r"\1_\2", sub).lower()

-    def load_indicators(self, file_path):
-        self.indicators = Indicators(file_path, self.log)
-
    def check_indicators(self):
        """Check the results of this module against a provided list of
-        indicators."""
+        indicators.
+        """
        raise NotImplementedError

    def save_to_json(self):
@@ -101,9 +107,19 @@ class MVTModule(object):
    def serialize(self, record):
        raise NotImplementedError

-    def to_timeline(self):
-        """Convert results into a timeline.
+    @staticmethod
+    def _deduplicate_timeline(timeline):
+        """Serialize entry as JSON to deduplicate repeated entries
+
+        :param timeline: List of entries from timeline to deduplicate
        """
+        timeline_set = set()
+        for record in timeline:
+            timeline_set.add(json.dumps(record, sort_keys=True))
+        return [json.loads(record) for record in timeline_set]
+
+    def to_timeline(self):
+        """Convert results into a timeline."""
        for result in self.results:
            record = self.serialize(result)
            if record:
@@ -121,15 +137,8 @@ class MVTModule(object):
                    self.timeline_detected.append(record)

        # De-duplicate timeline entries.
-        self.timeline = self.timeline_deduplicate(self.timeline)
-        self.timeline_detected = self.timeline_deduplicate(self.timeline_detected)
-
-    def timeline_deduplicate(self, timeline):
-        """Serialize entry as JSON to deduplicate repeated entries"""
-        timeline_set = set()
-        for record in timeline:
-            timeline_set.add(json.dumps(record, sort_keys=True))
-        return [json.loads(record) for record in timeline_set]
+        self.timeline = self._deduplicate_timeline(self.timeline)
+        self.timeline_detected = self._deduplicate_timeline(self.timeline_detected)

    def run(self):
        """Run the main module procedure.
@@ -151,7 +160,7 @@ def run_module(module):
        module.log.info("There might be no data to extract by module %s: %s",
                        module.__class__.__name__, e)
    except DatabaseCorruptedError as e:
-        module.log.error("The %s module database seems to be corrupted and recovery failed: %s",
+        module.log.error("The %s module database seems to be corrupted: %s",
                         module.__class__.__name__, e)
    except Exception as e:
        module.log.exception("Error in running extraction from module %s: %s",
@@ -178,8 +187,9 @@ def run_module(module):

 def save_timeline(timeline, timeline_path):
    """Save the timeline in a csv file.
-    :param timeline: List of records to order and store.
-    :param timeline_path: Path to the csv file to store the timeline to.
+
+    :param timeline: List of records to order and store
+    :param timeline_path: Path to the csv file to store the timeline to
    """
    with io.open(timeline_path, "a+", encoding="utf-8") as handle:
        csvoutput = csv.writer(handle, delimiter=",", quotechar="\"")
--- a/mvt/common/options.py
+++ b/mvt/common/options.py
@@ -9,8 +9,7 @@ from click import Option, UsageError


 class MutuallyExclusiveOption(Option):
-    """This class extends click to support mutually exclusive options.
-    """
+    """This class extends click to support mutually exclusive options."""

    def __init__(self, *args, **kwargs):
        self.mutually_exclusive = set(kwargs.pop("mutually_exclusive", []))
--- a/mvt/common/url.py
+++ b/mvt/common/url.py
@@ -7,6 +7,7 @@ import requests
 from tld import get_tld

 SHORTENER_DOMAINS = [
+    "1drv.ms",
    "1link.in",
    "1url.com",
    "2big.at",
@@ -15,29 +16,29 @@ SHORTENER_DOMAINS = [
    "2ya.com",
    "4url.cc",
    "6url.com",
+    "a.gg",
+    "a.nf",
    "a2a.me",
    "abbrr.com",
    "adf.ly",
    "adjix.com",
-    "a.gg",
    "alturl.com",
-    "a.nf",
    "atu.ca",
    "b23.ru",
    "bacn.me",
-    "bit.ly",
    "bit.do",
+    "bit.ly",
    "bkite.com",
    "bloat.me",
    "budurl.com",
    "buff.ly",
    "buk.me",
    "burnurl.com",
+    "c-o.in",
    "chilp.it",
    "clck.ru",
-    "clickmeter.com",
    "cli.gs",
-    "c-o.in",
+    "clickmeter.com",
    "cort.as",
    "cut.ly",
    "cuturl.com",
@@ -55,19 +56,20 @@ SHORTENER_DOMAINS = [
    "esyurl.com",
    "ewerl.com",
    "fa.b",
-    "fff.to",
    "ff.im",
+    "fff.to",
    "fhurl.com",
    "fire.to",
    "firsturl.de",
    "flic.kr",
    "fly2.ws",
    "fon.gs",
+    "forms.gle",
    "fwd4.me",
    "gl.am",
-    "go2cut.com",
-    "go2.me",
    "go.9nl.com",
+    "go2.me",
+    "go2cut.com",
    "goo.gl",
    "goshrink.com",
    "gowat.ch",
@@ -77,6 +79,7 @@ SHORTENER_DOMAINS = [
    "hex.io",
    "hover.com",
    "href.in",
+    "ht.ly",
    "htxt.it",
    "hugeurl.com",
    "hurl.it",
@@ -85,8 +88,8 @@ SHORTENER_DOMAINS = [
    "icanhaz.com",
    "idek.net",
    "inreply.to",
-    "iscool.net",
    "is.gd",
+    "iscool.net",
    "iterasi.net",
    "jijr.com",
    "jmp2.net",
@@ -102,10 +105,11 @@ SHORTENER_DOMAINS = [
    "linkbee.com",
    "linkbun.ch",
    "liurl.cn",
-    "lnk.gd",
-    "lnk.in",
    "ln-s.net",
    "ln-s.ru",
+    "lnk.gd",
+    "lnk.in",
+    "lnkd.in",
    "loopt.us",
    "lru.jp",
    "lt.tl",
@@ -122,44 +126,44 @@ SHORTENER_DOMAINS = [
    "nn.nf",
    "notlong.com",
    "nsfw.in",
+    "o-x.fr",
    "om.ly",
    "ow.ly",
-    "o-x.fr",
    "pd.am",
    "pic.gd",
    "ping.fm",
    "piurl.com",
    "pnt.me",
    "poprl.com",
-    "posted.at",
    "post.ly",
+    "posted.at",
    "profile.to",
    "qicute.com",
    "qlnk.net",
    "quip-art.com",
    "rb6.me",
    "redirx.com",
-    "rickroll.it",
    "ri.ms",
+    "rickroll.it",
    "riz.gd",
    "rsmonkey.com",
-    "rubyurl.com",
    "ru.ly",
+    "rubyurl.com",
    "s7y.us",
    "safe.mn",
    "sharein.com",
    "sharetabs.com",
    "shorl.com",
    "short.ie",
+    "short.to",
    "shortlinks.co.uk",
    "shortna.me",
-    "short.to",
    "shorturl.com",
    "shoturl.us",
    "shrinkify.com",
    "shrinkster.com",
-    "shrten.com",
    "shrt.st",
+    "shrten.com",
    "shrunkin.com",
    "shw.me",
    "simurl.com",
@@ -177,20 +181,20 @@ SHORTENER_DOMAINS = [
    "tcrn.ch",
    "thrdl.es",
    "tighturl.com",
-    "tiny123.com",
-    "tinyarro.ws",
    "tiny.cc",
    "tiny.pl",
+    "tiny123.com",
+    "tinyarro.ws",
    "tinytw.it",
    "tinyuri.ca",
    "tinyurl.com",
    "tinyvid.io",
    "tnij.org",
-    "togoto.us",
    "to.ly",
-    "traceurl.com",
+    "togoto.us",
    "tr.im",
    "tr.my",
+    "traceurl.com",
    "turo.us",
    "tweetburner.com",
    "twirl.at",
@@ -200,21 +204,21 @@ SHORTENER_DOMAINS = [
    "twiturl.de",
    "twurl.cc",
    "twurl.nl",
-    "u6e.de",
-    "ub0.cc",
    "u.mavrev.com",
    "u.nu",
+    "u6e.de",
+    "ub0.cc",
    "updating.me",
    "ur1.ca",
+    "url.co.uk",
+    "url.ie",
    "url4.eu",
    "urlao.com",
    "urlbrief.com",
-    "url.co.uk",
    "urlcover.com",
    "urlcut.com",
    "urlenco.de",
    "urlhawk.com",
-    "url.ie",
    "urlkiss.com",
    "urlot.com",
    "urlpire.com",
@@ -227,27 +231,23 @@ SHORTENER_DOMAINS = [
    "wapurl.co.uk",
    "wipi.es",
    "wp.me",
-    "xaddr.com",
    "x.co",
+    "x.se",
+    "xaddr.com",
    "xeeurl.com",
    "xr.com",
    "xrl.in",
    "xrl.us",
-    "x.se",
    "xurl.jp",
    "xzb.cc",
    "yep.it",
    "yfrog.com",
+    "ymlp.com",
    "yweb.com",
    "zi.ma",
    "zi.pe",
    "zipmyurl.com",
    "zz.gd",
-    "ymlp.com",
-    "forms.gle",
-    "ht.ly",
-    "lnkd.in",
-    "1drv.ms",
 ]

 class URL:
@@ -263,8 +263,11 @@ class URL:

    def get_domain(self):
        """Get the domain from a URL.
+
        :param url: URL to parse
-        :returns: Just the domain name extracted from the URL
+        :type url: str
+        :returns: Domain name extracted from URL
+        :rtype: str
        """
        # TODO: Properly handle exception.
        try:
@@ -273,9 +276,12 @@ class URL:
            return None

    def get_top_level(self):
-        """Get only the top level domain from a URL.
+        """Get only the top-level domain from a URL.
+
        :param url: URL to parse
-        :returns: The top level domain extracted from the URL
+        :type url: str
+        :returns: Top-level domain name extracted from URL
+        :rtype: str
        """
        # TODO: Properly handle exception.
        try:
@@ -283,13 +289,20 @@ class URL:
        except:
            return None

-    def check_if_shortened(self):
+    def check_if_shortened(self) -> bool:
+        """Check if the URL is among list of shortener services.
+
+        :returns: True if the URL is shortened, otherwise False
+        :rtype: bool
+        """
        if self.domain.lower() in SHORTENER_DOMAINS:
            self.is_shortened = True

        return self.is_shortened

    def unshorten(self):
+        """Unshorten the URL by requesting an HTTP HEAD response.
+        """
        res = requests.head(self.url)
        if str(res.status_code).startswith("30"):
            return res.headers["Location"]
--- a/mvt/common/utils.py
+++ b/mvt/common/utils.py
@@ -10,8 +10,12 @@ import re

 def convert_mactime_to_unix(timestamp, from_2001=True):
    """Converts Mac Standard Time to a Unix timestamp.
-    :param timestamp: MacTime timestamp (either int or float)
-    :returns: Unix epoch timestamp
+
+    :param timestamp: MacTime timestamp (either int or float).
+    :type timestamp: int
+    :param from_2001: bool: Whether to (Default value = True)
+    :param from_2001: Default value = True)
+    :returns: Unix epoch timestamp.
    """
    if not timestamp:
        return None
@@ -34,8 +38,10 @@ def convert_mactime_to_unix(timestamp, from_2001=True):

 def convert_chrometime_to_unix(timestamp):
    """Converts Chrome timestamp to a Unix timestamp.
-    :param timestamp: Chrome timestamp as int
-    :returns: Unix epoch timestamp
+
+    :param timestamp: Chrome timestamp as int.
+    :type timestamp: int
+    :returns: Unix epoch timestamp.
    """
    epoch_start = datetime.datetime(1601, 1 , 1)
    delta = datetime.timedelta(microseconds=timestamp)
@@ -44,8 +50,11 @@ def convert_chrometime_to_unix(timestamp):

 def convert_timestamp_to_iso(timestamp):
    """Converts Unix timestamp to ISO string.
-    :param timestamp: Unix timestamp
-    :returns: ISO timestamp string in YYYY-mm-dd HH:MM:SS.ms format
+
+    :param timestamp: Unix timestamp.
+    :type timestamp: int
+    :returns: ISO timestamp string in YYYY-mm-dd HH:MM:SS.ms format.
+    :rtype: str
    """
    try:
        return timestamp.strftime("%Y-%m-%d %H:%M:%S.%f")
@@ -54,15 +63,19 @@ def convert_timestamp_to_iso(timestamp):

 def check_for_links(text):
    """Checks if a given text contains HTTP links.
-    :param text: Any provided text
-    :returns: Search results
+
+    :param text: Any provided text.
+    :type text: str
+    :returns: Search results.
    """
    return re.findall("(?P<url>https?://[^\s]+)", text, re.IGNORECASE)

 def get_sha256_from_file_path(file_path):
    """Calculate the SHA256 hash of a file from a file path.
+
    :param file_path: Path to the file to hash
    :returns: The SHA256 hash string
+
    """
    sha256_hash = hashlib.sha256()
    with open(file_path, "rb") as handle:
@@ -75,8 +88,10 @@ def get_sha256_from_file_path(file_path):
 # https://stackoverflow.com/questions/57014259/json-dumps-on-dictionary-with-bytes-for-keys
 def keys_bytes_to_string(obj):
    """Convert object keys from bytes to string.
+
    :param obj: Object to convert from bytes to string.
-    :returns: Converted object.
+    :returns: Object converted to string.
+    :rtype: str
    """
    new_obj = {}
    if not isinstance(obj, dict):
--- a/mvt/common/version.py
+++ b/mvt/common/version.py
@@ -0,0 +1,19 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021 The MVT Project Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+import requests
+from packaging import version
+
+MVT_VERSION = "1.2.10"
+
+def check_for_updates():
+    res = requests.get("https://pypi.org/pypi/mvt/json")
+    data = res.json()
+    latest_version = data.get("info", {}).get("version", "")
+
+    if version.parse(latest_version) > version.parse(MVT_VERSION):
+        return latest_version
+
+    return None
--- a/mvt/ios/cli.py
+++ b/mvt/ios/cli.py
@@ -10,7 +10,9 @@ import click
 from rich.logging import RichHandler
 from rich.prompt import Prompt

+from mvt.common.help import *
 from mvt.common.indicators import Indicators, IndicatorsFileBadFormat
+from mvt.common.logo import logo
 from mvt.common.module import run_module, save_timeline
 from mvt.common.options import MutuallyExclusiveOption

@@ -25,9 +27,6 @@ logging.basicConfig(level="INFO", format=LOG_FORMAT, handlers=[
    RichHandler(show_path=False, log_time_format="%X")])
 log = logging.getLogger(__name__)

-# Help messages of repeating options.
-OUTPUT_HELP_MESSAGE = "Specify a path to a folder where you want to store JSON results"
-
 # Set this environment variable to a password if needed.
 PASSWD_ENV = "MVT_IOS_BACKUP_PASSWORD"

@@ -36,6 +35,14 @@ PASSWD_ENV = "MVT_IOS_BACKUP_PASSWORD"
 #==============================================================================
@click.group(invoke_without_command=False)
 def cli():
+    logo()
+
+
+#==============================================================================
+# Command: version
+#==============================================================================
+@cli.command("version", help="Show the currently installed version of MVT")
+def version():
    return


@@ -122,11 +129,11 @@ def extract_key(password, backup_path, key_file):
 #==============================================================================
@cli.command("check-backup", help="Extract artifacts from an iTunes backup")
@click.option("--iocs", "-i", type=click.Path(exists=True), multiple=True,
-              default=[], help="Path to indicators file (can be invoked multiple time)")
-@click.option("--output", "-o", type=click.Path(exists=False), help=OUTPUT_HELP_MESSAGE)
-@click.option("--fast", "-f", is_flag=True, help="Avoid running time/resource consuming features")
-@click.option("--list-modules", "-l", is_flag=True, help="Print list of available modules and exit")
-@click.option("--module", "-m", help="Name of a single module you would like to run instead of all")
+              default=[], help=HELP_MSG_IOC)
+@click.option("--output", "-o", type=click.Path(exists=False), help=HELP_MSG_OUTPUT)
+@click.option("--fast", "-f", is_flag=True, help=HELP_MSG_FAST)
+@click.option("--list-modules", "-l", is_flag=True, help=HELP_MSG_LIST_MODULES)
+@click.option("--module", "-m", help=HELP_MSG_MODULE)
@click.argument("BACKUP_PATH", type=click.Path(exists=True))
@click.pass_context
 def check_backup(ctx, iocs, output, fast, backup_path, list_modules, module):
@@ -185,11 +192,11 @@ def check_backup(ctx, iocs, output, fast, backup_path, list_modules, module):
 #==============================================================================
@cli.command("check-fs", help="Extract artifacts from a full filesystem dump")
@click.option("--iocs", "-i", type=click.Path(exists=True), multiple=True,
-              default=[], help="Path to indicators file (can be invoked multiple time)")
-@click.option("--output", "-o", type=click.Path(exists=False), help=OUTPUT_HELP_MESSAGE)
-@click.option("--fast", "-f", is_flag=True, help="Avoid running time/resource consuming features")
-@click.option("--list-modules", "-l", is_flag=True, help="Print list of available modules and exit")
-@click.option("--module", "-m", help="Name of a single module you would like to run instead of all")
+              default=[], help=HELP_MSG_IOC)
+@click.option("--output", "-o", type=click.Path(exists=False), help=HELP_MSG_OUTPUT)
+@click.option("--fast", "-f", is_flag=True, help=HELP_MSG_FAST)
+@click.option("--list-modules", "-l", is_flag=True, help=HELP_MSG_LIST_MODULES)
+@click.option("--module", "-m", help=HELP_MSG_MODULE)
@click.argument("DUMP_PATH", type=click.Path(exists=True))
@click.pass_context
 def check_fs(ctx, iocs, output, fast, dump_path, list_modules, module):
@@ -249,9 +256,9 @@ def check_fs(ctx, iocs, output, fast, dump_path, list_modules, module):
 #==============================================================================
@cli.command("check-iocs", help="Compare stored JSON results to provided indicators")
@click.option("--iocs", "-i", type=click.Path(exists=True), multiple=True,
-              default=[], required=True, help="Path to indicators file (can be invoked multiple time)")
-@click.option("--list-modules", "-l", is_flag=True, help="Print list of available modules and exit")
-@click.option("--module", "-m", help="Name of a single module you would like to run instead of all")
+              default=[], required=True, help=HELP_MSG_IOC)
+@click.option("--list-modules", "-l", is_flag=True, help=HELP_MSG_LIST_MODULES)
+@click.option("--module", "-m", help=HELP_MSG_MODULE)
@click.argument("FOLDER", type=click.Path(exists=True))
@click.pass_context
 def check_iocs(ctx, iocs, list_modules, module, folder):
--- a/mvt/ios/decrypt.py
+++ b/mvt/ios/decrypt.py
@@ -8,6 +8,7 @@ import glob
 import logging
 import os
 import shutil
+import sqlite3

 from iOSbackup import iOSbackup

@@ -16,6 +17,8 @@ log = logging.getLogger(__name__)
 class DecryptBackup:
    """This class provides functions to decrypt an encrypted iTunes backup
    using either a password or a key file.
+
+
    """

    def __init__(self, backup_path, dest_path=None):
@@ -30,7 +33,24 @@ class DecryptBackup:

    def can_process(self) -> bool:
        return self._backup is not None
-        
+
+    @staticmethod
+    def is_encrypted(backup_path) -> bool:
+        """Query Manifest.db file to see if it's encrypted or not.
+
+        :param backup_path: Path to the backup to decrypt
+
+        """
+        conn = sqlite3.connect(os.path.join(backup_path, "Manifest.db"))
+        cur = conn.cursor()
+        try:
+            cur.execute("SELECT fileID FROM Files LIMIT 1;")
+        except sqlite3.DatabaseError:
+            return True
+        else:
+            log.critical("The backup does not seem encrypted!")
+            return False
+
    def process_backup(self):
        if not os.path.exists(self.dest_path):
            os.makedirs(self.dest_path)
@@ -79,7 +99,9 @@ class DecryptBackup:

    def decrypt_with_password(self, password):
        """Decrypts an encrypted iOS backup.
+
        :param password: Password to use to decrypt the original backup
+
        """
        log.info("Decrypting iOS backup at path %s with password", self.backup_path)

@@ -94,6 +116,11 @@ class DecryptBackup:
                log.critical("No Manifest.plist in %s, and %d Manifest.plist files in subdirs. Please choose one!",
                             self.backup_path, len(possible))
                return
+
+        # Before proceeding, we check whether the backup is indeed encrypted.
+        if not self.is_encrypted(self.backup_path):
+            return
+
        try:
            self._backup = iOSbackup(udid=os.path.basename(self.backup_path),
                                     cleartextpassword=password,
@@ -110,11 +137,17 @@ class DecryptBackup:

    def decrypt_with_key_file(self, key_file):
        """Decrypts an encrypted iOS backup using a key file.
+
        :param key_file: File to read the key bytes to decrypt the backup
+
        """
        log.info("Decrypting iOS backup at path %s with key file %s",
                 self.backup_path, key_file)

+        # Before proceeding, we check whether the backup is indeed encrypted.
+        if not self.is_encrypted(self.backup_path):
+            return
+
        with open(key_file, "rb") as handle:
            key_bytes = handle.read()

@@ -133,8 +166,7 @@ class DecryptBackup:
            log.critical("Failed to decrypt backup. Did you provide the correct key file?")

    def get_key(self):
-        """Retrieve and prints the encryption key.
-        """
+        """Retrieve and prints the encryption key."""
        if not self._backup:
            return

@@ -144,7 +176,9 @@ class DecryptBackup:

    def write_key(self, key_path):
        """Save extracted key to file.
+
        :param key_path: Path to the file where to write the derived decryption key.
+
        """
        if not self._decryption_key:
            return
--- a/mvt/ios/modules/backup/backup_info.py
+++ b/mvt/ios/modules/backup/backup_info.py
@@ -30,9 +30,9 @@ class BackupInfo(IOSExtraction):
        with open(info_path, "rb") as handle:
            info = plistlib.load(handle)

-        fields = ["Build Version", "Device Name", "Display Name", "GUID",
+        fields = ["Build Version", "Device Name", "Display Name",
                  "GUID", "ICCID", "IMEI", "MEID", "Installed Applications",
-                  "Last Backup Data", "Phone Number", "Product Name",
+                  "Last Backup Date", "Phone Number", "Product Name",
                  "Product Type", "Product Version", "Serial Number",
                  "Target Identifier", "Target Type", "Unique Identifier",
                  "iTunes Version"]
--- a/mvt/ios/modules/backup/configuration_profiles.py
+++ b/mvt/ios/modules/backup/configuration_profiles.py
@@ -3,7 +3,6 @@
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/

-import os
 import plistlib
 from base64 import b64encode

@@ -12,8 +11,7 @@ from ..base import IOSExtraction
 CONF_PROFILES_DOMAIN = "SysSharedContainerDomain-systemgroup.com.apple.configurationprofiles"

 class ConfigurationProfiles(IOSExtraction):
-    """This module extracts the full plist data from configuration profiles.
-    """
+    """This module extracts the full plist data from configuration profiles."""

    def __init__(self, file_path=None, base_folder=None, output_folder=None,
                 fast_mode=False, log=None, results=[]):
--- a/mvt/ios/modules/backup/manifest.py
+++ b/mvt/ios/modules/backup/manifest.py
@@ -27,11 +27,19 @@ class Manifest(IOSExtraction):
    def _get_key(self, dictionary, key):
        """Unserialized plist objects can have keys which are str or byte types
        This is a helper to try fetch a key as both a byte or string type.
+
+        :param dictionary: param key:
+        :param key: 
+
        """
        return dictionary.get(key.encode("utf-8"), None) or dictionary.get(key, None)

-    def _convert_timestamp(self, timestamp_or_unix_time_int):
+    @staticmethod
+    def _convert_timestamp(timestamp_or_unix_time_int):
        """Older iOS versions stored the manifest times as unix timestamps.
+
+        :param timestamp_or_unix_time_int: 
+
        """
        if isinstance(timestamp_or_unix_time_int, datetime.datetime):
            return convert_timestamp_to_iso(timestamp_or_unix_time_int)
@@ -90,7 +98,7 @@ class Manifest(IOSExtraction):
    def run(self):
        manifest_db_path = os.path.join(self.base_folder, "Manifest.db")
        if not os.path.isfile(manifest_db_path):
-            raise DatabaseNotFoundError("Impossible to find the module's database file")
+            raise DatabaseNotFoundError("unable to find backup's Manifest.db")

        self.log.info("Found Manifest.db database at path: %s", manifest_db_path)

@@ -126,7 +134,8 @@ class Manifest(IOSExtraction):
                        "size": self._get_key(file_metadata, "Size"),
                    })
                except:
-                    self.log.exception("Error reading manifest file metadata")
+                    self.log.exception("Error reading manifest file metadata for file with ID %s and relative path %s",
+                                       file_data["fileID"], file_data["relativePath"])
                    pass

            self.results.append(cleaned_metadata)
--- a/mvt/ios/modules/backup/profile_events.py
+++ b/mvt/ios/modules/backup/profile_events.py
@@ -4,7 +4,6 @@
 #   https://license.mvt.re/1.1/

 import plistlib
-from datetime import datetime

 from mvt.common.utils import convert_timestamp_to_iso

@@ -15,6 +14,8 @@ CONF_PROFILES_EVENTS_RELPATH = "Library/ConfigurationProfiles/MCProfileEvents.pl
 class ProfileEvents(IOSExtraction):
    """This module extracts events related to the installation of configuration
    profiles.
+
+
    """

    def __init__(self, file_path=None, base_folder=None, output_folder=None,
--- a/mvt/ios/modules/base.py
+++ b/mvt/ios/modules/base.py
@@ -28,7 +28,9 @@ class IOSExtraction(MVTModule):

    def _recover_sqlite_db_if_needed(self, file_path):
        """Tries to recover a malformed database by running a .clone command.
+
        :param file_path: Path to the malformed database file.
+
        """
        # TODO: Find a better solution.
        conn = sqlite3.connect(file_path)
@@ -49,9 +51,9 @@ class IOSExtraction(MVTModule):
        self.log.info("Database at path %s is malformed. Trying to recover...", file_path)

        if not shutil.which("sqlite3"):
-            raise DatabaseCorruptedError("Unable to recover without sqlite3 binary. Please install sqlite3!")
+            raise DatabaseCorruptedError("failed to recover without sqlite3 binary: please install sqlite3!")
        if '"' in file_path:
-            raise DatabaseCorruptedError(f"Database at path '{file_path}' is corrupted. unable to recover because it has a quotation mark (\") in its name.")
+            raise DatabaseCorruptedError(f"database at path '{file_path}' is corrupted. unable to recover because it has a quotation mark (\") in its name")

        bak_path = f"{file_path}.bak"
        shutil.move(file_path, bak_path)
@@ -59,18 +61,20 @@ class IOSExtraction(MVTModule):
        ret = subprocess.call(["sqlite3", bak_path, f".clone \"{file_path}\""],
                              stdout=subprocess.PIPE, stderr=subprocess.PIPE)
        if ret != 0:
-            raise DatabaseCorruptedError("Recovery of database failed")
+            raise DatabaseCorruptedError("failed to recover database")

        self.log.info("Database at path %s recovered successfully!", file_path)

    def _get_backup_files_from_manifest(self, relative_path=None, domain=None):
        """Locate files from Manifest.db.
-        :param relative_path: Relative path to use as filter from Manifest.db.
-        :param domain: Domain to use as filter from Manifest.db.
+
+        :param relative_path: Relative path to use as filter from Manifest.db. (Default value = None)
+        :param domain: Domain to use as filter from Manifest.db. (Default value = None)
+
        """
        manifest_db_path = os.path.join(self.base_folder, "Manifest.db")
        if not os.path.exists(manifest_db_path):
-            raise Exception("Unable to find backup's Manifest.db")
+            raise DatabaseNotFoundError("unable to find backup's Manifest.db")

        base_sql = "SELECT fileID, domain, relativePath FROM Files WHERE "

@@ -86,7 +90,7 @@ class IOSExtraction(MVTModule):
                elif domain:
                    cur.execute(f"{base_sql} domain = ?;", (domain,))
        except Exception as e:
-            raise Exception("Query to Manifest.db failed: %s", e)
+            raise DatabaseCorruptedError("failed to query Manifest.db: %s", e)

        for row in cur:
            yield {
@@ -116,8 +120,11 @@ class IOSExtraction(MVTModule):
        modules that expect to work with a single SQLite database.
        If a module requires to process multiple databases or files,
        you should use the helper functions above.
+
        :param backup_id: iTunes backup database file's ID (or hash).
-        :param root_paths: Glob patterns for files to seek in filesystem dump.
+        :param root_paths: Glob patterns for files to seek in filesystem dump. (Default value = [])
+        :param backup_ids: Default value = None)
+
        """
        file_path = None
        # First we check if the was an explicit file path specified.
@@ -144,6 +151,6 @@ class IOSExtraction(MVTModule):
        if file_path:
            self.file_path = file_path
        else:
-            raise DatabaseNotFoundError("Unable to find the module's database file")
+            raise DatabaseNotFoundError("unable to find the module's database file")

        self._recover_sqlite_db_if_needed(self.file_path)
--- a/mvt/ios/modules/fs/init.py
+++ b/mvt/ios/modules/fs/init.py
@@ -7,10 +7,12 @@ from .cache_files import CacheFiles
 from .filesystem import Filesystem
 from .net_netusage import Netusage
 from .safari_favicon import SafariFavicon
+from .shutdownlog import ShutdownLog
 from .version_history import IOSVersionHistory
 from .webkit_indexeddb import WebkitIndexedDB
 from .webkit_localstorage import WebkitLocalStorage
 from .webkit_safariviewservice import WebkitSafariViewService

-FS_MODULES = [CacheFiles, Filesystem, Netusage, SafariFavicon, IOSVersionHistory,
-              WebkitIndexedDB, WebkitLocalStorage, WebkitSafariViewService,]
+FS_MODULES = [CacheFiles, Filesystem, Netusage, SafariFavicon, ShutdownLog,
+              IOSVersionHistory, WebkitIndexedDB, WebkitLocalStorage,
+              WebkitSafariViewService,]
--- a/mvt/ios/modules/fs/filesystem.py
+++ b/mvt/ios/modules/fs/filesystem.py
@@ -13,7 +13,10 @@ from ..base import IOSExtraction

 class Filesystem(IOSExtraction):
    """This module extracts creation and modification date of files from a
-    full file-system dump."""
+    full file-system dump.
+
+
+    """

    def __init__(self, file_path=None, base_folder=None, output_folder=None,
                 fast_mode=False, log=None, results=[]):
--- a/mvt/ios/modules/fs/net_netusage.py
+++ b/mvt/ios/modules/fs/net_netusage.py
@@ -14,7 +14,10 @@ NETUSAGE_ROOT_PATHS = [

 class Netusage(NetBase):
    """This class extracts data from netusage.sqlite and attempts to identify
-    any suspicious processes if running on a full filesystem dump."""
+    any suspicious processes if running on a full filesystem dump.
+
+
+    """

    def __init__(self, file_path=None, base_folder=None, output_folder=None,
                 fast_mode=False, log=None, results=[]):
--- a/mvt/ios/modules/fs/shutdownlog.py
+++ b/mvt/ios/modules/fs/shutdownlog.py
@@ -0,0 +1,81 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021 The MVT Project Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+from mvt.common.utils import convert_mactime_to_unix, convert_timestamp_to_iso
+
+from ..base import IOSExtraction
+
+SHUTDOWN_LOG_PATH = [
+    "private/var/db/diagnostics/shutdown.log",
+]
+
+class ShutdownLog(IOSExtraction):
+    """This module extracts processes information from the shutdown log file."""
+
+    def __init__(self, file_path=None, base_folder=None, output_folder=None,
+                 fast_mode=False, log=None, results=[]):
+        super().__init__(file_path=file_path, base_folder=base_folder,
+                         output_folder=output_folder, fast_mode=fast_mode,
+                         log=log, results=results)
+
+    def serialize(self, record):
+        return {
+            "timestamp": record["isodate"],
+            "module": self.__class__.__name__,
+            "event": "shutdown",
+            "data": f"Client {record['client']} with PID {record['pid']} was running when the device was shut down",
+        }
+    
+    def check_indicators(self):
+        if not self.indicators:
+            return
+
+        for result in self.results:
+            for ioc in self.indicators.ioc_processes:
+                parts = result["client"].split("/")
+                if ioc in parts:
+                    self.log.warning("Found mention of a known malicious process \"%s\" in shutdown.log",
+                                     ioc)
+                    self.detected.append(result)
+
+    def process_shutdownlog(self, content):
+        current_processes = []
+        for line in content.split("\n"):
+            line = line.strip()
+
+            if line.startswith("remaining client pid:"):
+                current_processes.append({
+                    "pid": line[line.find("pid: ")+5:line.find(" (")],
+                    "client": line[line.find("(")+1:line.find(")")],
+                })
+            elif line.startswith("SIGTERM: "):
+                try:
+                    mac_timestamp = int(line[line.find("[")+1:line.find("]")])
+                except ValueError:
+                    try:
+                        start = line.find(" @")+2
+                        mac_timestamp = int(line[start:start+10])
+                    except:
+                        mac_timestamp = 0
+
+                timestamp = convert_mactime_to_unix(mac_timestamp, from_2001=False)
+                isodate = convert_timestamp_to_iso(timestamp)
+
+                for current_process in current_processes:
+                    self.results.append({
+                        "isodate": isodate,
+                        "pid": current_process["pid"],
+                        "client": current_process["client"],
+                    })
+
+                current_processes = []
+
+        self.results = sorted(self.results, key=lambda entry: entry["isodate"])
+
+    def run(self):
+        self._find_ios_database(root_paths=SHUTDOWN_LOG_PATH)
+        self.log.info("Found shutdown log at path: %s", self.file_path)
+        with open(self.file_path, "r") as handle:
+            self.process_shutdownlog(handle.read())
--- a/mvt/ios/modules/fs/webkit_indexeddb.py
+++ b/mvt/ios/modules/fs/webkit_indexeddb.py
@@ -11,7 +11,10 @@ WEBKIT_INDEXEDDB_ROOT_PATHS = [

 class WebkitIndexedDB(WebkitBase):
    """This module looks extracts records from WebKit IndexedDB folders,
-    and checks them against any provided list of suspicious domains."""
+    and checks them against any provided list of suspicious domains.
+
+
+    """

    slug = "webkit_indexeddb"

--- a/mvt/ios/modules/fs/webkit_localstorage.py
+++ b/mvt/ios/modules/fs/webkit_localstorage.py
@@ -11,7 +11,10 @@ WEBKIT_LOCALSTORAGE_ROOT_PATHS = [

 class WebkitLocalStorage(WebkitBase):
    """This module looks extracts records from WebKit LocalStorage folders,
-    and checks them against any provided list of suspicious domains."""
+    and checks them against any provided list of suspicious domains.
+
+
+    """

    def __init__(self, file_path=None, base_folder=None, output_folder=None,
                 fast_mode=False, log=None, results=[]):
--- a/mvt/ios/modules/fs/webkit_safariviewservice.py
+++ b/mvt/ios/modules/fs/webkit_safariviewservice.py
@@ -11,7 +11,10 @@ WEBKIT_SAFARIVIEWSERVICE_ROOT_PATHS = [

 class WebkitSafariViewService(WebkitBase):
    """This module looks extracts records from WebKit LocalStorage folders,
-    and checks them against any provided list of suspicious domains."""
+    and checks them against any provided list of suspicious domains.
+
+
+    """

    def __init__(self, file_path=None, base_folder=None, output_folder=None,
                 fast_mode=False, log=None, results=[]):
--- a/mvt/ios/modules/mixed/init.py
+++ b/mvt/ios/modules/mixed/init.py
@@ -13,15 +13,18 @@ from .idstatuscache import IDStatusCache
 from .interactionc import InteractionC
 from .locationd import LocationdClients
 from .net_datausage import Datausage
+from .osanalytics_addaily import OSAnalyticsADDaily
 from .safari_browserstate import SafariBrowserState
 from .safari_history import SafariHistory
 from .sms import SMS
 from .sms_attachments import SMSAttachments
+from .tcc import TCC
 from .webkit_resource_load_statistics import WebkitResourceLoadStatistics
 from .webkit_session_resource_log import WebkitSessionResourceLog
 from .whatsapp import Whatsapp

 MIXED_MODULES = [Calls, ChromeFavicon, ChromeHistory, Contacts, FirefoxFavicon,
                 FirefoxHistory, IDStatusCache, InteractionC, LocationdClients,
-                 Datausage, SafariBrowserState, SafariHistory, SMS, SMSAttachments,
-                 WebkitResourceLoadStatistics, WebkitSessionResourceLog, Whatsapp,]
+                 OSAnalyticsADDaily, Datausage, SafariBrowserState, SafariHistory,
+                 TCC, SMS, SMSAttachments, WebkitResourceLoadStatistics,
+                 WebkitSessionResourceLog, Whatsapp,]
--- a/mvt/ios/modules/mixed/firefox_history.py
+++ b/mvt/ios/modules/mixed/firefox_history.py
@@ -19,7 +19,10 @@ FIREFOX_HISTORY_ROOT_PATHS = [

 class FirefoxHistory(IOSExtraction):
    """This module extracts all Firefox visits and tries to detect potential
-    network injection attacks."""
+    network injection attacks.
+
+
+    """

    def __init__(self, file_path=None, base_folder=None, output_folder=None,
                 fast_mode=False, log=None, results=[]):
--- a/mvt/ios/modules/mixed/idstatuscache.py
+++ b/mvt/ios/modules/mixed/idstatuscache.py
@@ -15,6 +15,7 @@ IDSTATUSCACHE_BACKUP_IDS = [
 ]
 IDSTATUSCACHE_ROOT_PATHS = [
    "private/var/mobile/Library/Preferences/com.apple.identityservices.idstatuscache.plist",
+    "private/var/mobile/Library/IdentityServices/idstatuscache.plist",
 ]

 class IDStatusCache(IOSExtraction):
@@ -50,12 +51,8 @@ class IDStatusCache(IOSExtraction):
                                 result.get("user"))
                self.detected.append(result)

-    def run(self):
-        self._find_ios_database(backup_ids=IDSTATUSCACHE_BACKUP_IDS,
-                                root_paths=IDSTATUSCACHE_ROOT_PATHS)
-        self.log.info("Found IDStatusCache plist at path: %s", self.file_path)
-
-        with open(self.file_path, "rb") as handle:
+    def _extract_idstatuscache_entries(self, file_path):
+        with open(file_path, "rb") as handle:
            file_plist = plistlib.load(handle)

        id_status_cache_entries = []
@@ -83,4 +80,16 @@ class IDStatusCache(IOSExtraction):
            entry["occurrences"] = entry_counter[entry["user"]]
            self.results.append(entry)

+    def run(self):
+
+        if self.is_backup:
+            self._find_ios_database(backup_ids=IDSTATUSCACHE_BACKUP_IDS)
+            self.log.info("Found IDStatusCache plist at path: %s", self.file_path)
+            self._extract_idstatuscache_entries(self.file_path)
+        elif self.is_fs_dump:
+            for idstatuscache_path in self._get_fs_files_from_patterns(IDSTATUSCACHE_ROOT_PATHS):
+                self.file_path = idstatuscache_path
+                self.log.info("Found IDStatusCache plist at path: %s", self.file_path)
+                self._extract_idstatuscache_entries(self.file_path)
+            
        self.log.info("Extracted a total of %d ID Status Cache entries", len(self.results))
--- a/mvt/ios/modules/mixed/locationd.py
+++ b/mvt/ios/modules/mixed/locationd.py
@@ -14,10 +14,11 @@ LOCATIOND_BACKUP_IDS = [
 ]
 LOCATIOND_ROOT_PATHS = [
    "private/var/mobile/Library/Caches/locationd/clients.plist",
+    "private/var/root/Library/Caches/locationd/clients.plist"
 ]

 class LocationdClients(IOSExtraction):
-    """Extract information from apps who used geolocation"""
+    """Extract information from apps who used geolocation."""

    def __init__(self, file_path=None, base_folder=None, output_folder=None,
                 fast_mode=False, log=None, results=[]):
@@ -50,22 +51,40 @@ class LocationdClients(IOSExtraction):

        return records

-    def run(self):
-        self._find_ios_database(backup_ids=LOCATIOND_BACKUP_IDS,
-                                root_paths=LOCATIOND_ROOT_PATHS)
-        self.log.info("Found Locationd Clients plist at path: %s", self.file_path)
+    def check_indicators(self):
+        if not self.indicators:
+            return

-        with open(self.file_path, "rb") as handle:
+        for result in self.results:
+            parts = result["package"].split("/")
+            proc_name = parts[len(parts)-1]
+
+            if self.indicators.check_process(proc_name):
+                self.detected.append(result)
+
+    def _extract_locationd_entries(self, file_path):
+        with open(file_path, "rb") as handle:
            file_plist = plistlib.load(handle)

-        for app in file_plist:
-            if file_plist[app] is dict:
-                result = file_plist[app]
-                result["package"] = app
-                for ts in self.timestamps:
-                    if ts in result.keys():
-                        result[ts] = convert_timestamp_to_iso(convert_mactime_to_unix(result[ts]))
+        for key, values in file_plist.items():
+            result = file_plist[key]
+            result["package"] = key
+            for ts in self.timestamps:
+                if ts in result.keys():
+                    result[ts] = convert_timestamp_to_iso(convert_mactime_to_unix(result[ts]))

-                self.results.append(result)
+            self.results.append(result)
+
+    def run(self):
+
+        if self.is_backup:
+            self._find_ios_database(backup_ids=LOCATIOND_BACKUP_IDS)
+            self.log.info("Found Locationd Clients plist at path: %s", self.file_path)
+            self._extract_locationd_entries(self.file_path)
+        elif self.is_fs_dump:
+            for locationd_path in self._get_fs_files_from_patterns(LOCATIOND_ROOT_PATHS):
+                self.file_path = locationd_path
+                self.log.info("Found Locationd Clients plist at path: %s", self.file_path)
+                self._extract_locationd_entries(self.file_path)

        self.log.info("Extracted a total of %d Locationd Clients entries", len(self.results))
--- a/mvt/ios/modules/mixed/net_datausage.py
+++ b/mvt/ios/modules/mixed/net_datausage.py
@@ -14,7 +14,10 @@ DATAUSAGE_ROOT_PATHS = [

 class Datausage(NetBase):
    """This class extracts data from DataUsage.sqlite and attempts to identify
-    any suspicious processes if running on a full filesystem dump."""
+    any suspicious processes if running on a full filesystem dump.
+
+
+    """

    def __init__(self, file_path=None, base_folder=None, output_folder=None,
                 fast_mode=False, log=None, results=[]):
--- a/mvt/ios/modules/mixed/osanalytics_addaily.py
+++ b/mvt/ios/modules/mixed/osanalytics_addaily.py
@@ -0,0 +1,64 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021 The MVT Project Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+import plistlib
+
+from mvt.common.utils import convert_timestamp_to_iso
+
+from ..base import IOSExtraction
+
+OSANALYTICS_ADDAILY_BACKUP_IDS = [
+    "f65b5fafc69bbd3c60be019c6e938e146825fa83",
+]
+OSANALYTICS_ADDAILY_ROOT_PATHS = [
+    "private/var/mobile/Library/Preferences/com.apple.osanalytics.addaily.plist",
+]
+
+class OSAnalyticsADDaily(IOSExtraction):
+    """Extract network usage information by process, from com.apple.osanalytics.addaily.plist"""
+
+    def __init__(self, file_path=None, base_folder=None, output_folder=None,
+                 fast_mode=False, log=None, results=[]):
+        super().__init__(file_path=file_path, base_folder=base_folder,
+                         output_folder=output_folder, fast_mode=fast_mode,
+                         log=log, results=results)
+
+    def serialize(self, record):
+        record_data = f"{record['package']} WIFI IN: {record['wifi_in']}, WIFI OUT: {record['wifi_out']} - "  \
+                      f"WWAN IN: {record['wwan_in']}, WWAN OUT: {record['wwan_out']}"
+        return {
+            "timestamp": record["ts"],
+            "module": self.__class__.__name__,
+            "event": "osanalytics_addaily",
+            "data": record_data,
+        }
+    
+    def check_indicators(self):
+        if not self.indicators:
+            return
+
+        for result in self.results:
+            if self.indicators.check_process(result["package"]):
+                    self.detected.append(result)
+
+    def run(self):
+        self._find_ios_database(backup_ids=OSANALYTICS_ADDAILY_BACKUP_IDS,
+                                root_paths=OSANALYTICS_ADDAILY_ROOT_PATHS)
+        self.log.info("Found com.apple.osanalytics.addaily plist at path: %s", self.file_path)
+
+        with open(self.file_path, "rb") as handle:
+            file_plist = plistlib.load(handle)
+
+        for app, values in file_plist.get("netUsageBaseline", {}).items():
+            self.results.append({
+                "package": app,
+                "ts": convert_timestamp_to_iso(values[0]),
+                "wifi_in": values[1],
+                "wifi_out": values[2],
+                "wwan_in": values[3],
+                "wwan_out": values[4],
+            })
+
+        self.log.info("Extracted a total of %d com.apple.osanalytics.addaily entries", len(self.results))
--- a/mvt/ios/modules/mixed/safari_browserstate.py
+++ b/mvt/ios/modules/mixed/safari_browserstate.py
@@ -13,9 +13,6 @@ from mvt.common.utils import (convert_mactime_to_unix,

 from ..base import IOSExtraction

-SAFARI_BROWSER_STATE_BACKUP_IDS = [
-    "3a47b0981ed7c10f3e2800aa66bac96a3b5db28e",
-]
 SAFARI_BROWSER_STATE_BACKUP_RELPATH = "Library/Safari/BrowserState.db"
 SAFARI_BROWSER_STATE_ROOT_PATHS = [
    "private/var/mobile/Library/Safari/BrowserState.db",
@@ -101,12 +98,17 @@ class SafariBrowserState(IOSExtraction):
            })

    def run(self):
-        # TODO: Is there really only one BrowserState.db in a device?
-        self._find_ios_database(backup_ids=SAFARI_BROWSER_STATE_BACKUP_IDS,
-                                root_paths=SAFARI_BROWSER_STATE_ROOT_PATHS)
-        self.log.info("Found Safari browser state database at path: %s", self.file_path)

-        self._process_browser_state_db(self.file_path)
+        if self.is_backup:
+            for backup_file in self._get_backup_files_from_manifest(relative_path=SAFARI_BROWSER_STATE_BACKUP_RELPATH):
+                self.file_path = self._get_backup_file_from_id(backup_file["file_id"])
+                self.log.info("Found Safari browser state database at path: %s", self.file_path)
+                self._process_browser_state_db(self.file_path)
+        elif self.is_fs_dump:
+            for safari_browserstate_path in self._get_fs_files_from_patterns(SAFARI_BROWSER_STATE_ROOT_PATHS):
+                self.file_path = safari_browserstate_path
+                self.log.info("Found Safari browser state database at path: %s", self.file_path)
+                self._process_browser_state_db(self.file_path)

        self.log.info("Extracted a total of %d tab records and %d session history entries",
                      len(self.results), self._session_history_count)
--- a/mvt/ios/modules/mixed/safari_history.py
+++ b/mvt/ios/modules/mixed/safari_history.py
@@ -19,7 +19,10 @@ SAFARI_HISTORY_ROOT_PATHS = [

 class SafariHistory(IOSExtraction):
    """This module extracts all Safari visits and tries to detect potential
-    network injection attacks."""
+    network injection attacks.
+
+
+    """

    def __init__(self, file_path=None, base_folder=None, output_folder=None,
                 fast_mode=False, log=None, results=[]):
@@ -80,6 +83,7 @@ class SafariHistory(IOSExtraction):
                self.detected.append(result)

    def _process_history_db(self, history_path):
+        self._recover_sqlite_db_if_needed(history_path)
        conn = sqlite3.connect(history_path)
        cur = conn.cursor()
        cur.execute("""
--- a/mvt/ios/modules/mixed/tcc.py
+++ b/mvt/ios/modules/mixed/tcc.py
@@ -0,0 +1,90 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021 The MVT Project Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+import sqlite3
+from datetime import datetime
+
+from mvt.common.utils import convert_timestamp_to_iso
+
+from ..base import IOSExtraction
+
+TCC_BACKUP_IDS = [
+    "64d0019cb3d46bfc8cce545a8ba54b93e7ea9347",
+]
+TCC_ROOT_PATHS = [
+    "private/var/mobile/Library/TCC/TCC.db",
+]
+
+AUTH_VALUES = {
+    0: "denied",
+    1: "unknown",
+    2: "allowed",
+    3: "limited",
+}
+AUTH_REASONS = {
+    1: "error",
+    2: "user_consent",
+    3: "user_set",
+    4: "system_set",
+    5: "service_policy",
+    6: "mdm_policy",
+    7: "override_policy",
+    8: "missing_usage_string",
+    9: "prompt_timeout",
+    10: "preflight_unknown",
+    11: "entitled",
+    12: "app_type_policy",
+}
+
+class TCC(IOSExtraction):
+    """This module extracts records from the TCC.db SQLite database."""
+
+    def __init__(self, file_path=None, base_folder=None, output_folder=None,
+                 fast_mode=False, log=None, results=[]):
+        super().__init__(file_path=file_path, base_folder=base_folder,
+                         output_folder=output_folder, fast_mode=fast_mode,
+                         log=log, results=results)
+
+    def process_db(self, file_path):
+        conn = sqlite3.connect(file_path)
+        cur = conn.cursor()
+        cur.execute("""SELECT 
+            service, client, client_type, auth_value, auth_reason, last_modified
+        FROM access;""")
+
+        for row in cur:
+            service = row[0]
+            client = row[1]
+            client_type = row[2]
+            client_type_desc = "bundle_id" if client_type == 0 else "absolute_path"
+            auth_value = row[3]
+            auth_value_desc = AUTH_VALUES.get(auth_value, "")
+            auth_reason = row[4]
+            auth_reason_desc = AUTH_REASONS.get(auth_reason, "unknown")
+            last_modified = convert_timestamp_to_iso(datetime.utcfromtimestamp((row[5])))
+
+            if service in ["kTCCServiceMicrophone", "kTCCServiceCamera"]:
+                device = "microphone" if service == "kTCCServiceMicrophone" else "camera"
+                self.log.info("Found client \"%s\" with access %s to %s on %s by %s",
+                              client, auth_value_desc, device, last_modified, auth_reason_desc)
+
+            self.results.append({
+                "service": service,
+                "client": client,
+                "client_type": client_type_desc,
+                "auth_value": auth_value_desc,
+                "auth_reason_desc": auth_reason_desc,
+                "last_modified": last_modified,
+            })
+
+        cur.close()
+        conn.close()
+
+    def run(self):
+        self._find_ios_database(backup_ids=TCC_BACKUP_IDS, root_paths=TCC_ROOT_PATHS)
+        self.log.info("Found TCC database at path: %s", self.file_path)
+        self.process_db(self.file_path)
+
+        self.log.info("Extracted a total of %d TCC items", len(self.results))
--- a/mvt/ios/modules/mixed/webkit_resource_load_statistics.py
+++ b/mvt/ios/modules/mixed/webkit_resource_load_statistics.py
@@ -18,8 +18,7 @@ WEBKIT_RESOURCELOADSTATICS_ROOT_PATHS = [
 ]

 class WebkitResourceLoadStatistics(IOSExtraction):
-    """This module extracts records from WebKit ResourceLoadStatistics observations.db.
-    """
+    """This module extracts records from WebKit ResourceLoadStatistics observations.db."""
    # TODO: Add serialize().

    def __init__(self, file_path=None, base_folder=None, output_folder=None,
@@ -75,7 +74,7 @@ class WebkitResourceLoadStatistics(IOSExtraction):
        if self.is_backup:
            try:
                for backup_file in self._get_backup_files_from_manifest(relative_path=WEBKIT_RESOURCELOADSTATICS_BACKUP_RELPATH):
-                    db_path = os.path.join(self.base_folder, backup_file["file_id"][0:2], backup_file["file_id"])
+                    db_path = self._get_backup_file_from_id(backup_file["file_id"])
                    key = f"{backup_file['domain']}/{WEBKIT_RESOURCELOADSTATICS_BACKUP_RELPATH}"
                    self._process_observations_db(db_path=db_path, key=key)
            except Exception as e:
--- a/mvt/ios/modules/mixed/webkit_session_resource_log.py
+++ b/mvt/ios/modules/mixed/webkit_session_resource_log.py
@@ -3,7 +3,6 @@
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/

-import glob
 import os
 import plistlib

@@ -24,7 +23,10 @@ WEBKIT_SESSION_RESOURCE_LOG_ROOT_PATHS = [
 class WebkitSessionResourceLog(IOSExtraction):
    """This module extracts records from WebKit browsing session
    resource logs, and checks them against any provided list of
-    suspicious domains."""
+    suspicious domains.
+
+
+    """

    def __init__(self, file_path=None, base_folder=None, output_folder=None,
                 fast_mode=False, log=None, results=[]):
@@ -114,7 +116,10 @@ class WebkitSessionResourceLog(IOSExtraction):

    def run(self):
        if self.is_backup:
-            for log_path in self._get_backup_files_from_manifest(relative_path=WEBKIT_SESSION_RESOURCE_LOG_BACKUP_RELPATH):
+            for log_file in self._get_backup_files_from_manifest(relative_path=WEBKIT_SESSION_RESOURCE_LOG_BACKUP_RELPATH):
+                log_path = self._get_backup_file_from_id(log_file["file_id"])
+                if not log_path:
+                    continue
                self.log.info("Found Safari browsing session resource log at path: %s", log_path)
                self.results[log_path] = self._extract_browsing_stats(log_path)
        elif self.is_fs_dump:
--- a/mvt/ios/modules/net_base.py
+++ b/mvt/ios/modules/net_base.py
@@ -145,14 +145,15 @@ class NetBase(IOSExtraction):
                    self.log.debug("Located at %s", binary_path)
                else:
                    msg = f"Could not find the binary associated with the process with name {proc['proc_name']}"
-                    if len(proc["proc_name"]) == 16:
+                    if (proc["proc_name"] is None):
+                        msg = f"Found process entry with empty 'proc_name' : {proc['live_proc_id']} at {proc['live_isodate']}"
+                    elif len(proc["proc_name"]) == 16:
                        msg = msg + " (However, the process name might have been truncated in the database)"

                    self.log.warning(msg)

    def check_manipulated(self):
-        """Check for missing or manipulate DB entries
-        """
+        """Check for missing or manipulate DB entries"""
        # Don't show duplicates for each missing process.
        missing_process_cache = set()
        for result in sorted(self.results, key=operator.itemgetter("live_isodate")):
--- a/mvt/ios/versions.py
+++ b/mvt/ios/versions.py
@@ -4,40 +4,40 @@
 #   https://license.mvt.re/1.1/

 IPHONE_MODELS = [
-    {"description": "iPhone 4S", "identifier": "iPhone4,1"},
-    {"description": "iPhone 5", "identifier": "iPhone5,1"},
-    {"description": "iPhone 5", "identifier": "iPhone5,2"},
-    {"description": "iPhone 5c", "identifier": "iPhone5,3"},
-    {"description": "iPhone 5c", "identifier": "iPhone5,4"},
-    {"description": "iPhone 5s", "identifier": "iPhone6,1"},
-    {"description": "iPhone 5s", "identifier": "iPhone6,2"},
-    {"description": "iPhone 6 Plus", "identifier": "iPhone7,1"},
-    {"description": "iPhone 6", "identifier": "iPhone7,2"},
-    {"description": "iPhone 6s", "identifier": "iPhone8,1"},
-    {"description": "iPhone 6s Plus", "identifier": "iPhone8,2"},
-    {"description": "iPhone SE (1st generation)", "identifier": "iPhone8,4"},
-    {"description": "iPhone 7", "identifier": "iPhone9,1"},
-    {"description": "iPhone 7 Plus", "identifier": "iPhone9,2"},
-    {"description": "iPhone 7", "identifier": "iPhone9,3"},
-    {"description": "iPhone 7 Plus", "identifier": "iPhone9,4"},
-    {"description": "iPhone 8", "identifier": "iPhone10,1"},
-    {"description": "iPhone 8 Plus", "identifier": "iPhone10,2"},
-    {"description": "iPhone X", "identifier": "iPhone10,3"},
-    {"description": "iPhone 8", "identifier": "iPhone10,4"},
-    {"description": "iPhone 8 Plus", "identifier": "iPhone10,5"},
-    {"description": "iPhone X", "identifier": "iPhone10,6"},
-    {"description": "iPhone XS", "identifier": "iPhone11,2"},
-    {"description": "iPhone XS Max", "identifier": "iPhone11,4"},
-    {"description": "iPhone XS Max", "identifier": "iPhone11,6"},
-    {"description": "iPhone XR", "identifier": "iPhone11,8"},
-    {"description": "iPhone 11", "identifier": "iPhone12,1"},
-    {"description": "iPhone 11 Pro", "identifier": "iPhone12,3"},
-    {"description": "iPhone 11 Pro Max", "identifier": "iPhone12,5"},
-    {"description": "iPhone SE (2nd generation)", "identifier": "iPhone12,8"},
-    {"description": "iPhone 12 mini", "identifier": "iPhone13,1"},
-    {"description": "iPhone 12", "identifier": "iPhone13,2"},
-    {"description": "iPhone 12 Pro", "identifier": "iPhone13,3"},
-    {"description": "iPhone 12 Pro Max", "identifier": "iPhone13,4"},
+    {"identifier": "iPhone4,1", "description": "iPhone 4S"},
+    {"identifier": "iPhone5,1", "description": "iPhone 5"},
+    {"identifier": "iPhone5,2", "description": "iPhone 5"},
+    {"identifier": "iPhone5,3", "description": "iPhone 5c"},
+    {"identifier": "iPhone5,4", "description": "iPhone 5c"},
+    {"identifier": "iPhone6,1", "description": "iPhone 5s"},
+    {"identifier": "iPhone6,2", "description": "iPhone 5s"},
+    {"identifier": "iPhone7,1", "description": "iPhone 6 Plus"},
+    {"identifier": "iPhone7,2", "description": "iPhone 6"},
+    {"identifier": "iPhone8,1", "description": "iPhone 6s"},
+    {"identifier": "iPhone8,2", "description": "iPhone 6s Plus"},
+    {"identifier": "iPhone8,4", "description": "iPhone SE (1st generation)"},
+    {"identifier": "iPhone9,1", "description": "iPhone 7"},
+    {"identifier": "iPhone9,2", "description": "iPhone 7 Plus"},
+    {"identifier": "iPhone9,3", "description": "iPhone 7"},
+    {"identifier": "iPhone9,4", "description": "iPhone 7 Plus"},
+    {"identifier": "iPhone10,1", "description": "iPhone 8"},
+    {"identifier": "iPhone10,2", "description": "iPhone 8 Plus"},
+    {"identifier": "iPhone10,3", "description": "iPhone X"},
+    {"identifier": "iPhone10,4", "description": "iPhone 8"},
+    {"identifier": "iPhone10,5", "description": "iPhone 8 Plus"},
+    {"identifier": "iPhone10,6", "description": "iPhone X"},
+    {"identifier": "iPhone11,2", "description": "iPhone XS"},
+    {"identifier": "iPhone11,4", "description": "iPhone XS Max"},
+    {"identifier": "iPhone11,6", "description": "iPhone XS Max"},
+    {"identifier": "iPhone11,8", "description": "iPhone XR"},
+    {"identifier": "iPhone12,1", "description": "iPhone 11"},
+    {"identifier": "iPhone12,3", "description": "iPhone 11 Pro"},
+    {"identifier": "iPhone12,5", "description": "iPhone 11 Pro Max"},
+    {"identifier": "iPhone12,8", "description": "iPhone SE (2nd generation)"},
+    {"identifier": "iPhone13,1", "description": "iPhone 12 mini"},
+    {"identifier": "iPhone13,2", "description": "iPhone 12"},
+    {"identifier": "iPhone13,3", "description": "iPhone 12 Pro"},
+    {"identifier": "iPhone13,4", "description": "iPhone 12 Pro Max"},
 ]

 IPHONE_IOS_VERSIONS = [
@@ -222,6 +222,8 @@ IPHONE_IOS_VERSIONS = [
    {"build": "18F72", "version": "14.6"},
    {"build": "18G69", "version": "14.7"},
    {"build": "18G82", "version": "14.7.1"},
+    {"build": "18H17", "version": "14.8"},
+    {"build": "19A346", "version": "15.0"},
 ]

 def get_device_desc_from_id(identifier, devices_list=IPHONE_MODELS):
--- a/setup.py
+++ b/setup.py
@@ -7,9 +7,7 @@ import os

 from setuptools import find_packages, setup

-__package_name__ = "mvt"
-__version__ = "1.2.1"
-__description__ = "Mobile Verification Toolkit"
+from mvt.common.version import MVT_VERSION

 this_directory = os.path.abspath(os.path.dirname(__file__))
 readme_path = os.path.join(this_directory, "README.md")
@@ -24,6 +22,7 @@ requires = (
    "tqdm>=4.61.2",
    "requests>=2.26.0",
    "simplejson>=3.17.3",
+    "packaging>=21.0",
    # iOS dependencies:
    "iOSbackup>=0.9.912",
    # Android dependencies:
@@ -43,9 +42,9 @@ def get_package_data(package):
    return {package: filepaths}

 setup(
-    name=__package_name__,
-    version=__version__,
-    description=__description__,
+    name="mvt",
+    version=MVT_VERSION,
+    description="Mobile Verification Toolkit",
    long_description=long_description,
    long_description_content_type="text/markdown",
    url="https://github.com/mvt-project/mvt",
Author	SHA1	Message	Date
Nex	660e208473	Bumped version	2021-09-28 15:40:26 +02:00
Nex	01e68ccc6a	Fixed dict decl	2021-09-28 12:45:15 +02:00
Nex	fba0fa1f2c	Removed newline	2021-09-28 12:44:15 +02:00
Nex	1cbf55e50e	Merge branch 'pungentsneak-main'	2021-09-28 12:43:26 +02:00
Nex	8fcc79ebfa	Adapted for better support	2021-09-28 12:42:57 +02:00
Nex	423462395a	Merge branch 'main' of https://github.com/pungentsneak/mvt into pungentsneak-main	2021-09-28 12:33:14 +02:00
Nex	1f08572a6a	Bumped version	2021-09-22 17:32:22 +02:00
Nex	94e3c0ce7b	Added iOS 15.0	2021-09-22 17:27:29 +02:00
pungentsneak	904daad935	add ShutdownLog	2021-09-22 13:24:17 +02:00
Nex	eb2a8b8b41	Merge branch 'Te-k-stalkerware'	2021-09-21 22:27:54 +02:00
Nex	60a17381a2	Standardized code	2021-09-21 22:27:35 +02:00
tek	ef2bb93dc4	Adds indicator check for android package name and file hash	2021-09-21 19:43:02 +02:00
Nex	f68b7e7089	Pull file hashes fom Packages module directly	2021-09-20 19:15:39 +02:00
Nex	a22241ec32	Added version commands	2021-09-17 14:19:03 +02:00
Nex	8ad1bc7a2b	Bumped version	2021-09-16 10:45:26 +02:00
Nex	c6b3509ed4	Merge branch 'main' of github.com:mvt-project/mvt	2021-09-16 10:45:00 +02:00
Nex	75b5b296a5	Added check for indicators (closes: #189 )	2021-09-16 10:44:39 +02:00
Nex	2d62e31eaa	Merge pull request #188 from Kvek/fix/iOS-docs docs: update libimobiledevice url in docs	2021-09-15 14:41:11 +02:00
Kvek	1bfc683e4b	docs: update libimobiledevice url in docs	2021-09-15 13:21:38 +01:00
Nex	7ab09669b5	Merge pull request #187 from kmaria/patch-1 Fix url for Koodous	2021-09-15 13:15:31 +02:00
Maria Kispal	757bd8618e	Fix url for Koodous with www in the url ends up in 404 page	2021-09-15 13:04:52 +02:00
Nex	f1d039346d	Bumped version	2021-09-14 14:33:17 +02:00
Nex	ccdfd92d4a	Merge branch 'dozenfossil-main'	2021-09-14 14:29:21 +02:00
Nex	032b229eb8	Minor changes for consistency	2021-09-14 14:29:04 +02:00
Nex	93936976c7	Merge branch 'main' of https://github.com/dozenfossil/mvt into dozenfossil-main	2021-09-14 14:26:37 +02:00
Nex	f3a4e9d108	Merge pull request #186 from beneficentboast/main fix error for manipulated entries in DataUsage/NetUsage	2021-09-14 14:26:00 +02:00
Nex	93a9735b5e	Reordering	2021-09-14 14:21:54 +02:00
Nex	7b0e2d4564	Added version	2021-09-14 14:20:54 +02:00
beneficentboast	725a99bcd5	fix error for manipulated entries in DataUsage	2021-09-13 20:13:43 +02:00
dozenfossil	35a6f6ec9a	fix multi path/file issue	2021-09-13 20:02:48 +02:00
Nex	3f9809f36c	Formatting docstrings	2021-09-11 02:39:33 +02:00
Nex	6da6595108	More docstrings	2021-09-10 20:09:37 +02:00
Nex	35dfeaccee	Re-ordered list of shortener domains	2021-09-10 15:21:02 +02:00
Nex	e5f2aa3c3d	Standardizing reST docstrings	2021-09-10 15:18:13 +02:00
Nex	3236c1b390	Added new TCC module	2021-09-09 12:00:48 +02:00
Nex	80a670273d	Added additional locationd path	2021-09-07 15:18:00 +02:00
Nex	969b5cc506	Fixed bug in locationd module	2021-09-07 15:06:19 +02:00
Nex	ef8622d4c3	Changed event name	2021-09-03 14:49:04 +02:00
Nex	e39e9e6f92	Cleaned up and simplified module	2021-09-03 14:48:24 +02:00
Nex	7b32ed3179	Compacted record data	2021-09-03 14:41:55 +02:00
Nex	315317863e	Fixed documentation	2021-09-03 14:06:01 +02:00
Nex	08d35b056a	Merge branch 'guitarsinger-main'	2021-09-03 13:35:59 +02:00
Nex	3e679312d1	Renamed module	2021-09-03 13:35:27 +02:00
guitarsinger	be4f1afed6	add OSAnalyticsADDAILY	2021-09-03 11:59:44 +02:00
Nex	0dea25d86e	Reverted version number to minor	2021-09-02 15:33:36 +02:00
Nex	505d3c7e60	Bumped version	2021-09-02 15:31:25 +02:00
Nex	8f04c09b75	Removed duplicate	2021-09-02 15:28:17 +02:00
Nex	595b7e2066	Fixed typo	2021-09-02 15:27:00 +02:00
Nex	d3941bb5d3	Merge pull request #177 from harsaphes/main Checking idstatuscache.plist in a dump for iOS>14.7	2021-09-01 22:00:51 +02:00
Nex	194c8a0ac1	Using new function to retrieve local db path	2021-09-01 21:59:12 +02:00
Nex	bef190fe50	Merge pull request #178 from mvt-project/webkit_error Fixes a bug in retrieving the backup file path in webkit session resource log	2021-09-01 21:57:49 +02:00
tek	cacf027051	Fixes a bug in retrieving the backup file path in webkit session resource logs	2021-09-01 15:49:23 -04:00
tek	da97f5ca30	Add db recovery to Safari history module	2021-09-01 15:40:45 -04:00
Nex	a774577940	Handling some exceptions more gracefully	2021-09-01 13:41:21 +02:00
Nex	7252cc82a7	Added module to dump full output of dumpsys	2021-08-30 22:20:05 +02:00
Nex	b34d80fd11	Logging module completed	2021-08-30 22:19:28 +02:00
Nex	0347dfa3c9	Added module Files to pull list of visible file pathso	2021-08-30 22:11:07 +02:00
Nex	28647b8493	Fixed is_dir() to isdir()	2021-08-30 22:08:29 +02:00
harsaphes	c2ec26fd75	Checking idstatuscache.plist in a dump for iOS>14.7	2021-08-30 21:01:59 +02:00
Nex	856a6fb895	Cleaning up some classes	2021-08-28 12:33:27 +02:00
Nex	62f3c535df	Merge pull request #176 from JeffLIrion/patch-1 Fix `_adb_check_keys` method	2021-08-28 12:25:52 +02:00
Jeff Irion	34c64af815	Fix `_adb_check_keys` method	2021-08-27 23:26:50 -07:00
Nex	ea4da71277	Creating android home folder if missing	2021-08-27 19:12:09 +02:00
Nex	94fe3c90e0	Added logcat modules	2021-08-26 15:23:54 +02:00
Nex	f78332aa71	Split receivers into a new package	2021-08-26 14:51:56 +02:00
Nex	0c4eb0bb34	Added discovery of Android packages with potentially abusive receivers	2021-08-26 14:08:39 +02:00
Nex	e70054d0c2	Bumped version	2021-08-26 12:48:09 +02:00
Nex	a75cf58f72	Added missing dependency	2021-08-26 12:47:46 +02:00
Nex	c859b43220	Adding logo to iOS cli	2021-08-26 12:40:45 +02:00
Nex	75ee2db02e	Upgrading version	2021-08-26 12:36:37 +02:00
Nex	f6efb3c89a	Bumped version	2021-08-25 21:58:38 +02:00
Nex	b27047ed27	Updated lookup modules to new format (closes: #175 )	2021-08-25 21:58:03 +02:00
Nex	d43c8109d1	Bumped version	2021-08-25 16:32:05 +02:00
Nex	79f313827f	Changed mvt-android download-apks to only fetch non-system packages	2021-08-25 13:35:21 +02:00
Nex	67d8820cc9	Merge pull request #174 from arky/adb-keygen-fix Create adb keys (Fixes #165)	2021-08-21 18:43:14 +02:00
Arky	9297e06cc4	Create adb keys (Fixes #165 )	2021-08-21 22:43:41 +07:00
Nex	faf44b0d4d	Merge pull request #173 from arky/android-tools-fix Use latest Android platform tools	2021-08-21 17:25:34 +02:00
Nex	4ebe0b6971	Shrink logo in README	2021-08-21 15:58:35 +02:00
Arky	3cbeb4befa	Use latest Android platform tools	2021-08-21 20:53:33 +07:00
Nex	0005ad2abd	Removed unused imports	2021-08-21 15:50:12 +02:00
Nex	a16b0c12d2	Added shared help messages	2021-08-21 15:48:52 +02:00
Nex	e0a6608b9d	Logging which files error the manifest module	2021-08-20 17:15:35 +02:00
Nex	80a91bb2ad	Checking if the backup is actually encrypted before proceeding (closes: #48 )	2021-08-20 15:18:08 +02:00
Nex	9a7970e8a0	Merge pull request #172 from jekil/main Some esthetic fixes to documentation	2021-08-20 09:07:05 +02:00
jekil	05a82075cf	Some esthetic fixes to documentation	2021-08-20 08:58:08 +02:00
Nex	d99a8be632	Merge pull request #170 from jekil/main Dockerfile lifting	2021-08-20 08:17:38 +02:00
jekil	4882ce9c88	Lifting to avoid not needed layers	2021-08-19 23:26:00 +02:00
Nex	2d277d2d14	Catching in case uid field is not present	2021-08-18 23:11:18 +02:00
Nex	1fc6c49d4f	Inverted buttons	2021-08-18 19:56:27 +02:00
Nex	6a3b2dde81	Reintroduced newline	2021-08-18 19:23:12 +02:00
Nex	51a71bceb3	Added notice about target audience in introduction	2021-08-18 17:50:12 +02:00
Nex	ee5ac2a502	Updated Android documentation	2021-08-18 17:47:24 +02:00
Nex	b74d7719ea	Merge pull request #169 from gregzo/main Added availability details to records.md	2021-08-18 17:20:47 +02:00
Nex	7887ad6ee4	Removed trailing dot	2021-08-18 17:03:49 +02:00
Gregorio Zanon	e30f6d9134	Added availability details to records.md Added availability details for backup records which require encryption or aren't available anymore in recent iOS versions.	2021-08-18 10:07:39 +02:00