How to check your iPhone for Pegasus Spyware
High-risk users should be proactive in testing for signs of compromise
15 min readNov 7, 2024
Recently, concerns over spyware and hacking have increased, especially for those at high risk, like journalists, activists, or others who handle sensitive information. One of the most concerning threats is Pegasus, a powerful spyware that can monitor your device without your knowledge. If you suspect your iPhone might be compromised, following a few steps can help you check for signs of infection and give you peace of mind.
Step 1: Prerequisites
iPhone
Go to Settings > Face ID & Passcode and toggle on Accessories.
MacOS Testing Computer
First, install Homebrew if you don’t have it already:
/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"Then, run the following commands to start using Homebrew:
echo >> /Users/scidsg/.zprofile
echo 'eval "$(/opt/homebrew/bin/brew shellenv)"' >> /Users/scidsg/.zprofile
eval "$(/opt/homebrew/bin/brew shellenv)"Next, install the dependencies for the Mobile Verification Toolkit:
brew install python3 libusb ideviceinstaller libimobiledevice gitFinally, install Docker Desktop using the documentation here.
Step 2: Set up the Mobile Verification Toolkit
In your Terminal, navigate to your Documents folder, then run the command:
git clone https://github.com/mvt-project/mvt.git
cd mvt/If you use Github Desktop, you can use the “Open with GitHub Desktop” in the repository.
Then, from the mvt Git folder, enter your development environment:
python3 -m venv mvt-env
source mvt-env/bin/activateLastly, install the tools for iOS:
pip install --upgrade pip
pip install -e '.[ios]'Step 3: Backup your iPhone
Ensure you select Back up all of the data on your iPhone to this Mac and deselect Encrypt local backup. Click Back Up Now to start the process. Depending on the contents of your phone, this may take over an hour.
When your backup completes, click Manage Backups..., select your backup, right-click and choose Show In Finder. Rename the folder to iphone-backup and move it to your Documents folder.
⚠️ Remember to toggle off Accessories in your iPhone settings after back up completes!
Step 4: Check the backup for compromise
Now, run the following command to enter these commands to build the Mobile Verification Toolkit and open your backup in Docker:
docker build -t mvt .
docker run -it -v ~/Documents/iphone-backup:/backup mvtNow, from the Docker container, download the Indicators of Compromise:
mvt-ios download-iocsFinally, run the test:
mvt-ios check-backup /backup --output /home/cases/outputIt’ll produce an output that looks like this:
root@6c3109459d82:/home/cases# mvt-ios check-backup /backup --output /home/cases/output
MVT - Mobile Verification Toolkit
https://mvt.re
Version: 2.5.4
Indicators updates checked recently, next automatic check in 12 hours
16:56:17 INFO [mvt.ios.cmd_check_backup] Parsing STIX2 indicators file at path
/root/.local/share/mvt/indicators/raw.githubusercontent.com_mvt-project_mvt-
indicators_main_2023-04-11_quadream_kingspawn.stix2
INFO [mvt.ios.cmd_check_backup] Parsing STIX2 indicators file at path
/root/.local/share/mvt/indicators/raw.githubusercontent.com_AssoEchap_stalke
rware-indicators_master_generated_stalkerware.stix2
16:56:18 INFO [mvt.ios.cmd_check_backup] Parsing STIX2 indicators file at path
/root/.local/share/mvt/indicators/raw.githubusercontent.com_AmnestyTech_inve
stigations_master_2023-03-29_android_campaign_malware.stix2
INFO [mvt.ios.cmd_check_backup] Parsing STIX2 indicators file at path
/root/.local/share/mvt/indicators/raw.githubusercontent.com_AmnestyTech_inve
stigations_master_2021-07-18_nso_pegasus.stix2
INFO [mvt.ios.cmd_check_backup] Parsing STIX2 indicators file at path
/root/.local/share/mvt/indicators/raw.githubusercontent.com_mvt-project_mvt-
indicators_main_2023-07-25_wyrmspy_dragonegg_wyrmspy_dragonegg.stix2
INFO [mvt.ios.cmd_check_backup] Parsing STIX2 indicators file at path
/root/.local/share/mvt/indicators/raw.githubusercontent.com_mvt-project_mvt-
indicators_main_2023-06_01_operation_triangulation_operation_triangulation.s
tix2
INFO [mvt.ios.cmd_check_backup] Parsing STIX2 indicators file at path
/root/.local/share/mvt/indicators/raw.githubusercontent.com_AmnestyTech_inve
stigations_master_2024-05-02_wintego_helios_wintego_helios.stix2
INFO [mvt.ios.cmd_check_backup] Parsing STIX2 indicators file at path
/root/.local/share/mvt/indicators/raw.githubusercontent.com_mvt-project_mvt-
indicators_main_intellexa_predator_predator.stix2
INFO [mvt.ios.cmd_check_backup] Parsing STIX2 indicators file at path
/root/.local/share/mvt/indicators/raw.githubusercontent.com_mvt-project_mvt-
indicators_main_2022-06-23_rcs_lab_rcs.stix2
INFO [mvt.ios.cmd_check_backup] Loaded a total of 10460 unique indicators
INFO [mvt] Checking iTunes backup located at: /backup
INFO [mvt.ios.modules.backup.backup_info] Running module BackupInfo...
INFO [mvt.ios.modules.backup.backup_info] Build Version: 22B83
INFO [mvt.ios.modules.backup.backup_info] Device Name: Your iPhone
INFO [mvt.ios.modules.backup.backup_info] Display Name: Your iPhone
INFO [mvt.ios.modules.backup.backup_info] GUID: DE25E30C57345BA471A1935082BFA14F
INFO [mvt.ios.modules.backup.backup_info] ICCID: 8901260497737183677
INFO [mvt.ios.modules.backup.backup_info] IMEI: 353468913495091
INFO [mvt.ios.modules.backup.backup_info] MEID: None
INFO [mvt.ios.modules.backup.backup_info] Installed Applications:
['org.whispersystems.signal', 'org.onionshare.OnionShare', 'lots of other apps'...]
INFO [mvt.ios.modules.backup.backup_info] Last Backup Date: 2024-11-07 16:51:04
INFO [mvt.ios.modules.backup.backup_info] Phone Number: 1 (510) 778-2266
INFO [mvt.ios.modules.backup.backup_info] Product Name: iPhone 15 Pro
INFO [mvt.ios.modules.backup.backup_info] Product Type: iPhone16,1 (iPhone 15
Pro)
INFO [mvt.ios.modules.backup.backup_info] Product Version: 18.1
INFO [mvt.ios.modules.backup.backup_info] Serial Number: CMW6L6X59M
INFO [mvt.ios.modules.backup.backup_info] Target Identifier:
00008130-00061CA41A46001C
INFO [mvt.ios.modules.backup.backup_info] Target Type: Device
INFO [mvt.ios.modules.backup.backup_info] Unique Identifier:
00008130-00061CA41A46001C
INFO [mvt.ios.modules.backup.backup_info] iTunes Version: None
INFO [mvt.ios.modules.backup.backup_info] The BackupInfo module does not support
checking for indicators
INFO [mvt.ios.modules.backup.configuration_profiles] Running module
ConfigurationProfiles...
INFO [mvt.ios.modules.backup.configuration_profiles] Extracted details about 1
configuration profiles
INFO [mvt.ios.modules.backup.configuration_profiles] The ConfigurationProfiles
module produced no detections!
INFO [mvt.ios.modules.backup.manifest] Running module Manifest...
INFO [mvt.ios.modules.backup.manifest] Found Manifest.db database at path:
/backup/Manifest.db
16:56:27 INFO [mvt.ios.modules.backup.manifest] Extracted a total of 293466 file metadata
items
16:56:39 INFO [mvt.ios.modules.backup.manifest] The Manifest module produced no detections!
16:56:42 INFO [mvt.ios.modules.backup.profile_events] Running module ProfileEvents...
INFO [mvt.ios.modules.backup.profile_events] Found MCProfileEvents.plist file at /backup/ae/aeb25de285ea542f7ac7c2070cddd1961e369df1
INFO [mvt.ios.modules.backup.profile_events] Extracted 0 profile events
INFO [mvt.ios.modules.backup.profile_events] The ProfileEvents module produced no detections!
INFO [mvt.ios.modules.mixed.calls] Running module Calls...
INFO [mvt.ios.modules.mixed.calls] There might be no data to extract by module Calls: unable to find the module's database file
INFO [mvt.ios.modules.mixed.chrome_favicon] Running module ChromeFavicon...
INFO [mvt.ios.modules.mixed.chrome_favicon] There might be no data to extract by module ChromeFavicon: unable to find the module's database file
INFO [mvt.ios.modules.mixed.chrome_history] Running module ChromeHistory...
INFO [mvt.ios.modules.mixed.chrome_history] There might be no data to extract by module ChromeHistory: unable to find the module's database file
INFO [mvt.ios.modules.mixed.contacts] Running module Contacts...
INFO [mvt.ios.modules.mixed.contacts] Found Contacts database at path: /backup/31/31bb7ba8914766d4ba40d6dfb6113c8b614be442
INFO [mvt.ios.modules.mixed.contacts] Extracted a total of 250 contacts from the address book
INFO [mvt.ios.modules.mixed.contacts] The Contacts module does not support checking for indicators
INFO [mvt.ios.modules.mixed.firefox_favicon] Running module FirefoxFavicon...
INFO [mvt.ios.modules.mixed.firefox_favicon] There might be no data to extract by module FirefoxFavicon: unable to find the module's database file
INFO [mvt.ios.modules.mixed.firefox_history] Running module FirefoxHistory...
INFO [mvt.ios.modules.mixed.firefox_history] There might be no data to extract by module FirefoxHistory: unable to find the module's database file
INFO [mvt.ios.modules.mixed.idstatuscache] Running module IDStatusCache...
INFO [mvt.ios.modules.mixed.idstatuscache] Found IDStatusCache plist at path: /backup/6b/6b97989189901ceaa4e5be9b7f05fb584120e27b
INFO [mvt.ios.modules.mixed.idstatuscache] Extracted a total of 0 ID Status Cache entries
INFO [mvt.ios.modules.mixed.idstatuscache] The IDStatusCache module produced no detections!
INFO [mvt.ios.modules.mixed.interactionc] Running module InteractionC...
INFO [mvt.ios.modules.mixed.interactionc] There might be no data to extract by module InteractionC: unable to find the module's database file
INFO [mvt.ios.modules.mixed.locationd] Running module LocationdClients...
INFO [mvt.ios.modules.mixed.locationd] Found Locationd Clients plist at path: /backup/a6/a690d7769cce8904ca2b67320b107c8fe5f79412
INFO [mvt.ios.modules.mixed.locationd] Extracted a total of 227 Locationd Clients entries
INFO [mvt.ios.modules.mixed.locationd] The LocationdClients module produced no detections!
INFO [mvt.ios.modules.mixed.osanalytics_addaily] Running module OSAnalyticsADDaily...
INFO [mvt.ios.modules.mixed.osanalytics_addaily] Found com.apple.osanalytics.addaily plist at path: /backup/f6/f65b5fafc69bbd3c60be019c6e938e146825fa83
INFO [mvt.ios.modules.mixed.osanalytics_addaily] Extracted a total of 632 com.apple.osanalytics.addaily entries between 2024-06-14 21:42:39 and 2024-11-06
06:49:27
INFO [mvt.ios.modules.mixed.osanalytics_addaily] The OSAnalyticsADDaily module produced no detections!
INFO [mvt.ios.modules.mixed.net_datausage] Running module Datausage...
INFO [mvt.ios.modules.mixed.net_datausage] Found DataUsage database at path: /backup/0d/0d609c54856a9bb2d56729df1d68f2958a88426b
ERROR [mvt.ios.modules.mixed.net_datausage] Error in running extraction from module Datausage: no such column: ZLIVEUSAGE.ZWIFIIN
Traceback (most recent call last):
File "/usr/local/lib/python3.10/dist-packages/mvt/common/module.py", line 167, in run_module
exec_or_profile("module.run()", globals(), locals())
File "/usr/local/lib/python3.10/dist-packages/mvt/common/utils.py", line 262, in exec_or_profile
exec(module, globals, locals)
File "<string>", line 1, in <module>
File "/usr/local/lib/python3.10/dist-packages/mvt/ios/modules/mixed/net_datausage.py", line 50, in run
self._extract_net_data()
File "/usr/local/lib/python3.10/dist-packages/mvt/ios/modules/net_base.py", line 42, in _extract_net_data
cur.execute(
sqlite3.OperationalError: no such column: ZLIVEUSAGE.ZWIFIIN
INFO [mvt.ios.modules.mixed.safari_browserstate] Running module SafariBrowserState...
INFO [mvt.ios.modules.mixed.safari_browserstate] Extracted a total of 0 tab records and 0 session history entries
INFO [mvt.ios.modules.mixed.safari_browserstate] The SafariBrowserState module produced no detections!
INFO [mvt.ios.modules.mixed.safari_history] Running module SafariHistory...
INFO [mvt.ios.modules.mixed.safari_history] Extracted a total of 0 history records
INFO [mvt.ios.modules.mixed.safari_history] The SafariHistory module produced no detections!
INFO [mvt.ios.modules.mixed.tcc] Running module TCC...
INFO [mvt.ios.modules.mixed.tcc] Found TCC database at path: /backup/64/64d0019cb3d46bfc8cce545a8ba54b93e7ea9347
INFO [mvt.ios.modules.mixed.tcc] Found client "org.whispersystems.signal" with access allowed to camera on 2022-12-17 21:09:09.000000 by user_consent
INFO [mvt.ios.modules.mixed.tcc] Found client "org.whispersystems.signal" with access allowed to microphone on 2023-01-09 23:10:04.000000 by user_consent
INFO [mvt.ios.modules.mixed.tcc] Extracted a total of 235 TCC items
INFO [mvt.ios.modules.mixed.tcc] The TCC module produced no detections!
INFO [mvt.ios.modules.mixed.sms] Running module SMS...
INFO [mvt.ios.modules.mixed.sms] Found SMS database at path: /backup/3d/3d0d7e5fb2ce288813306e4d4636395e047a3d28
INFO [mvt.ios.modules.mixed.sms] Extracted a total of 13668 SMS messages
16:56:47 INFO [mvt.ios.modules.mixed.sms] The SMS module produced no detections!
16:56:48 INFO [mvt.ios.modules.mixed.sms_attachments] Running module SMSAttachments...
INFO [mvt.ios.modules.mixed.sms_attachments] Found SMS database at path: /backup/3d/3d0d7e5fb2ce288813306e4d4636395e047a3d28
INFO [mvt.ios.modules.mixed.sms_attachments] Extracted a total of 2860 SMS attachments
INFO [mvt.ios.modules.mixed.sms_attachments] The SMSAttachments module produced no detections!
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Running module WebkitResourceLoadStatistics...
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Found WebKit ResourceLoadStatistics observations.db file at path
/backup/7f/7f3cc54967a0a80dc64cedca3420ab4376c27e65
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Extracted a total of 2 records from /backup/7f/7f3cc54967a0a80dc64cedca3420ab4376c27e65
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Found WebKit ResourceLoadStatistics observations.db file at path
/backup/2b/2bf7d8a13bc178023d8a5751c11f2e176d5a0ea2
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Extracted a total of 2 records from /backup/2b/2bf7d8a13bc178023d8a5751c11f2e176d5a0ea2
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Found WebKit ResourceLoadStatistics observations.db file at path
/backup/3c/3c76ca17fabbd158e8abc966d13b67e3be95fa8e
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Extracted a total of 2 records from /backup/3c/3c76ca17fabbd158e8abc966d13b67e3be95fa8e
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Found WebKit ResourceLoadStatistics observations.db file at path
/backup/69/699c46b8a3c0e7c854503ec291232aee429cee71
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Extracted a total of 2 records from /backup/69/699c46b8a3c0e7c854503ec291232aee429cee71
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Found WebKit ResourceLoadStatistics observations.db file at path
/backup/4d/4d5461281f8d549ea8b20e2a5a60f8cf3d2fba1b
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Extracted a total of 24 records from /backup/4d/4d5461281f8d549ea8b20e2a5a60f8cf3d2fba1b
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Found WebKit ResourceLoadStatistics observations.db file at path
/backup/09/09ffe5f5032fd861c97f04a635e03e70c4bbd891
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Extracted a total of 29 records from /backup/09/09ffe5f5032fd861c97f04a635e03e70c4bbd891
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Found WebKit ResourceLoadStatistics observations.db file at path
/backup/81/81fbecac238dd61d13038346ebb34978286ccd2a
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Extracted a total of 35 records from /backup/81/81fbecac238dd61d13038346ebb34978286ccd2a
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Found WebKit ResourceLoadStatistics observations.db file at path
/backup/74/74b2b7b01656710e5ca78f2c8d843c72498d4c99
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Extracted a total of 35 records from /backup/74/74b2b7b01656710e5ca78f2c8d843c72498d4c99
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Found WebKit ResourceLoadStatistics observations.db file at path
/backup/3d/3d6cee210080465b4c57f31be1e986e6981e7a32
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Extracted a total of 39 records from /backup/3d/3d6cee210080465b4c57f31be1e986e6981e7a32
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Found WebKit ResourceLoadStatistics observations.db file at path
/backup/67/67de78c8c3ade3043033a931cf1eeeb1a16da49e
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Extracted a total of 158 records from /backup/67/67de78c8c3ade3043033a931cf1eeeb1a16da49e
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Found WebKit ResourceLoadStatistics observations.db file at path
/backup/b8/b86de064647ecdf005939d77959e9138244f98d2
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Extracted a total of 180 records from /backup/b8/b86de064647ecdf005939d77959e9138244f98d2
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Found WebKit ResourceLoadStatistics observations.db file at path
/backup/c7/c7cbb97b79006ad4aaea5869de995608cf9077b1
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Extracted a total of 182 records from /backup/c7/c7cbb97b79006ad4aaea5869de995608cf9077b1
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Found WebKit ResourceLoadStatistics observations.db file at path
/backup/41/412e43361dd0691dda04fa523b52ce1f656f4cfe
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Extracted a total of 183 records from /backup/41/412e43361dd0691dda04fa523b52ce1f656f4cfe
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Found WebKit ResourceLoadStatistics observations.db file at path
/backup/b0/b095123fe7d67d2229f74bdc5bb227a952310ba1
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Extracted a total of 660 records from /backup/b0/b095123fe7d67d2229f74bdc5bb227a952310ba1
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Found WebKit ResourceLoadStatistics observations.db file at path
/backup/00/00f451fe0796cb89efa7c799f518d5317a666869
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Extracted a total of 661 records from /backup/00/00f451fe0796cb89efa7c799f518d5317a666869
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Found WebKit ResourceLoadStatistics observations.db file at path
/backup/a7/a712e00754d6123194c4f43af4af5dc72186ec36
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Extracted a total of 667 records from /backup/a7/a712e00754d6123194c4f43af4af5dc72186ec36
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Found WebKit ResourceLoadStatistics observations.db file at path
/backup/f3/f3e21366856db1a70df72bcc37a4ed1bab496aec
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Extracted a total of 809 records from /backup/f3/f3e21366856db1a70df72bcc37a4ed1bab496aec
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Found WebKit ResourceLoadStatistics observations.db file at path
/backup/c3/c3835e896a3c7835f16e847220d13b6e28d8bff5
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Extracted a total of 818 records from /backup/c3/c3835e896a3c7835f16e847220d13b6e28d8bff5
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Found WebKit ResourceLoadStatistics observations.db file at path
/backup/f5/f5f0d5da2a3ce4375555df851ee4eeb7d65ea364
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Extracted a total of 832 records from /backup/f5/f5f0d5da2a3ce4375555df851ee4eeb7d65ea364
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Found WebKit ResourceLoadStatistics observations.db file at path
/backup/d8/d8a1a193cd291bdde531b2d5f74fccf8ea05bbb9
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Extracted a total of 832 records from /backup/d8/d8a1a193cd291bdde531b2d5f74fccf8ea05bbb9
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Found WebKit ResourceLoadStatistics observations.db file at path
/backup/9f/9f74d3f47580be130d7803eba20bead88d2bdcb4
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Extracted a total of 835 records from /backup/9f/9f74d3f47580be130d7803eba20bead88d2bdcb4
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Found WebKit ResourceLoadStatistics observations.db file at path
/backup/2d/2dd2b4dba3e696f51dce190ffbc697a6b742fd20
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Extracted a total of 835 records from /backup/2d/2dd2b4dba3e696f51dce190ffbc697a6b742fd20
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Found WebKit ResourceLoadStatistics observations.db file at path
/backup/30/30c2b162b18fd5eb18f192182dbac8e7f6932d8a
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Extracted a total of 835 records from /backup/30/30c2b162b18fd5eb18f192182dbac8e7f6932d8a
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Found WebKit ResourceLoadStatistics observations.db file at path
/backup/30/306c9396cec0c68307e83edb4630319d7aca5e17
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Extracted a total of 876 records from /backup/30/306c9396cec0c68307e83edb4630319d7aca5e17
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Found WebKit ResourceLoadStatistics observations.db file at path
/backup/1f/1f633cd5d1393f40d791b60424239620187717be
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Extracted a total of 876 records from /backup/1f/1f633cd5d1393f40d791b60424239620187717be
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Found WebKit ResourceLoadStatistics observations.db file at path
/backup/77/772b7e636f43c694205dc70170c36465245d837d
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Extracted a total of 1772 records from /backup/77/772b7e636f43c694205dc70170c36465245d837d
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Found WebKit ResourceLoadStatistics observations.db file at path
/backup/48/484138c03eab6aacbf9931a7498232e7b57286ae
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Extracted a total of 1798 records from /backup/48/484138c03eab6aacbf9931a7498232e7b57286ae
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Found WebKit ResourceLoadStatistics observations.db file at path
/backup/34/347f28caa5d75319b00d07aed364233c038c173f
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Extracted a total of 1826 records from /backup/34/347f28caa5d75319b00d07aed364233c038c173f
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Found WebKit ResourceLoadStatistics observations.db file at path
/backup/6b/6be9036c7605790729c8b5e1b5a4c339da1de3e8
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Extracted a total of 1836 records from /backup/6b/6be9036c7605790729c8b5e1b5a4c339da1de3e8
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Found WebKit ResourceLoadStatistics observations.db file at path
/backup/7f/7f6840fe03ce4ce7d4fa56f1efa43d4caba4cfae
16:56:49 INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Extracted a total of 1836 records from /backup/7f/7f6840fe03ce4ce7d4fa56f1efa43d4caba4cfae
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Found WebKit ResourceLoadStatistics observations.db file at path
/backup/f6/f653134757c17c495b1f2790714a4a41ce366883
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Extracted a total of 2645 records from /backup/f6/f653134757c17c495b1f2790714a4a41ce366883
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Found WebKit ResourceLoadStatistics observations.db file at path
/backup/17/172b563a0d76df7b4455a0b7b003ab231dee24eb
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Extracted a total of 2655 records from /backup/17/172b563a0d76df7b4455a0b7b003ab231dee24eb
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Found WebKit ResourceLoadStatistics observations.db file at path
/backup/55/55a59b5a089078c71e82bb48e9381cef390929f1
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Extracted a total of 2657 records from /backup/55/55a59b5a089078c71e82bb48e9381cef390929f1
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Found WebKit ResourceLoadStatistics observations.db file at path
/backup/f1/f11003ccfb1a841737ee28d7f19bb6405f598821
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Extracted a total of 2657 records from /backup/f1/f11003ccfb1a841737ee28d7f19bb6405f598821
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Found WebKit ResourceLoadStatistics observations.db file at path
/backup/b1/b10b7faa61b9ba7ea45b135205a190153dc6a0da
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Extracted a total of 2657 records from /backup/b1/b10b7faa61b9ba7ea45b135205a190153dc6a0da
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Found WebKit ResourceLoadStatistics observations.db file at path
/backup/4b/4b0c700196cf500226b498ecaa551b121690b5ae
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Extracted a total of 2669 records from /backup/4b/4b0c700196cf500226b498ecaa551b121690b5ae
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Found WebKit ResourceLoadStatistics observations.db file at path
/backup/22/22cd597efa53c2e66fd64d06a47865c5a84bb7fd
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Extracted a total of 2678 records from /backup/22/22cd597efa53c2e66fd64d06a47865c5a84bb7fd
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Found WebKit ResourceLoadStatistics observations.db file at path
/backup/d0/d0478bc911c1807a1f039523b544eea3fd98ba29
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Extracted a total of 2686 records from /backup/d0/d0478bc911c1807a1f039523b544eea3fd98ba29
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Found WebKit ResourceLoadStatistics observations.db file at path
/backup/73/732b06423e580d0c2baefe140b3a2b8e7c68589f
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Extracted a total of 2689 records from /backup/73/732b06423e580d0c2baefe140b3a2b8e7c68589f
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Found WebKit ResourceLoadStatistics observations.db file at path
/backup/ed/ed0fe256edfa224371722c966b312fe2626f82bf
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Extracted a total of 2689 records from /backup/ed/ed0fe256edfa224371722c966b312fe2626f82bf
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Found WebKit ResourceLoadStatistics observations.db file at path
/backup/7f/7fb2600b602aaadc738844c7d4976f60a27c947f
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Extracted a total of 2689 records from /backup/7f/7fb2600b602aaadc738844c7d4976f60a27c947f
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Found WebKit ResourceLoadStatistics observations.db file at path
/backup/cc/cc0287326788e25c0cf60657f76ec180edfb0347
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Extracted a total of 2689 records from /backup/cc/cc0287326788e25c0cf60657f76ec180edfb0347
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Found WebKit ResourceLoadStatistics observations.db file at path
/backup/4a/4aabd6c6addac7c85f3f71713aa140ca007861a4
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Extracted a total of 2738 records from /backup/4a/4aabd6c6addac7c85f3f71713aa140ca007861a4
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Found WebKit ResourceLoadStatistics observations.db file at path
/backup/2c/2cb3f3799d01773f305758752b4d49c113c9dd7c
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Extracted a total of 2763 records from /backup/2c/2cb3f3799d01773f305758752b4d49c113c9dd7c
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Found WebKit ResourceLoadStatistics observations.db file at path
/backup/a8/a8c53137474e7fd11d1a923b144a059d39bede90
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Extracted a total of 2764 records from /backup/a8/a8c53137474e7fd11d1a923b144a059d39bede90
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Found WebKit ResourceLoadStatistics observations.db file at path
/backup/f2/f23e4a0b9b0193be698bcf8900d73d9d2363985d
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Extracted a total of 2771 records from /backup/f2/f23e4a0b9b0193be698bcf8900d73d9d2363985d
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Found WebKit ResourceLoadStatistics observations.db file at path
/backup/68/68a018d92ba81499554e4850dea1357e4e8639e9
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Extracted a total of 2774 records from /backup/68/68a018d92ba81499554e4850dea1357e4e8639e9
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Found WebKit ResourceLoadStatistics observations.db file at path
/backup/29/29709f898e9ccdc9a1327df42b6bc87424779b6e
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Extracted a total of 2777 records from /backup/29/29709f898e9ccdc9a1327df42b6bc87424779b6e
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Found WebKit ResourceLoadStatistics observations.db file at path
/backup/b6/b61f6d652b0820d1959b8464a2541f05c3b89c21
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Extracted a total of 2777 records from /backup/b6/b61f6d652b0820d1959b8464a2541f05c3b89c21
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Found WebKit ResourceLoadStatistics observations.db file at path
/backup/29/29cfd982ab189c190c42fe4c4da5003257928111
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Extracted a total of 2781 records from /backup/29/29cfd982ab189c190c42fe4c4da5003257928111
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Found WebKit ResourceLoadStatistics observations.db file at path
/backup/2b/2ba096af050c8e9438a3091b36c4af26320b06bb
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Extracted a total of 2781 records from /backup/2b/2ba096af050c8e9438a3091b36c4af26320b06bb
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Found WebKit ResourceLoadStatistics observations.db file at path
/backup/ef/effcbd1569a15b6f8beb9dadcb566b84163d6204
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Extracted a total of 2781 records from /backup/ef/effcbd1569a15b6f8beb9dadcb566b84163d6204
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Found WebKit ResourceLoadStatistics observations.db file at path
/backup/9c/9c27c15cc4324079bbd4e789d7e50a2fce2fced9
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Extracted a total of 2817 records from /backup/9c/9c27c15cc4324079bbd4e789d7e50a2fce2fced9
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Found WebKit ResourceLoadStatistics observations.db file at path
/backup/4f/4fd2dcdc2d59a379a3a66ab542754629a3f43f5c
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Extracted a total of 2817 records from /backup/4f/4fd2dcdc2d59a379a3a66ab542754629a3f43f5c
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Found WebKit ResourceLoadStatistics observations.db file at path
/backup/43/436b3dff9788b27b52f5b428c0136f2e1f1f0c1a
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Extracted a total of 2906 records from /backup/43/436b3dff9788b27b52f5b428c0136f2e1f1f0c1a
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Found WebKit ResourceLoadStatistics observations.db file at path
/backup/23/235f7381e07063cdc4245145358d61c18947d9bc
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Extracted a total of 2906 records from /backup/23/235f7381e07063cdc4245145358d61c18947d9bc
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Found WebKit ResourceLoadStatistics observations.db file at path
/backup/e8/e8d7b486a1f12eeafc97fa65fd39988168b31e65
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Extracted a total of 2906 records from /backup/e8/e8d7b486a1f12eeafc97fa65fd39988168b31e65
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Found WebKit ResourceLoadStatistics observations.db file at path
/backup/32/328bc33fd8d9d9791e8c37995a68d98aac120333
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Extracted a total of 2918 records from /backup/32/328bc33fd8d9d9791e8c37995a68d98aac120333
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Found WebKit ResourceLoadStatistics observations.db file at path
/backup/29/2917c83586a733ce45418276c8e59a455c749f34
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Extracted a total of 2918 records from /backup/29/2917c83586a733ce45418276c8e59a455c749f34
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Found WebKit ResourceLoadStatistics observations.db file at path
/backup/00/002f429e9704514f94de7d9776578e7cbdd3791b
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Extracted a total of 2921 records from /backup/00/002f429e9704514f94de7d9776578e7cbdd3791b
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Found WebKit ResourceLoadStatistics observations.db file at path
/backup/49/49b6d9ff45c1b8336e4db93b0d444a8086c9e7bf
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Extracted a total of 2922 records from /backup/49/49b6d9ff45c1b8336e4db93b0d444a8086c9e7bf
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Found WebKit ResourceLoadStatistics observations.db file at path
/backup/84/8471601165956d967410c2af988ca71c8d3131f6
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Extracted a total of 2922 records from /backup/84/8471601165956d967410c2af988ca71c8d3131f6
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Found WebKit ResourceLoadStatistics observations.db file at path
/backup/4c/4c2220de3848468478a73354901367c6d1727248
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Extracted a total of 2924 records from /backup/4c/4c2220de3848468478a73354901367c6d1727248
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Found WebKit ResourceLoadStatistics observations.db file at path
/backup/8d/8d18263d8f8f9eaae50fd0f4e88ba9f64d732997
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Extracted a total of 2926 records from /backup/8d/8d18263d8f8f9eaae50fd0f4e88ba9f64d732997
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Found WebKit ResourceLoadStatistics observations.db file at path
/backup/da/dafa3be0e3307f326c1dbd9a6057bc186c776d78
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Extracted a total of 2926 records from /backup/da/dafa3be0e3307f326c1dbd9a6057bc186c776d78
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Found WebKit ResourceLoadStatistics observations.db file at path
/backup/87/8753a88756234f74d8f144d9616b3874b6393555
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Extracted a total of 2927 records from /backup/87/8753a88756234f74d8f144d9616b3874b6393555
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Found WebKit ResourceLoadStatistics observations.db file at path
/backup/ab/ab4b916d494b3879d54d48bd52c617bfe6ccd2c9
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Extracted a total of 2937 records from /backup/ab/ab4b916d494b3879d54d48bd52c617bfe6ccd2c9
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Found WebKit ResourceLoadStatistics observations.db file at path
/backup/24/24f1700a74e73a90f7b820e3023b7067f59321e0
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Extracted a total of 2937 records from /backup/24/24f1700a74e73a90f7b820e3023b7067f59321e0
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Found WebKit ResourceLoadStatistics observations.db file at path
/backup/e8/e85bf973b1a336da8dcd3ef7a10fe6a6be295ea0
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Extracted a total of 3839 records from /backup/e8/e85bf973b1a336da8dcd3ef7a10fe6a6be295ea0
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Found WebKit ResourceLoadStatistics observations.db file at path
/backup/76/762d585c6f663e954c441f6ddfe01b582ed68a5a
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Extracted a total of 3839 records from /backup/76/762d585c6f663e954c441f6ddfe01b582ed68a5a
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Found WebKit ResourceLoadStatistics observations.db file at path
/backup/b2/b274ccada6ae9c6e6136a3cf91e96553e41c3286
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Extracted a total of 3851 records from /backup/b2/b274ccada6ae9c6e6136a3cf91e96553e41c3286
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Found WebKit ResourceLoadStatistics observations.db file at path
/backup/ae/ae1f40770a5dbb145b46eebc9f60241d5ebd8226
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Extracted a total of 3852 records from /backup/ae/ae1f40770a5dbb145b46eebc9f60241d5ebd8226
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Found WebKit ResourceLoadStatistics observations.db file at path
/backup/49/49df741533cf442dd7517d3968e94c2c581ec1f6
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Extracted a total of 3852 records from /backup/49/49df741533cf442dd7517d3968e94c2c581ec1f6
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Found WebKit ResourceLoadStatistics observations.db file at path
/backup/c5/c59b07efc43ec55d931c06400a6f5a54867fd9d2
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Extracted a total of 3852 records from /backup/c5/c59b07efc43ec55d931c06400a6f5a54867fd9d2
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Found WebKit ResourceLoadStatistics observations.db file at path
/backup/12/12a9fe08b1002024ebd6f23a7e7a7e88bb4e52c6
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Extracted a total of 3852 records from /backup/12/12a9fe08b1002024ebd6f23a7e7a7e88bb4e52c6
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Found WebKit ResourceLoadStatistics observations.db file at path
/backup/42/42f5783d3faaed28614615ca884dd9ae5bc0c1b6
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Extracted a total of 3852 records from /backup/42/42f5783d3faaed28614615ca884dd9ae5bc0c1b6
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Found WebKit ResourceLoadStatistics observations.db file at path
/backup/94/946c838869839807f4582a3243c3011af48559f6
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Extracted a total of 3852 records from /backup/94/946c838869839807f4582a3243c3011af48559f6
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Found WebKit ResourceLoadStatistics observations.db file at path
/backup/cc/ccec792299a6757805ad6222416dfd73d17bc6c3
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Extracted a total of 3860 records from /backup/cc/ccec792299a6757805ad6222416dfd73d17bc6c3
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Found WebKit ResourceLoadStatistics observations.db file at path
/backup/f5/f57204be6a12561dec4eaeb615a50709b7a8dbc2
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Extracted a total of 3891 records from /backup/f5/f57204be6a12561dec4eaeb615a50709b7a8dbc2
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Found WebKit ResourceLoadStatistics observations.db file at path
/backup/0e/0ea6cdbc8ff6a2a7b0c7710ec022d323b2ccdfda
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Extracted a total of 3896 records from /backup/0e/0ea6cdbc8ff6a2a7b0c7710ec022d323b2ccdfda
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Found WebKit ResourceLoadStatistics observations.db file at path
/backup/ed/eddf34b78df8122b0f3cf947f629e3fc9a3f3f08
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Extracted a total of 4391 records from /backup/ed/eddf34b78df8122b0f3cf947f629e3fc9a3f3f08
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Found WebKit ResourceLoadStatistics observations.db file at path
/backup/b0/b0057674a16ea768bcf1313a7dcd16fb4a94b53e
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Extracted a total of 4392 records from /backup/b0/b0057674a16ea768bcf1313a7dcd16fb4a94b53e
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Found WebKit ResourceLoadStatistics observations.db file at path
/backup/29/296d9a51ab4f39240f9767a657b1707f9548eb58
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Extracted a total of 4396 records from /backup/29/296d9a51ab4f39240f9767a657b1707f9548eb58
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Found WebKit ResourceLoadStatistics observations.db file at path
/backup/24/24217407f60158047cbf5c0ddbc49d8f9725233a
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Extracted a total of 4396 records from /backup/24/24217407f60158047cbf5c0ddbc49d8f9725233a
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Found WebKit ResourceLoadStatistics observations.db file at path
/backup/9c/9cdbbacdea15803c1c7fa5fa5cbbd2b21c86fc3c
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Extracted a total of 4399 records from /backup/9c/9cdbbacdea15803c1c7fa5fa5cbbd2b21c86fc3c
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Found WebKit ResourceLoadStatistics observations.db file at path
/backup/3b/3bc6b9c7ab7794e591efeb504d8936befbb648da
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Extracted a total of 4399 records from /backup/3b/3bc6b9c7ab7794e591efeb504d8936befbb648da
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Found WebKit ResourceLoadStatistics observations.db file at path
/backup/6c/6c0a2ba448af05acafe404eb57936f476d8c2c87
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Extracted a total of 4399 records from /backup/6c/6c0a2ba448af05acafe404eb57936f476d8c2c87
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Found WebKit ResourceLoadStatistics observations.db file at path
/backup/a3/a3f2fb6557fe4499ebdd532801c3e90ef4be2fd5
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Extracted a total of 4420 records from /backup/a3/a3f2fb6557fe4499ebdd532801c3e90ef4be2fd5
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Found WebKit ResourceLoadStatistics observations.db file at path
/backup/d1/d1caf0294fe69360af4e8754b333cb1aecfdae5f
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Extracted a total of 4424 records from /backup/d1/d1caf0294fe69360af4e8754b333cb1aecfdae5f
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Found WebKit ResourceLoadStatistics observations.db file at path
/backup/06/06b2e4536e9b1d0af52efebc41e3fb2b464ba063
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Extracted a total of 4464 records from /backup/06/06b2e4536e9b1d0af52efebc41e3fb2b464ba063
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Found WebKit ResourceLoadStatistics observations.db file at path
/backup/fa/fa32c684bb3319c1398d7ff22e1623524725180a
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Extracted a total of 4471 records from /backup/fa/fa32c684bb3319c1398d7ff22e1623524725180a
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Found WebKit ResourceLoadStatistics observations.db file at path
/backup/7b/7bfbc36b113ba8a160055188b3e014959228d452
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Extracted a total of 4481 records from /backup/7b/7bfbc36b113ba8a160055188b3e014959228d452
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Found WebKit ResourceLoadStatistics observations.db file at path
/backup/fb/fb02dbb27e2453cf4c51379ff2469682697ec2da
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Extracted a total of 4487 records from /backup/fb/fb02dbb27e2453cf4c51379ff2469682697ec2da
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Found WebKit ResourceLoadStatistics observations.db file at path
/backup/60/60dd78f1cc84403675cc877c39be40cd5a195b2f
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Extracted a total of 4493 records from /backup/60/60dd78f1cc84403675cc877c39be40cd5a195b2f
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Found WebKit ResourceLoadStatistics observations.db file at path
/backup/81/81935bc48286424050bd3aefb2ad7d79f8327008
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Extracted a total of 4493 records from /backup/81/81935bc48286424050bd3aefb2ad7d79f8327008
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Found WebKit ResourceLoadStatistics observations.db file at path
/backup/6d/6dddcde2b64373668f78b3b693dd7c59557d753e
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Extracted a total of 4498 records from /backup/6d/6dddcde2b64373668f78b3b693dd7c59557d753e
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Found WebKit ResourceLoadStatistics observations.db file at path
/backup/c0/c03ff25d9f8e6ea325e589077f3f908bb7ad6560
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] Extracted a total of 4499 records from /backup/c0/c03ff25d9f8e6ea325e589077f3f908bb7ad6560
INFO [mvt.ios.modules.mixed.webkit_resource_load_statistics] The WebkitResourceLoadStatistics module produced no detections!
INFO [mvt.ios.modules.mixed.webkit_session_resource_log] Running module WebkitSessionResourceLog...
INFO [mvt.ios.modules.mixed.webkit_session_resource_log] Extracted records from 0 Safari browsing session resource logs
INFO [mvt.ios.modules.mixed.webkit_session_resource_log] The WebkitSessionResourceLog module produced no detections!
INFO [mvt.ios.modules.mixed.whatsapp] Running module Whatsapp...
INFO [mvt.ios.modules.mixed.whatsapp] Found WhatsApp database at path: /backup/7c/7c7fba66680ef796b916b067077cc246adacf01d
INFO [mvt.ios.modules.mixed.whatsapp] Extracted a total of 0 WhatsApp messages
INFO [mvt.ios.modules.mixed.whatsapp] The Whatsapp module produced no detections!
INFO [mvt.ios.modules.mixed.shortcuts] Running module Shortcuts...
INFO [mvt.ios.modules.mixed.shortcuts] Found Shortcuts database at path: /backup/5b/5b4d0b44b5990f62b9f4d34ad8dc382bf0b01094
INFO [mvt.ios.modules.mixed.shortcuts] Extracted a total of 14 Shortcuts
INFO [mvt.ios.modules.mixed.shortcuts] The Shortcuts module produced no detections!
INFO [mvt.ios.modules.mixed.applications] Running module Applications...
INFO [mvt.ios.modules.mixed.applications] Extracted a total of 114 applications
WARNING [mvt.ios.modules.mixed.applications] Suspicious app not installed from the App Store or MDM: org.onionshare.OnionShare
INFO [mvt.ios.modules.mixed.calendar] Running module Calendar...
INFO [mvt.ios.modules.mixed.calendar] Found calendar database at path: /backup/20/2041457d5fe04d39d0ab481178355df6781e6858
INFO [mvt.ios.modules.mixed.calendar] Extracted a total of 3290 calendar items
INFO [mvt.ios.modules.mixed.calendar] The Calendar module produced no detections!
INFO [mvt.ios.modules.mixed.global_preferences] Running module GlobalPreferences...
INFO [mvt.ios.modules.mixed.global_preferences] Found Global Preference database at path: /backup/0d/0dc926a1810f7aee4e8f38793ed788701f93bf9d
INFO [mvt.ios.modules.mixed.global_preferences] Extracted a total of 32 Global Preferences
WARNING [mvt.ios.modules.mixed.global_preferences] Lockdown mode disabled
INFO [mvt.ios.modules.mixed.global_preferences] The GlobalPreferences module produced no detections!
16:56:50 WARNING NOTE: Detected indicators of compromise. Only expert review can confirm if the detected indicators are signs of an attack.
Please seek reputable expert help if you have serious concerns about a possible spyware attack. Such support is available to human rights defenders and
civil society through Amnesty International's Security Lab at https://securitylab.amnesty.org/get-help/?c=mvt
WARNING [mvt] The analysis of the backup produced 1 detections!You can see a couple of warnings at the end. Since I have an app installed via a developer tool called TestFlight, the test flags and detects OnionShare as suspicious.
If everything it finds is familiar, you have nothing to worry about.
Conclusion
Once you’ve completed these steps, your iPhone will have been thoroughly scanned for indicators of spyware. If the analysis finds anything suspicious, it’s often due to an app installed through non-standard means, like testing software or apps not from the App Store. However, if there are detections you don’t recognize, it’s best to reach out for expert help, such as Amnesty International’s Security Lab, to review and confirm any potential threats.
