iOS Forensics MCP Server

Created By
RLabs-Inca year ago
iOS Forensics MCP Server for analyzing iPhone/iPad file systems
Overview

What is iOS Forensics MCP Server?

The iOS Forensics MCP Server is a forensic analysis tool designed for examining iPhone and iPad file systems using the Model Context Protocol (MCP). It enables AI assistants to access and analyze extracted iOS file systems for digital forensics purposes.

How to use iOS Forensics MCP Server?

To use the iOS Forensics MCP Server, install it via uv or clone the repository from GitHub. Configure it with a compatible client like Claude, and start the server to interact with it for forensic analysis.

Key features of iOS Forensics MCP Server?

  • File system analysis and directory navigation
  • SQLite database parsing with WAL forensics
  • Property List (plist) parsing
  • Analysis of iOS artifacts such as messages, call logs, and locations
  • Timeline generation and forensic reporting

Use cases of iOS Forensics MCP Server?

  1. Analyzing SMS messages and call logs from iOS devices.
  2. Extracting and generating timelines from location data.
  3. Recovering deleted records from SQLite databases.
  4. Generating comprehensive forensic reports for investigations.

FAQ from iOS Forensics MCP Server?

  • Can I analyze any iOS device?
    Yes, as long as you have the extracted file system from the device.
  • Is there a specific Python version required?
    Yes, Python 3.9 or higher is required.
  • Is the tool free to use?
    Yes, it is open-source and available under the MIT License.
Project Info
Created At
a year ago
Updated At
a year ago
Author Name
RLabs-Inc
Star
0
Language
Python
License
MIT license

Recommend Servers

View All
Tavily Mcp
@tavily-ai

JavaScript
a year ago
Bring your real authenticated browser session to AI coding agents. Local-first MCP server + Chrome MV3 extension. No cloud. No telemetry.
@Cubenest

peek records the user's actual logged-in browser (DOM via rrweb, console events, network metadata, optional response bodies via opt-in Deep capture) through a Chrome MV3 extension. The extension ships events through a native-messaging stdio bridge to a local MCP server (peek-mcp), which persists them to a SQLite database at ~/.peek/sessions.db. AI coding agents (Claude Code, Cursor, Cline, Windsurf) read sessions from the database via 10 MCP tools: Tool What it does list_recent_sessions List recently recorded sessions (id, origin, ts, event count). get_session_summary LLM-readable narrative summary of a session. get_session_console_errors Console errors recorded in a session. get_session_network_errors Failed/notable network requests in a session. get_user_action_before_error Last N user actions before a console error. generate_playwright_repro Generate a runnable Playwright test from a session. get_dom_snapshot Reconstruct the DOM at a given timestamp. query_dom_history Timeline of attribute/text changes for a selector. request_authorization Side-panel consent for write actions (Level 3). execute_action Dispatch a UI action (gated by permission level + destructive blocklist). Why local-first matters Every other "browser session for AI" tool ships to a vendor cloud. peek's SQLite + extension live on the user's machine — no remote endpoints, no telemetry. The privacy policy (docs/peek/PRIVACY_POLICY.md) is the source of truth. Install # 1. Add the MCP server to Claude Code claude mcp add peek -- npx -y @peekdev/mcp # 2. Install the Chrome extension from the Chrome Web Store # (link added once the CWS listing is approved)

a day ago