# Check iPhone for Pegasus

**URL:** <https://community.metaspike.com/t/check-iphone-for-pegasus/704>\
**Category:** Digital Forensics\
**Created:** [July 21, 2021, 7:12pm UTC](https://community.metaspike.com/t/check-iphone-for-pegasus/704 "2021-07-21T19:12:58Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![caseyl4n6](https://community-cdn.metaspike.com/user_avatar/community.metaspike.com/caseyl4n6/32/330_2.png) [@caseyl4n6](https://community.metaspike.com/u/caseyl4n6)\
**Post date:** [July 21, 2021, 7:12pm UTC](https://community.metaspike.com/t/check-iphone-for-pegasus/704/1 "2021-07-21T19:12:58Z")

</div>

Hello,

We need to scan a clients iphone for Pegasus. What is the quickest way to handle this?

---

<div class="post-metadata">

**Author:** ![agungor](https://community-cdn.metaspike.com/user_avatar/community.metaspike.com/agungor/32/719_2.png) [@agungor](https://community.metaspike.com/u/agungor)\
**Post date:** [July 21, 2021, 7:28pm UTC](https://community.metaspike.com/t/check-iphone-for-pegasus/704/2 "2021-07-21T19:28:20Z")

</div>

You would probably want to look at Mobile Verification Toolkit (MVT) from Amnesty International:

[mvt-project/mvt: MVT is a forensic tool to look for signs of infection in smartphone devices (github.com)](https://github.com/mvt-project/mvt)

You can start by obtaining a file system dump or an iTunes backup—using the mobile forensics tool of your choice or even with something like [libimobiledevice](https://libimobiledevice.org/) in a pinch.

For instance, here is how you can create an iTunes backup with libimobiledevice:

```
idevicebackup2 backup encryption on
idevicebackup2 backup --full /path/to/backup/

```

If you have an iTunes backup, you can run MVT against it as follows:

```
mvt-ios check-backup -i pegasus.stix2 -o <folder for JSON results> <backup path>

```

Similarly, you can run MVT against a file system dump as follows:

```
mvt-ios check-fs -i pegasus.stix2 -o <folder for JSON results> <path to filesystem dump>

```

Here are some more details regarding MVT usage:

[Check a Backup with mvt-ios - Mobile Verification Toolkit](https://mvt.readthedocs.io/en/latest/ios/backup/check.html)

[Check a Filesystem Dump with mvt-ios - Mobile Verification Toolkit](https://mvt.readthedocs.io/en/latest/ios/filesystem/check.html)

You can obtain the STIX2 file defining a list of malicious indicators from here:

[investigations/2021-07-18\_nso at master · AmnestyTech/investigations (github.com)](https://github.com/AmnestyTech/investigations/tree/master/2021-07-18_nso)

The above repo also contains raw lists of email addresses, files, domains, etc. that comprise the Pegasus indicators list. These can be used with mobile forensics tools independently of MVT if needed.

Good luck 😃

---

<div class="post-metadata">

**Author:** ![agungor](https://community-cdn.metaspike.com/user_avatar/community.metaspike.com/agungor/32/719_2.png) [@agungor](https://community.metaspike.com/u/agungor)\
**Post date:** [July 23, 2021, 7:05pm UTC](https://community.metaspike.com/t/check-iphone-for-pegasus/704/3 "2021-07-23T19:05:09Z")

</div>

I’ll also drop a link to Amnesty International’s Forensic Methodology Report re: catching NSO Group’s Pegasus in case it is helpful to anyone.

> **[Forensic Methodology Report: How to catch NSO Group’s Pegasus](https://www.amnesty.org/en/latest/research/2021/07/forensic-methodology-report-how-to-catch-nso-groups-pegasus/)**
>
> NSO Group claims that its Pegasus spyware is only used to “investigate terrorism and crime” and “leaves no traces whatsoever”. This Forensic Methodology Report shows that neither of these statements are true. This report accompanies the release of...

---

<div class="post-metadata">

**Author:** ![caseyl4n6](https://community-cdn.metaspike.com/user_avatar/community.metaspike.com/caseyl4n6/32/330_2.png) [@caseyl4n6](https://community.metaspike.com/u/caseyl4n6)\
**Post date:** [July 27, 2021, 4:00pm UTC](https://community.metaspike.com/t/check-iphone-for-pegasus/704/4 "2021-07-27T16:00:38Z")

</div>

Super helpful summary thanks!