Ios Forensics MCP

🚀 iOS Forensic MCP Server

A forensic analysis server for analyzing the iOS file system using the Model Context Protocol (MCP). This project enables AI assistants like Claude to access and analyze the extracted iOS file system for digital forensics work.

🚀 Quick Start

The iOS Forensic MCP Server provides tools for analyzing files extracted from iOS devices, focusing on:

• File system analysis
• SQLite database parsing (including WAL file analysis)
• Property list (plist) parsing
• Analysis of iOS special logs (messages, call logs, contacts, locations, etc.)
• Timeline generation
• Forensic reporting

This project is designed as an educational/learning tool, allowing users to interact with AI assistants to explore and analyze iOS data.

✨ Features

File System Tools

• Directory navigation and metadata parsing
• File content viewing and type identification
• File search for content and pattern matching

SQLite Analysis

• Database discovery and schema parsing
• Secure query execution (including WAL processing)
• Recovery of deleted records in free list pages
• Database slicing for in - depth forensic analysis

Plist Analysis

• Binary and XML plist parsing
• Value extraction and conversion to structured data
• Identification and reconstruction of deleted items

Special Features

• Message log parsing
• Application log collection
• System cache analysis

📦 Installation

Requirements

• Operating System: Linux, macOS, or Windows (supported via WSL)
• Python Version: 3.8 or higher
• Permissions: Run in read - only mode to protect evidence integrity

Steps

1. Install from Source Code

   Clone the repository and run the installation script:

   git clone https://github.com/rlabs-inc/ios-forensics-mcp.git
   cd ios-forensics-mcp
   ./install.sh
   

2. Dependency Management

   Use requirements.txt to manage Python dependencies.

3. Configuration File

   Create and edit the config.json file to set analysis parameters.

💻 Usage Examples

Configuration Example

{
  "tools": {
    "sqlite": {
      "enabled": true,
      "database_path": "/path/to/databases"
    },
    "plist": {
      "enabled": true,
      "plist_path": "/path/to/plists"
    }
  },
  "logging": {
    "level": "INFO",
    "output_file": "analysis.log"
  }
}

Starting the MCP Server

# Start with default configuration
ios-forensics-mcp

# Start with a specified configuration file
ios-forensics-mcp --config /path/to/config.json

# Specify the path to the iOS root directory
ios-forensics-mcp --root-path /path/to/ios_extraction

📚 Documentation

For detailed documentation on each tool and its functions, please refer to the documentation.

🔧 Technical Details

Project Structure

ios_forensics_mcp/
├── tools/              # Tool implementations
│   ├── filesystem/     # File system tools
│   ├── sqlite/         # SQLite analysis tools
│   ├── plist/          # Property List tools
│   └── specialized/    # iOS specific log parsers
└── utils/              # Common utility functions

🛡️ Important Note

This tool runs with the permissions of the executing user and accesses the file system accordingly. Security recommendations:

• Always run in read - only mode to protect evidence.
• Validate paths to prevent directory traversal attacks.
• Use a dedicated unprivileged user to run the server.
• Restrict access to the extracted iOS file system.

📄 License

This project is distributed under the MIT License. For detailed information, please refer to the LICENSE file.

🤝 Contribution

Contributions are welcome! Please feel free to submit a Pull Request.

🙏 Acknowledgments

• Thanks to the digital forensics community for their research and documentation on iOS legacy.
• Thanks to the MCP community for creating the protocol that makes this tool possible.