RLabs-Inc/ios-forensics-mcp

A forensic analysis server for iOS file systems using the Model Context Protocol (MCP). This project enables AI assistants like Claude to access and analyze extracted iOS file systems for digital forensics purposes.
## 🔍 Overview
The iOS Forensics MCP Server provides tools for analyzing iOS device extractions, focusing on:
File system analysis
SQLite database parsing with WAL forensics
Property List (plist) parsing
iOS artifact analysis (messages, call logs, contacts, locations, etc.)
Timeline generation
Forensic reporting
This is designed as an educational/learning tool, allowing users to interact with an AI assistant to explore and analyze iOS data.
## 🚀 Features
File System Tools
Directory navigation with metadata analysis
File content viewing with type recognition
File searching with content and pattern matching
SQLite Analysis
Database discovery and schema analysis
Secure query execution with WAL handling
Deleted record recovery from freelist pages
Database carving for deep forensic analysis
Plist Analysis
Binary and XML plist parsing
Value extraction with query paths
Timestamp analysis
Specialized iOS Parsers
Messages analyzer (SMS/iMessage)
Call log analyzer
Contacts analyzer
Location data analyzer
Browser history analyzer
Photo geolocation extractor
App data analyzer
Advanced Analysis
Timeline generation across multiple data sources
Pattern recognition for user behavior analysis
Deleted data recovery
Comprehensive reporting
## 📋 Requirements
Python 3.9+
MCP compatible client (Claude Desktop, Claude Code, VS Code with MCP plugin, etc.)
Extracted iOS file system (accessible directory)
## 📦 Installation
### Using uv
bash
# Install using uv
uv install ios-forensics-mcp
### From source
bash
# Clone the repository
git clone https://github.com/RLabs-Inc/ios-forensics-mcp.git
cd ios-forensics-mcp
# Install dependencies (automatically uses editable mode)
uv sync
## Claude Desktop Setup
Add the MCP server to your Claude Desktop configuration file (typically located at ~/.claude/config.json or similar path based on your OS):
json
"mcpServers": {
"ios-forensics": {
"command": "uv",
"args": [
"run",
"ios-forensics-mcp",
"--root-path",
"/path/to/ios_extraction"
After adding this configuration, restart Claude Desktop, and the iOS Forensics MCP server will appear in your available servers list.
### Using with Claude
Once the server is running and configured with Claude, you can start asking forensic questions:
"Can you show me the SMS messages from this device?"
"Extract location data from this iPhone and create a timeline"
"Analyze the call history and show me frequently contacted numbers"
"Find deleted messages in the SMS database"
"Generate a report of all activity on March 15th"
"What apps are installed on this device?"
"Show me the last known location of this device"
"Extract photos and their geolocation data"
"Analyze the browser history for suspicious activity"
"Find all contacts with phone numbers"
## Claude Code Integration
To use iOS Forensics MCP with Claude Code, you need to add it as an MCP server. First ensure you have Claude Code installed:
bash
# Install Claude Code if not already installed