iOS Forensics MCP Server

What is iOS Forensics MCP Server?

A forensic analysis server that enables AI assistants like Claude to access and analyze extracted iOS file systems for digital forensics purposes. It provides tools for file system analysis, SQLite database parsing with WAL forensics, plist parsing, iOS artifact analysis, timeline generation, and forensic reporting. Designed as an educational/learning tool.

How to use iOS Forensics MCP Server?

Install via uv or from source. Configure the server in an MCP-compatible client (Claude Desktop, Claude Code, VS Code with MCP plugin) by adding a server entry that points to an extracted iOS file system. Start the server with the command ios-forensics-mcp or uv run ios-forensics-mcp --root-path /path/to/ios_extraction. Then ask forensic questions like "Show me the SMS messages from this device" or "Generate a report of all activity on March 15th".

Key features of iOS Forensics MCP Server

• File system navigation with metadata and content viewing
• SQLite database analysis with WAL forensics and deleted record recovery
• Binary and XML plist parsing with timestamp analysis
• Specialized parsers for messages, call logs, contacts, and locations
• Timeline generation across multiple data sources
• Pattern recognition and deleted data recovery

Use cases of iOS Forensics MCP Server

• Analyze SMS/iMessage conversations and recover deleted messages
• Extract and geolocate photos from an iOS device extraction
• Generate a timeline of user activity from multiple artifacts
• Analyze call history, contacts, and browser history for suspicious patterns
• Produce comprehensive forensic reports for educational exercises

FAQ from iOS Forensics MCP Server

What are the system requirements for iOS Forensics MCP Server?

Python 3.9+, an MCP-compatible client (Claude Desktop, Claude Code, VS Code with MCP plugin), and an extracted iOS file system accessible as a directory.

Where does the data live and how is it accessed?

The server reads from a user-supplied extracted iOS file system directory. It runs with the permissions of the executing user and should be used in read-only mode for evidence preservation.

Is this tool production-grade or for learning?

It is designed as an educational/learning tool for exploring and analyzing iOS data with an AI assistant, not as a production forensic tool.

How do I configure the server to run in read-only mode?

Set "read_only": true in the configuration file (config.json) under ios_filesystem, or ensure the underlying file system directory is mounted read-only.

What license does iOS Forensics MCP Server use?

It is released under the MIT License.