iOS Forensics Server

Example Use Cases

• 1

  Navigate and inspect an extracted iOS file system (file listings, metadata, content preview) to locate evidence.

• 2

  Analyze SQLite databases from iOS apps, including WAL handling, schema inspection, and recovering deleted records.

• 3

  Extract and correlate iOS artifacts (messages, calls, contacts, locations, photos) to build timelines and generate forensic reports.

Description

This MCP server provides tools for forensic analysis of iOS device extractions, including file system browsing, content viewing, and metadata analysis. It includes specialized parsers for SQLite (with WAL and deleted record recovery), property lists (plist), and common iOS artifacts (messages, call logs, contacts, locations, browser history, and photo geolocation). The server can generate timelines, perform deleted-data recovery, and produce forensic reports, and is designed to integrate with Claude and other MCP-compatible clients for interactive analysis. It is presented as an educational/learning tool and recommends read-only operation for evidence preservation.