⚠️ Note this is an AI generated application. - see credits and disclaimer below.

MECT — Mobile Extraction Comparison Tool

A tool for comparing mobile device backups against filesystem acquisitions.

Provides both a Tkinter GUI and a command-line interface.

Credits and Disclaimer

• software conceptualization, design and architecture - Chris Hargreaves
• code - Claude Opus 4.5/4.6

Supported Formats

Backups (left pane / first argument):

Format	Description
iOS backup directory	Folder containing Manifest.db (standard iTunes/Finder backup)
iOS backup ZIP	Zipped iTunes backup
Android .ab file	AES-256 encrypted or unencrypted Android backup
Magnet Acquire Quick Image (Android)	ZIP containing adb-data.tar (or directory containing such a ZIP)
Magnet Acquire Quick Image (iOS)	ZIP containing Manifest.db plus optional Filesystem/ and Live Data/ folders

Filesystem acquisitions (right pane / second argument):

Format	Description
TAR archive	Any compression supported; platform auto-detected from paths
ZIP archive	Platform auto-detected
Extracted directory	Walked recursively; platform auto-detected

Installation

python3 -m venv venv
source venv/bin/activate
pip install -r requirements.txt

Usage

GUI

python main.py

Load a backup and filesystem acquisition using the toolbar buttons, then run the comparison to see mapped, unmapped, and filesystem-only files.

CLI

python compare_cli.py <backup_path> <filesystem_path> [options]

Options:

Flag	Description
-o, --output	Output format: stats (default), detailed, domains, json, csv-unmapped, csv-fs-only, csv-all
-p, --password	Password for encrypted backups
-q, --quiet	Suppress progress messages

Examples:

# Basic comparison with summary stats
python compare_cli.py ./backup ./filesystem.tar

# Android encrypted backup
python compare_cli.py ./backup.ab ./filesystem.tar -p mypassword

# Export all mappings as CSV
python compare_cli.py ./backup ./filesystem.tar -o csv-all > mappings.csv

# Full JSON output
python compare_cli.py ./backup ./filesystem.tar -o json > results.json

Testing

pip install pytest
python -m pytest tests/ -v

Architecture

• main.py — Tkinter GUI application
• compare_cli.py — Command-line interface
• ios_backup_parser.py — iOS backup parsing (encrypted and unencrypted)
• android_backup_parser.py — Android .ab backup parsing
• magnet_parser.py — Magnet Acquire Quick Image parsing
• filesystem_loader.py — Filesystem acquisition loading (TAR, ZIP, directory)
• path_mapper.py — iOS backup-to-filesystem path mapping
• android_path_mapper.py — Android backup-to-filesystem path mapping