[besendorf]

Coruna's randomized preference filenames and app-container Documents/.devcache artifacts are missed by static filename indicators. Add scoped checks to Manifest and Filesystem, with medium-severity path findings and high-severity findings when the published content structure matches. Correlate matching device-identifier fingerprints across distinct application containers without exporting the raw identifiers or tracked photo path.

Map known backup domains to device paths, handle iOS path aliases and Windows separators, and require a directory boundary when matching path indicators. When --hashes or HASH_FILES is enabled, store and check file SHA-256 values in module results so payload hash IOCs provide detection coverage and saved results can be rechecked. Content reads are bounded for artifact inspection and confined to regular files within the acquisition.

The artifact definitions come from iVerify's September 2026 Coruna/DarkSword report. Path-only findings remain distinct from corroborated content matches and confirmed hash IOCs.

[github-actions]

Coverage Report •

File	Stmts	Miss	Cover	Missing
src/mvt/common
indicators.py	338	47	86%	60–62, 75–81, 183, 189, 195, 201, 223, 237–242, 349, 391–394, 435–436, 487, 510–513, 557, 569, 585–593, 604, 625, 647, 680, 702–712, 750, 793, 814
src/mvt/ios
cmd_check_backup.py	47	5	89%	71, 77–82, 96–100
cmd_check_fs.py	21	2	90%	58, 61
coruna.py	96	3	97%	47, 167–168
src/mvt/ios/modules/backup
manifest.py	115	10	91%	77, 84, 153, 162, 165, 174–176, 240–241
src/mvt/ios/modules/fs
filesystem.py	57	8	86%	63, 84, 96–97, 110–111, 132–133
TOTAL	9989	2302	77%

Tests	Skipped	Failures	Errors	Time
575	1 💤	0 ❌	0 🔥	16.824s ⏱️