Hi DFIR community,

Just wanting to share our FOSS tool we're developing to enable remote Android and iOS forensics and network monitoring capabilities. Please note these are specifically for live logical acquisitions and not disk.

Description:

MESH enables remote mobile forensics by assigning CGNAT-range IP addresses to devices over an encrypted, censorship-resistant peer-to-peer mesh network.

Mobile devices are often placed behind carrier-grade NAT (CGNAT), firewalls, or restrictive mobile networks that prevent direct inbound access. Traditional remote forensics typically requires centralized VPN servers or risky port-forwarding.

MESH solves this by creating an encrypted peer-to-peer overlay and assigning each node a CGNAT-range address via a virtual TUN interface. Devices appear as if they are on the same local subnet — even when geographically distant or behind multiple NAT layers.

This enables remote mobile forensics using ADB Wireless Debugging and libimobiledevice, allowing tools such as WARD, MVT, and AndroidQF to operate remotely without exposing devices to the public internet.

The mesh can also be used for remote network monitoring, including PCAP capture and Suricata-based intrusion detection over the encrypted overlay. Allowing for both immediate forensics capture and network capture.

MESH is designed specifically for civil society forensics & hardened for hostile/censored networks:

• Direct peer-to-peer WireGuard transport when available

• Optional AmneziaWG to obfuscate WireGuard fingerprints to evade national firewalls or DPI inspection

• Automatic fallback to end-to-end encrypted HTTPS relays when UDP is blocked

Meshes are ephemeral and analyst-controlled: bring devices online, collect evidence, and tear the network down immediately afterward. No complicated hub-and-spoke configurations.