iOS, <a href="https://docs.mvt.re/en/latest/ios/methodology/" rel="nofollow">https://docs.mvt.re/en/latest/ios/methodology/</a><p><i>> You will need to decide whether to attempt to jailbreak the device and obtain a full filesystem dump, or not.</i><p>Since Apple won't allow iDevice owners to access an unredacted raw disk image for forensics, iOS malware detection tools are hamstrung. The inability to fully backup devices means that post-intrusion device restore is literally impossible. Only a new OS version can be installed, then a subset of the original data can be restored, then every app/service needs to re-establish trust with this newly "untrusted" (but more trustworthy than the previously trusted-but-compromised) device.<p>In theory, Apple could provide their own malware analysis toolset, or provide optional remote attestation to verify OS and baseband integrity.<p>In the absence of persistent disk artifacts, the next best option is behavioral analysis, e.g. usage anomalies ("dog that did not bark") in CPU, battery, storage or network. Outbound network traffic can be inspected by a router and compared against expected application and system traffic. This requires an outbound firewall where rules can specify traffic by wildcard domain names, which are widely used by CDNs. Apple helpfully provides a list of domains and port numbers for all Apple services.