MESH client - remote forensics

The MESH client allows your device to connect with a trusted analyst for remote forensics.

It enables remote wireless debugging for Android devices, providing mobile forensics and controlled network access over secure tunnels.

Mobile devices are often placed behind NAT, firewalls, or restrictive mobile networks that prevent direct inbound access. Traditional remote forensics typically requires centralized VPN servers or risky port-forwarding.

MESH solves this by establishing secure connections using WireGuard-based tunneling and Tailscale coordination. Each device is assigned a private network address, allowing it to communicate securely with trusted infrastructure as if on the same local network.

To enable this functionality, MESH uses Android’s VpnService API. This creates a virtual network (TUN) interface that allows the app to route traffic required for these secure connections. This is necessary for features such as remote ADB wireless debugging and interaction with forensic tools.

The VPN interface is used only for these specific connections and does not provide a general-purpose VPN service or anonymization.

MESH is not a standalone networking or VPN tool. It only functions when connected to trusted, analyst-operated infrastructure configured for remote forensic analysis. Users cannot use the app independently without this setup.

This setup enables remote mobile forensics using tools such as WARD, MVT, AndroidQF, and libimobiledevice, without exposing devices directly to the public internet.

For additional technical details and source code, see the MESH project repository:

https://github.com/BARGHEST-ngo/MESH