Skip to content

User guide

Learn how to use MESH for forensic investigations, manage your mesh network, and perform common tasks.

Overview

This section covers:

  • Forensic workflows - How to perform remote device analysis
  • Network management - Managing nodes, users, and access control
  • Common tasks - Day-to-day operations and best practices
  • Architecture details - Deep dive into how MESH works

Documentation

  • User guide

    Complete guide to using MESH for forensic investigations, including workflows, tools, and best practices.

    View User guide

  • Architecture Details

    Deep dive into MESH architecture, including technical details, protocols, and implementation.

    View Architecture

Quick Reference

Common commands

#Connect and pair to an Android device over ADB-over-Wifi
mesh adbpair --host 100.63.x.x --hostport 1234 --pairport 1234 --code 1234

#Connect and pair BUT initate AndroidQF instantly on connection
mesh adbpair --host 100.63.x.x --hostport 1234 --pairport 1234 --code 1234 --qf

#Initate ADB acquisition (AndroidQF/WARD) into the bind-mounted acquisitions dir
mesh adbcollect --output /home/mesh/acquisitions/case-2026-08-27

# Check mesh status
mesh status

# Test connection and establish UDP hole punching
mesh ping 100.67.x.x

# Connect to Android device
adb connect 100.64.x.x:5555

# Analyse a collected acquisition with MVT
mvt-android check-androidqf /home/mesh/acquisitions/case-2026-08-27

# Capture network traffic into the same acquisitions directory
tcpdump -i mesh0 -w /home/mesh/acquisitions/case-2026-08-27/capture.pcap

Getting Help

Next: Read the User guide for detailed workflows →