ALEAPP

No entries match these filters. Clear filters

1. v2026.4.5 Nov 3, 2026 · issue 129

   ALEAPP adds Android bug report parsing, SQLite WALSQLite WALA write-ahead logging mode for SQLite databases where changes are written to a separate log file before the main database, allowing concurrent reads during writes and faster commit performance. multi-generation reads, and dozens of new artifacts including Health ConnectHealth ConnectAn Android platform API, maintained by Google, that provides a unified on-device store for health and fitness data, letting apps read and write standardized health records without each building its own data pipeline., Hive, and C2PA provenanceprovenanceEvidence recording where a software artifact came from and how it was built, including its source and build process. It helps a consumer check that the artifact matches a trusted build.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2026.4.5 https://github.com/abrignoni/ALEAPP.git
   # already have the repo? check out this version:
   $ git checkout v2026.4.5

   • Adds is_sqlite_sidecar to replace hand-written sidecar filters across 56 modules, and reads committed state, previous WALWALWrite-Ahead Log: a durability mechanism in databases where changes are recorded to an append-only log before being applied to main storage, giving tools crash recovery and atomic transactions without full-page rewrites. generation leftover frames, and uncommitted tails from sqlite_wal v0.1.0 — recovering hidden rows from Samsung Honeyboard, Snapchat, Phone Link, Discord, Telegram, and Google Chat.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds new artifacts for Google Play Store App Data Usage (reading data_usage.db, one row per package, date, and network state combination including byte counts), Google Play Services Screen Lock State History, Telegram Push Messages (unread_push_messages), Phone Accounts (alongside call logs that now include the SIM ICCID for each call), Health Connect (Android 14+), Samsung Smart Switch, Bluetooth File Transfers (btopp.db), Blocked Numbers, Android Auto Rejected Cars, Setup Flags, boot reason entries from the persistent property store, one database per Android user in frosting, Calendar, Settings Search, My Files recents, Android Auto, image rows from cmh when location_view cannot be queried (Android 16), Instagram Pending Media, Samsung Launcher Search History, Samsung Wi-Fi networks and foreground apps (TcpMonitorApInfo.json), Package Rollback Records, Permission Controller Safety Label History, Permission Change Dates, Permission Controller Log, Google Maps Sync places and people, Battery Stats Daily Package Changes, Wi-Fi IP Memory Store, Call Data Logs (Scone), and Mozilla browser profile times.
   • Adds C2PA provenance reading through the vendored c2pareader 0.2.0.
   • Adds a Hive box inventory artifact through the vendored hive-parser.
   • Adds Chromium artifacts for Omnibox Shortcuts, Browsing Topics API usage, web notifications, website usage events and share history, Site Permissions with permission prompt actions and counts, the File System API including bucket storage, AccountBookmarks in Bookmarks, and ETag and Last-Modified fields in Downloads.

   +3 more show less

   • Names Chromium browsers from the package folder rather than the full path, so WebViews in Microsoft and other apps are attributed to their host app instead of being misidentified as Edge.
   • Facebook now reads Messenger's contacts store and prefs_db, with an Android User column.
   • Supports -t raw NTFSNTFSThe default file system format for Windows, developed by Microsoft, storing files with rich metadata and access controls; cyber tools target it to parse artifacts like timestamps, alternate data streams, and the MFT., ReFS, exFAT, and FAT name case-matching on macOS and Linux to match existing Windows behaviour.
   • Adds is_sqlite_sidecar to replace hand-written sidecar filters across 56 modules, and reads committed state, previous WALWALWrite-Ahead Log: a durability mechanism in databases where changes are recorded to an append-only log before being applied to main storage, giving tools crash recovery and atomic transactions without full-page rewrites. generation leftover frames, and uncommitted tails from sqlite_wal v0.1.0 — recovering hidden rows from Samsung Honeyboard, Snapchat, Phone Link, Discord, Telegram, and Google Chat.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds new artifacts for Google Play Store App Data Usage (reading data_usage.db, one row per package, date, and network state combination including byte counts), Google Play Services Screen Lock State History, Telegram Push Messages (unread_push_messages), Phone Accounts (alongside call logs that now include the SIM ICCID for each call), Health Connect (Android 14+), Samsung Smart Switch, Bluetooth File Transfers (btopp.db), Blocked Numbers, Android Auto Rejected Cars, Setup Flags, boot reason entries from the persistent property store, one database per Android user in frosting, Calendar, Settings Search, My Files recents, Android Auto, image rows from cmh when location_view cannot be queried (Android 16), Instagram Pending Media, Samsung Launcher Search History, Samsung Wi-Fi networks and foreground apps (TcpMonitorApInfo.json), Package Rollback Records, Permission Controller Safety Label History, Permission Change Dates, Permission Controller Log, Google Maps Sync places and people, Battery Stats Daily Package Changes, Wi-Fi IP Memory Store, Call Data Logs (Scone), and Mozilla browser profile times.
   • Adds C2PA provenance reading through the vendored c2pareader 0.2.0.
   • Adds a Hive box inventory artifact through the vendored hive-parser.
   • Adds Chromium artifacts for Omnibox Shortcuts, Browsing Topics API usage, web notifications, website usage events and share history, Site Permissions with permission prompt actions and counts, the File System API including bucket storage, AccountBookmarks in Bookmarks, and ETag and Last-Modified fields in Downloads.

   3 more in Everything

2. v2026.4.4 Oct 24, 2026 · issue 120

   Adds --hash for SHA-256SHA-256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. file staging with container timestamps, WALWALWrite-Ahead Log: a durability mechanism in databases where changes are recorded to an append-only log before being applied to main storage, giving tools crash recovery and atomic transactions without full-page rewrites.-mode SQLite immutable=1 fallback, and single-file portable Windows releases.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2026.4.4 https://github.com/abrignoni/ALEAPP.git
   # already have the repo? check out this version:
   $ git checkout v2026.4.4

   • Adds --hash flag (and a matching GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands. checkbox) to record SHA-256 hashes for staged files, capturing container-recorded timestamps from ZIP NTFSNTFSThe default file system format for Windows, developed by Microsoft, storing files with rich metadata and access controls; cyber tools target it to parse artifacts like timestamps, alternate data streams, and the MFT./extended timestamp fields, tar headers (GNU, PAX), L01/AD1 entries, FAT/exFAT entries, and ext/APFSAPFSApple's proprietary filesystem introduced in 2017, replacing HFS+, designed for SSDs with native encryption, snapshots, and space sharing — giving cyber tools reliable forensic primitives on modern Apple devices./HFS+ times.
   • Reads Cellebrite CLBX ZIP times from metadata.msgpack (adding msgpack as a dependency), and extracts creation time from the fourth value of four-value extended timestamp blocks.
   • A WAL-mode SQLite database staged without its -wal file is now opened read-only with immutable=1.
   • Tar links are now read as the member they point to; corrupt ZIP members are skipped rather than halting the run.
   • Windows releases ship as a single portable file per architecture (-windows-x64-portable.zip, -windows-arm64-portable.zip) with no installer required.

   5 details in Everything

   • New detection Yandex Disk artifact module
   • New detection KeepSafe artifact module
   • New detection Google Pay artifact module
   • New detection Offline DJI TXT flight records artifact module
   • New detection Shortcut Service artifact module
   • New detection Chrome Cache - Videos artifact module
   • New detection Chromium downloads matched to MediaStore
   • New detection Google app suggestion and key-value caches artifact modules
   • New detection Discord - Servers artifact module
   • Updated detection Google ODLH gains new Path Points artifact and additional activity fields
   • Updated supported platform Raw image input adds LVM2, LUKS, RAID, FAT12/FAT16 support
   └──▷ BREAKING ON UPGRADE

   • !Python 3.11 or newer is now required to run ALEAPP from source (previously Python 3.10 was sufficient).
   • !There is no aleappGUI executable any more — aleapp without arguments now opens the window.
   • !Windows releases no longer ship an installer; the distribution is a single portable file (aleapp.exe) that must be placed wherever a calling tool expects it.
3. v2026.4.3 Oct 2, 2026 · issue 092

   ALEAPP v2026.4.3 adds SwiftKey language model artifacts, Telegram layer 227 support, and improved raw NTFSNTFSThe default file system format for Windows, developed by Microsoft, storing files with rich metadata and access controls; cyber tools target it to parse artifacts like timestamps, alternate data streams, and the MFT. image staging⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2026.4.3 https://github.com/abrignoni/ALEAPP.git
   # already have the repo? check out this version:
   $ git checkout v2026.4.3

   └──▷ TRY IT
   Parse a raw Android disk image to extract SwiftKey language model artifacts, including Terms by App to see per-app typing history.
   copy

   $ python aleapp.py -t raw -i <path_to_image.img> -o <path_for_report_output>

   • Adds four SwiftKey language model artifacts from dynamic.lm files — Models, Terms, Term Sequences, and Terms by App — covering both the Samsung Keyboard (app_SwiftKey) and SwiftKey app paths.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Supports Telegram layer 227, including sender rank and guest peer fields on older constructors (0x3ae56482, 0x95ef6f2b), seventeen older message classes (including secret chat ones), service message sender reporting, and table preservation when a single record cannot be walked.
   • Updates qnxprobe to 1.57 for -t raw acquisitions, now correctly staging OneDrive Files On-Demand placeholders (instead of zeros), XPRESS-compressed files (via Windows Overlay Filter) as their content, and NTFS-compressed files with early-ending compression units at their full length.
   • Adds four SwiftKey language model artifacts from dynamic.lm files — Models, Terms, Term Sequences, and Terms by App — covering both the Samsung Keyboard (app_SwiftKey) and SwiftKey app paths.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   2 more in Everything

4. v2026.4.2 Sep 29, 2026 · issue 090

   ALEAPP v2026.4.2 adds E01E01A forensic disk image format that stores a drive's contents in segmented files with built-in checksums and metadata, widely used in digital forensics because it supports compression and chain-of-custody verification./AFFAFFAdvanced Forensic Format, an open disk-image container standard maintained by Simson Garfinkel, designed to store forensic evidence with built-in compression, metadata, and cryptographic hashing./DMG/APFSAPFSApple's proprietary filesystem introduced in 2017, replacing HFS+, designed for SSDs with native encryption, snapshots, and space sharing — giving cyber tools reliable forensic primitives on modern Apple devices. image support, WhatsApp channels, ExoPlayer media rejoining, and unified aleapp binary across all platforms.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2026.4.2 https://github.com/abrignoni/ALEAPP.git
   # already have the repo? check out this version:
   $ git checkout v2026.4.2

   └──▷ TRY IT
   Parse an encrypted APFS acquisition from an E01 image, supplying the volume password for on-the-fly decryption — no mounting or admin rights required.
   copy

   $ aleapp -t raw -i /evidence/iphone_acquisition.E01 -o /reports/output/

   Process a compressed tar extraction on a system where the GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands. would previously have rejected the file type.
   copy

   $ aleapp -t tar -i /evidence/android_extraction.tar.xz -o /reports/output/

   • Extends -t raw to read E01, Ex01, SMART, AFF, and AFD acquisitions, Apple disk images (.dmg, .sparseimage, sparse bundles, segmented sets), encrypted Apple disk images, FTK Imager AD-encrypted images, and encrypted APFS volumes — each opened with a supplied password.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds NTFSNTFSThe default file system format for Windows, developed by Microsoft, storing files with rich metadata and access controls; cyber tools target it to parse artifacts like timestamps, alternate data streams, and the MFT. alternate data stream support under -t raw.
   • Adds WhatsApp channels and channel messages as their own artifacts, resolves LID jids for 1:1 chats, groups, and call logs, and reports status text, wa_name, and group pictures in Contacts and Group Details.
   • Adds new artifacts for Nova AI Chatbot, Samsung Gallery Hidden Album, and Calculator Lock — including a new Calculator History artifact from HISTORY.DB and note contacts for every Android user.
   • Rejoins and displays ExoPlayer media (including HLS streams) directly on Reddit, Twitter, and Instagram cache rows.

   +3 more show less

   • Replaces separate aleapp and aleappGUI binaries with a single unified aleapp program: run without arguments to open the GUI, run with arguments for CLI — available as Windows installer/portable zip, signed macOS disk image, and Linux AppImage for both Intel/AMD and ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware..
   • Snapchat Android artifact now reports only the users the account added.
   • GUI now accepts .tar.xz archives directly.
   • Extends -t raw to read E01, Ex01, SMART, AFF, and AFD acquisitions, Apple disk images (.dmg, .sparseimage, sparse bundles, segmented sets), encrypted Apple disk images, FTK Imager AD-encrypted images, and encrypted APFS volumes — each opened with a supplied password.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds NTFSNTFSThe default file system format for Windows, developed by Microsoft, storing files with rich metadata and access controls; cyber tools target it to parse artifacts like timestamps, alternate data streams, and the MFT. alternate data stream support under -t raw.
   • Adds new artifacts for Nova AI Chatbot, Samsung Gallery Hidden Album, and Calculator Lock — including a new Calculator History artifact from HISTORY.DB and note contacts for every Android user.
   • Rejoins and displays ExoPlayer media (including HLS streams) directly on Reddit, Twitter, and Instagram cache rows.
   • Replaces separate aleapp and aleappGUI binaries with a single unified aleapp program: run without arguments to open the GUI, run with arguments for CLI — available as Windows installer/portable zip, signed macOS disk image, and Linux AppImage for both Intel/AMD and ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware..

   3 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !The separate aleappGUI binary is gone; aleapp without arguments now opens the window. Automation or scripts that launched aleappGUI must be updated to call aleapp instead.
   • !Download filenames changed shape (e.g. -windows-x64-setup.exe, -linux-x64.AppImage); any pipeline that fetches a release artifact by its old filename will need updating.
   • !On Windows and macOS, aleapp must be run from the folder it was installed into — copying the executable elsewhere on its own will not work.
5. v2026.4.1 Sep 20, 2026 · issue 080

   ALEAPP v2026.4.1 adds a Nova AI Chatbot forensic parser and dramatically speeds up NTFSNTFSThe default file system format for Windows, developed by Microsoft, storing files with rich metadata and access controls; cyber tools target it to parse artifacts like timestamps, alternate data streams, and the MFT./APFSAPFSApple's proprietary filesystem introduced in 2017, replacing HFS+, designed for SSDs with native encryption, snapshots, and space sharing — giving cyber tools reliable forensic primitives on modern Apple devices. image reads with qnxprobe 1.30.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2026.4.1 https://github.com/abrignoni/ALEAPP.git
   # already have the repo? check out this version:
   $ git checkout v2026.4.1

   └──▷ TRY IT
   Parse a raw macOS E01E01A forensic disk image format that stores a drive's contents in segmented files with built-in checksums and metadata, widely used in digital forensics because it supports compression and chain-of-custody verification. acquisition for Nova AI Chatbot artifacts — the single-pass APFS reader makes large images practical to process.
   copy

   $ python aleapp.py -t raw -i /evidence/macbook.E01 -o /reports/nova_case/

   • Adds forensic parser modules for Nova AI Chatbot (com.scaleup.chatai), including conversation history, shared preferences, and user media submissions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Reads NTFS and APFS disk images in a single pass using qnxprobe 1.30 — listing a 32 GB macOS E01 drops from 139.8 s to 8.5 s, and a full run from 226.7 s to 85.7 s.
   • Adds ArtifactResult, a streaming result path for handling large artifacts more efficiently.
   • Commits the LAVA database once per artifact instead of once per staged file, cutting a 4,000-message WhatsApp artifact from 20.6 s to 9.5 s.
   • Records evidence-relative source paths for directory and single-file inputs.

   +1 more show less

   • Oversized HTML report tables are held back and replaced with a summarized view instead of rendering an unbounded table.
   • Adds forensic parser modules for Nova AI Chatbot (com.scaleup.chatai), including conversation history, shared preferences, and user media submissions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds ArtifactResult, a streaming result path for handling large artifacts more efficiently.

   4 more in Everything

6. v2026.4.0 Sep 13, 2026 · issue 074

   ALEAPP v2026.4.0 adds raw/E01E01A forensic disk image format that stores a drive's contents in segmented files with built-in checksums and metadata, widely used in digital forensics because it supports compression and chain-of-custody verification. image input via -t raw, F2FSF2FSA Linux filesystem developed by Samsung, optimized for NAND flash storage by reducing write amplification and managing erase cycles efficiently, making it attractive for tools running on flash-based devices. support, and new Android app coverage for Blink, Kwai, Avast Cleanup, YouCam Perfect, and MEGA.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2026.4.0 https://github.com/abrignoni/ALEAPP.git
   # already have the repo? check out this version:
   $ git checkout v2026.4.0

   └──▷ TRY IT
   Parse a raw disk image or E01 acquisition directly without extracting it first — useful when working with full-device forensic captures.
   copy

   $ python aleapp.py -t raw -i <path_to_image.E01> -o <path_for_report_output>

   • Adds -t raw flag to read raw disk images and E01 acquisitions directly, enabling forensic analysis without prior extraction.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds F2FS filesystem support via re-vendored qnxprobe, allowing parsing of Android devices formatted with F2FS.
   • Adds full Blink camera/doorbell artifact support for Android, covering Camera Information, Camera Entitlements, Syncmodule Information, Syncmodule Entitlements, and Network Information from the BlinkRoom database.
   • Adds MEGA cloud storage node cache and media caches support for Android.

   4 details in Everything

7. v2026.3.3 Sep 9, 2026 · issue 070

   ALEAPP v2026.3.3 adds 70+ new app parsers, deep Android system artifacts, MMKVMMKVA key-value storage library from Tencent, built on memory-mapped files, that gives apps fast persistent storage without explicit write calls — useful for tools that need low-latency local state or config caching. decryption, and a combined SMSSMSShort Message Service, the protocol built into cellular networks for sending text messages between phones; cyber tools use it for alerting, two-factor authentication delivery, or phishing simulation over mobile channels./MMSMMSMultimedia Messaging Service, a mobile carrier protocol that extends SMS to carry images, audio, and video between handsets; cyber tools use it to analyze or simulate rich-media mobile message delivery. artifact.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2026.3.3 https://github.com/abrignoni/ALEAPP.git
   # already have the repo? check out this version:
   $ git checkout v2026.3.3

   • Adds a combined SMS and MMS Messages artifact that merges both transports into one table sorted by date, with a Message Type column (SMS or MMS) and a Source Table column naming the originating table (sms, spam_sms, or pdu).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds a new MMS Attachments artifact reporting every part row joined to its message, including unreferenced files under app_parts and parts with stored content type, sniffed type, size, and a status column.
   • Adds MMKV decryption support via a vendored mmkv_parser, correct varint header handling, and a new MMKV - Recovered Records artifact.
   • Adds Xiaohongshu account data, recent chats, and app launches parsed directly from MMKV.
   • Adds Android system artifacts covering Android users, ADBADBAndroid Debug Bridge, a command-line tool maintained by Google that lets a host machine communicate with an Android device over USB or TCP, giving cyber tools shell access, file transfer, and app control. authorizations, and telecom phone accounts.

   +14 more show less

   • Adds install sessions, per-user package state, and per-app SSAID artifacts.
   • Adds Android dropbox, tombstone, and ANR crash record artifacts.
   • Adds Nearby Fast Pair and discovered item artifacts.
   • Adds Chrome sync synced tabs and session devices artifacts.
   • Adds Chromium tab restore files reporting navigation entries.
   • Adds Chromium browsers' HTTP cache artifacts for Android.
   • Adds Phone Link linked accounts artifact.
   • Adds ExoPlayer media cache artifacts for Twitter, Snapchat, Instagram, and Reddit.
   • Adds Life360 API cache artifacts and cached photos on chat messages.
   • Adds Discord API cache artifacts and renders cached attachments on chats.
   • Adds Samsung IMS service logs support for Android.
   • Adds App Ops artifacts covering recent accesses, standby buckets, and permission modes, plus permission subsystem access.abx parsing.
   • Adds 70+ new app parsers spanning secure messaging (WeChat, Element X, Silent Phone, Tutanota, Dust), password/security managers (Bitwarden, KeePassDX, Aegis, Magisk), productivity/note apps (Joplin, Tasks.org, Orgzly Revived, ColorNote), media/streaming (NewPipe, AntennaPod, Snapseed, Musicolet, InShot, VivaVideo), navigation/fitness (Organic Maps, OsmAnd, OpenTracks, Trail Sense, Sleep as Android), and others including GETTR, Xiaohongshu, Houseparty, CCleaner, Aurora Store, Breezy Weather, RedReader, Aves Gallery, Solid Explorer, HERE WeGo, Moovit, QR and Barcode Scanner, MX Player, Nova Launcher, Flipboard, Easy Voice Recorder, and CamScanner.
   • WeChat messages are now fully human-readable with decoded content and media correctly attached to their parent messages.
   • Adds a combined SMS and MMS Messages artifact that merges both transports into one table sorted by date, with a Message Type column (SMS or MMS) and a Source Table column naming the originating table (sms, spam_sms, or pdu).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds a new MMS Attachments artifact reporting every part row joined to its message, including unreferenced files under app_parts and parts with stored content type, sniffed type, size, and a status column.
   • Adds MMKV decryption support via a vendored mmkv_parser, correct varint header handling, and a new MMKV - Recovered Records artifact.
   • Adds Xiaohongshu account data, recent chats, and app launches parsed directly from MMKV.
   • Adds Android system artifacts covering Android users, ADBADBAndroid Debug Bridge, a command-line tool maintained by Google that lets a host machine communicate with an Android device over USB or TCP, giving cyber tools shell access, file transfer, and app control. authorizations, and telecom phone accounts.

   +13 more show less

   • Adds install sessions, per-user package state, and per-app SSAID artifacts.
   • Adds Android dropbox, tombstone, and ANR crash record artifacts.
   • Adds Nearby Fast Pair and discovered item artifacts.
   • Adds Chrome sync synced tabs and session devices artifacts.
   • Adds Chromium tab restore files reporting navigation entries.
   • Adds Chromium browsers' HTTP cache artifacts for Android.
   • Adds Phone Link linked accounts artifact.
   • Adds ExoPlayer media cache artifacts for Twitter, Snapchat, Instagram, and Reddit.
   • Adds Life360 API cache artifacts and cached photos on chat messages.
   • Adds Discord API cache artifacts and renders cached attachments on chats.
   • Adds Samsung IMS service logs support for Android.
   • Adds App Ops artifacts covering recent accesses, standby buckets, and permission modes, plus permission subsystem access.abx parsing.
   • Adds 70+ new app parsers spanning secure messaging (WeChat, Element X, Silent Phone, Tutanota, Dust), password/security managers (Bitwarden, KeePassDX, Aegis, Magisk), productivity/note apps (Joplin, Tasks.org, Orgzly Revived, ColorNote), media/streaming (NewPipe, AntennaPod, Snapseed, Musicolet, InShot, VivaVideo), navigation/fitness (Organic Maps, OsmAnd, OpenTracks, Trail Sense, Sleep as Android), and others including GETTR, Xiaohongshu, Houseparty, CCleaner, Aurora Store, Breezy Weather, RedReader, Aves Gallery, Solid Explorer, HERE WeGo, Moovit, QR and Barcode Scanner, MX Player, Nova Launcher, Flipboard, Easy Voice Recorder, and CamScanner.

   1 more in Everything

8. v2026.3.2 Aug 27, 2026 · issue 058

   ALEAPP v2026.3.2 adds 35+ new app parsers including Uber, Facebook, Zoom, Threema, and TeleGuard for Android forensics.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2026.3.2 https://github.com/abrignoni/ALEAPP.git
   # already have the repo? check out this version:
   $ git checkout v2026.3.2

   • Adds parsers for over 35 new Android apps: Uber, Facebook, Threads, Twitch, Zoom, PayPal, Revolut, Outlook, Yahoo Mail, Adobe Acrobat Reader, Disney+, Amazon Prime Video, Pinterest, Hinge, NordVPN, Roblox, eBay, Etsy, Vinted, Booking.com, Ryanair, DHL, CapCut, Shazam, Truecaller, SimpleX Chat, TeleGuard (calls, account, drafts, downloads), Threema, Opera Browser, Samsung Bixby Routines, Spotify (6 artifacts), and Private Photo Vault.
   • Adds TeleGuard artifact coverage for calls, account, drafts, and downloads on Android.
   • Adds Threema account, contacts, and messages parsing (requires new sqlcipher3 version 0.6.2 dependency to decrypt Threema databases).
   • Adds Uber location artifacts with KMLKMLAn XML-based file format maintained by the OGC for storing geographic data such as points, paths, and polygons. Cyber tools use it to visualize location-based intelligence on maps. output for coordinates and timestamps, plus sessions, payment profiles, telemetry messages, cached images, and app settings.
   • Adds Ryanair boarding pass parsing with decryption using the key stored in the app's own preferences, plus bookings, flights, passengers, and sessions.

   +3 more show less

   • Adds Truecaller call history, contacts, SMSSMSShort Message Service, the protocol built into cellular networks for sending text messages between phones; cyber tools use it for alerting, two-factor authentication delivery, or phishing simulation over mobile channels. senders, call cache, and settings from tc.db, insights.db, and calling-cache.db.
   • Gmail parsing now reads every account store across all Android users instead of only the first, and Gmail bodies are now shown as readable text with a dedicated Links column.
   • Reports now use real device/source paths instead of examiner folder paths, with extraction-relative paths enforced library-wide.

   8 details in Everything

9. v2026.3.1 Aug 18, 2026 · issue 050

   ALEAPP v2026.3.1 adds parsers for Instagram, Tinder, Netflix, Reddit, Amazon Shopping, Proton Mail MailX, expanded Snapchat/TikTok/WhatsApp/Wire/LINE/GroupMe/Chrome artifacts.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2026.3.1 https://github.com/abrignoni/ALEAPP.git
   # already have the repo? check out this version:
   $ git checkout v2026.3.1

   • Adds new Proton Mail db-mail (MailX) Room store parser via protonmailDbMail.py, surfacing four artifacts: MailX Messages (time, subject, sender/recipient addresses decoded from JSON, read/replied/forwarded flags, attachment count, size, conversation ID, message ID), MailX Attachments (name, size, MIME type, disposition, saved content URI from MessageAttachmentMetadataEntity), MailX Contacts (ContactEmailEntity rows), and MailX Account (UserEntity + AccountEntity including createdAtUtc in Unix millis).
   • Adds six WhatsApp add-on artifacts: reactions, edits, revokes, polls, receipts, and system events.
   • Adds Snapchat chat media, core.db, and session artifacts; TikTok Account artifact; TikTok activity artifacts with multi-account database handling for IM data and deduplication of duplicate extraction paths.
   • Adds Wire data recovery for data surviving encrypted app generations.
   • Adds Instagram support for Android.

   +8 more show less

   • Adds Tinder support for Android.
   • Adds Netflix support for Android.
   • Adds Reddit support for Android.
   • Adds Amazon Shopping support for Android.
   • Adds Chrome saved credit cards artifact and Chrome payments customer data artifact.
   • Adds seven Samsung My Files artifacts from previously unparsed databases, with cached thumbnails displayed inline in local file listings.
   • Adds GroupMe FCM queued messages artifact, message deletion state reporting, and scoped group-creator lookup.
   • Adds LINE message and call reporting even when contact tables are empty.

   13 details in Everything

10. v2026.3.0 Aug 14, 2026 · issue 046

    ALEAPP v2026.3.0 adds Signal/Telegram/Session decryption, 15+ new app parsers, and deep Android system artifact expansion

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2026.3.0 https://github.com/abrignoni/ALEAPP.git
    # already have the repo? check out this version:
    $ git checkout v2026.3.0

    • Adds Signal for Android parsing with full SQLCipher decryption, attachment and thumbnail decryption, and message-linking.
    • Adds Telegram for Android artifacts covering accounts, chats, peers, group/channel members, VoIP call logs, and service message actions parsed from cache4.db and shared preferences.
    • Adds Session messenger account parsing from shared preferences.
    • Adds Snapchat arroyo.db conversation parsing, including recovery of WALWALWrite-Ahead Log: a durability mechanism in databases where changes are recorded to an append-only log before being applied to main storage, giving tools crash recovery and atomic transactions without full-page rewrites.-only rows with row-provenanceprovenanceEvidence recording where a software artifact came from and how it was built, including its source and build process. It helps a consumer check that the artifact matches a trusted build. columns.
    • Adds Kik artifacts for Android.

    +20 more show less

    • Adds BeReal artifacts for Android from app caches.
    • Adds JusTalk and JusTalk Kids artifacts from the Realm store and MMKVMMKVA key-value storage library from Tencent, built on memory-mapped files, that gives apps fast persistent storage without explicit write calls — useful for tools that need low-latency local state or config caching. stores for account identity and app state.
    • Adds Weibo artifacts for Android, including bidirectional image-to-post linking.
    • Adds Xiaohongshu (RED) artifacts for Android.
    • Adds Slack artifacts for Android.
    • Adds AllTrails artifacts for Android.
    • Adds BRD (BreadWallet) artifacts for Android.
    • Adds Dropbox artifacts for Android.
    • Adds what3words artifacts for Android via a vendored Realm parser.
    • Adds DJI drone flight track parsing.
    • Adds Claude artifacts for Android.
    • Adds MeWe artifacts covering posts, comments, media, polls, reactions, and groups.
    • Adds Smart Sidebar File Dock artifacts for OxygenOS/ColorOS.
    • Adds Google Play services database parsing (constellation, account history, icing, ODLH).
    • Adds Samsung system database parsing covering Privacy Dashboard, WiFi, Sleep Detection, CMH tagging, and media provider.
    • Adds modernized UsageStats and Recent Tasks artifact parsing.
    • Adds Google Dialer and Google Calendar artifact parsing.
    • ProtonVPN hostname resolution no longer touches the network at parse time.
    • Adds a CI guard for HTML report injection and remote destinations; evidence names are now escaped in report media tags and all remote CDNCDNA content delivery network, servers distributed across locations that cache and serve content near readers. It can reduce loading time and traffic to the original server./URL destinations removed from HTML reports.
    • Adds stale-allowlist detection and always-on NOT CHECKED reporting to admin/scripts/check_claim_language.py, closing a coverage-audit gap present in ALEAPP but not the other LEAPP cores.

    25 details in Everything

11. v2026.2.0 Jul 24, 2026 · issue 025

    ALEAPP v2026.2.0 adds C2PA AI provenanceprovenanceEvidence recording where a software artifact came from and how it was built, including its source and build process. It helps a consumer check that the artifact matches a trusted build. parsing, Mister Skinnylegs browser artifact integration, and enhanced Samsung clipboard/CMH extraction.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2026.2.0 https://github.com/abrignoni/ALEAPP.git
    # already have the repo? check out this version:
    $ git checkout v2026.2.0

    • New C2PA Content Provenance artifact parses AI-generated media provenance data including signer certificate, signing time, case-insensitive media path matching, and a Media State column grouping manifest rows per media file.
    • New Mister Skinnylegs artifact plugin integrates browser artifact processing targeting every Chromium-based browser or browser-style app.
    • Samsung Honeyboard clipboard artifact reworked with WALWALWrite-Ahead Log: a durability mechanism in databases where changes are recorded to an append-only log before being applied to main storage, giving tools crash recovery and atomic transactions without full-page rewrites. recovery, SEFT support, and dual-schema handling (including old-schema UID resolution from ABX packages.xml on Android 12+).
    • Samsung CMH now parsed directly from the files table, recovering records on Android 15 devices where the images view was dropped.

    4 details in Everything

12. v2026.1.0 Jul 10, 2026 · release notes

    ALEAPP v2026.1.0 adds parsers for Honor Media Library, Samsung Secure Folder HistoryLog, Rema 1000/Scan Selv, and an App Inventory module.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2026.1.0 https://github.com/abrignoni/ALEAPP.git
    # already have the repo? check out this version:
    $ git checkout v2026.1.0

    • Adds HONOR Media Library/Gallery parser
    • Adds a developer-only App Inventory module for parsing-coverage analysis

    2 details in Everything

13. v3.6.0 May 26, 2026 · release notes

    ALEAPP v3.6.0 adds DeepSeek ChatMessages module and SVG image matching support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.6.0 https://github.com/abrignoni/ALEAPP.git
    # already have the repo? check out this version:
    $ git checkout v3.6.0

    • Deepseek_ChatMessages forensic parser module added for extracting chat logs from DeepSeek applications.
    • Support for LinkedIn and Withings HealthMate modules integrated via LAVA framework.

    2 details in Everything

14. v3.5.0 May 18, 2026 · release notes

    ALEAPP v3.5.0 adds JPEG XL and DDS image type matching to artifact extraction

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.5.0 https://github.com/abrignoni/ALEAPP.git
    # already have the repo? check out this version:
    $ git checkout v3.5.0

    • Adds JPEG XL and DDS image type matcher for expanded file support

    1 detail in Everything

15. v3.4.1 Apr 21, 2026 · release notes

    ALEAPP v3.4.1 adds ALEX Live Data support, Agency logo in reports, and over 20 new artifact parsers.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.4.1 https://github.com/abrignoni/ALEAPP.git
    # already have the repo? check out this version:
    $ git checkout v3.4.1

    • ALEAPP now supports ALEX Live Data, enabling real-time artifact extraction from active devices.
    • Reports include an Agency logo embedded in the Case data section.
    • New parsers added for LinkedIn, DuckDuckGo Browser, knuddels chat, ChatGPT2, Kik FCM notifications, Zepp Life heart rate, Android Auto, Speedtest, IMAP Email, Call Transcription, FairEMail Messages, ZangiChat, Thunderbird Mail, Google Voice, Citymapper, SwissMeteo, App Ops (via ALEX), Pixel Watch Fitbit, shistorylog, RandoChat, Samsung Notes, SDHMS, Samsung Trash Provider, Romeo Dating, SBB Mobile, and batterystats-daily.

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Requires Python 3.10+ due to Pillow 12.1.1 dependency.
16. v3.4.0 Apr 25, 2025 · release notes

    ALEAPP v3.4.0 adds LAVA output format support, OneDrive Metadata parsing, and FairMail App module.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.4.0 https://github.com/abrignoni/ALEAPP.git
    # already have the repo? check out this version:
    $ git checkout v3.4.0

    • Adds LAVA output format for extracted artifacts
    • Adds OneDrive Metadata artifact parser module
    • Adds FairMail App (Contacts and Accounts) parser module

    3 details in Everything

17. v3.3.0 Feb 22, 2025 · release notes

    ALEAPP v3.3.0 adds Bluesky, Google Keep Notes, and MeetMe Chats modules alongside a new GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands. with module filtering

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.3.0 https://github.com/abrignoni/ALEAPP.git
    # already have the repo? check out this version:
    $ git checkout v3.3.0

    • Adds Bluesky module for parsing Bluesky artifacts
    • Adds MeetMe Chats module for parsing MeetMe Chats
    • Adds new Graphical User Interface with module filtering
    • Adds new template for HTML report

    4 details in Everything

18. v3.2.5 Nov 20, 2024 · release notes

    Adds support for parsing Life360 Driver Behavior data and Bluesky search logs

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.2.5 https://github.com/abrignoni/ALEAPP.git
    # already have the repo? check out this version:
    $ git checkout v3.2.5

    • Adds life360DriverBehavior extraction to parse Life360 driver behavior events
    • Adds blueskysearches.py to extract and parse Bluesky search log history

    2 details in Everything

19. v3.2.4 Oct 3, 2024 · release notes

    Adds support for reading sms_backup and mms_backup files

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.2.4 https://github.com/abrignoni/ALEAPP.git
    # already have the repo? check out this version:
    $ git checkout v3.2.4

20. v3.2.3 Jul 13, 2024 · release notes

    ALEAPP v3.2.3 adds new parsers for App K-9 Mail, MS Authenticator, Likee, Samsung clipboard, and on-device location history

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.2.3 https://github.com/abrignoni/ALEAPP.git
    # already have the repo? check out this version:
    $ git checkout v3.2.3

    • Added artifact parser for App K-9 Mail
    • Added artifact parser for MS Authenticator
    • Added data analysis for Likee application
    • Adding parser for Samsung Honeyboard clipboard
    • Added Samsung My Files Operation History and Trash decoders

    +4 more show less

    • Added Google on-device Location History parser
    • Adding parser for Notification History feature
    • Contacts from com.samsung.android.providers supported
    • Call logs from com.samsung.android.providers.contacts supported

    9 details in Everything

21. v3.2.2 May 2, 2024 · release notes

    ALEAPP v3.2.2 adds Wire protocol support, global UTC timezone conversion, and Withings HealthMate artifact parsing

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.2.2 https://github.com/abrignoni/ALEAPP.git
    # already have the repo? check out this version:
    $ git checkout v3.2.2

    • Adds wireMessenger.py to support parsing data from the Wire messaging application
    • Adds global timezone conversion to UTC for parsed artifacts via the Errp Update & Global Local to UTC logic

    2 details in Everything

22. v3.2.1 Mar 24, 2024 · release notes

    Adds parsing for GMM MyPlaces, Life360, Burner, Teleguard, and ChatGPT; adds Case Data management and new Tkinter GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.2.1 https://github.com/abrignoni/ALEAPP.git
    # already have the repo? check out this version:
    $ git checkout v3.2.1

    • Adds Case Data management via CLI and GUI to create and manage profile or case data files
    • Adds parsing support for GMM MyPlaces (GMM_MyPlaces.db)
    • Adds parsing support for Life360 locations
    • Adds parsing support for Teleguard messaging
    • Adds parsing support for Burner phone apps

    +3 more show less

    • Adds parsing support for ChatGPT conversations
    • Adds a new Tkinter-based GUI interface
    • Enables processing of multiple Gmail databases simultaneously

    8 details in Everything

23. v3.1.9 Dec 1, 2023 · release notes

    ALEAPP v3.1.9 adds profile file support in CLI and new artifact parsers

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.1.9 https://github.com/abrignoni/ALEAPP.git
    # already have the repo? check out this version:
    $ git checkout v3.1.9

    └──▷ TRY IT
    Use a profile file to specify input and output directories without repeating them on every run.
    copy

    $ aleapp --profile my_analysis_profile.ini

    • Adds --profile argument to the CLI for loading configuration files
    • Adds Airtag detection support via new airtagAndroid.py and airGuard.py parsers
    • Adds Discord Chats parsing capability
    • Adds Libre Torrent artifact parsing with path expansion
    • Adds PodcastAddict artifact support

    +1 more show less

    • Adds Google Maps Searches navigation artifacts

    6 details in Everything

24. v3.1.8 May 16, 2023 · release notes

    ALEAPP v3.1.8 adds parsers for Garmin Connect, Strava, Hikvision DMSS, Dahua DMSS, Chromium DIPS, PikPak, badoo, and more.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.1.8 https://github.com/abrignoni/ALEAPP.git
    # already have the repo? check out this version:
    $ git checkout v3.1.8

    • Adds parsing support for Garmin Connect modules (directory and API)
    • Adds parsing support for the Strava activity artifact
    • Adds parsing support for Hikvision App database
    • Adds parsing support for Dahua Technology (DMSS) CCTV & IoTIoTA collective label for internet-connected physical devices — sensors, cameras, routers, appliances — that tools target because they run embedded firmware with limited patching and broad network exposure. data
    • Adds Chromium DIPS parser

    +5 more show less

    • Adds PikPak cloud list and artifacts parser
    • Adds badoo modules parser
    • Adds Nike Run Club activities artifact parser
    • Adds User defined goals from Adidas Running parser
    • Adds Torrent artifacts parser

    10 details in Everything

25. v3.1.6 Feb 6, 2023 · release notes

    ALEAPP v3.1.6 adds parsers for Garmin data (incl. REM sleep), Samsung Wipe History, Offline Pages, Android Chrome cache, Firefox browser cache, and Brigs.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.1.6 https://github.com/abrignoni/ALEAPP.git
    # already have the repo? check out this version:
    $ git checkout v3.1.6

    • Adds Garmin parser with REM Sleep data support
    • Adds Samsung Wipe History Log parser
    • Adds Offline pages parser
    • Adds Android Chrome browser cache files parser
    • Adds Firefox browser cache parser (browserCachefirefox.py)

    5 details in Everything

26. v3.1.5 Jan 12, 2023 · release notes

    Adds parsers for Bumble, Tusky, Gmail emails, Calendar, Downloads and more.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.1.5 https://github.com/abrignoni/ALEAPP.git
    # already have the repo? check out this version:
    $ git checkout v3.1.5

    • Adds support for parsing Bumble data
    • Adds parser for Tusky (Mastodon client) alongside Mastodon updates
    • Adds parsing of Gmail emails
    • Adds Google Calendar parser
    • Adds Downloads parser

    +2 more show less

    • Adds SimpleStorage App Launch parsing
    • Adds gmm_storage.db parsing

    7 details in Everything

27. v3.1.1 Oct 19, 2022 · release notes

    ALEAPP v3.1.1 adds ProtonVPN artifacts and saveable processing profiles to the CLI

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.1.1 https://github.com/abrignoni/ALEAPP.git
    # already have the repo? check out this version:
    $ git checkout v3.1.1

    • Add ProtonVPN Artifacts support including VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. Connection History parsing
    • Add save-able/load-able processing profiles via the CLI

    2 details in Everything

28. v3.0.0 Jul 16, 2022 · release notes

    Adds Usage-history.xml artifact support and a new plugin loader architecture.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.0.0 https://github.com/abrignoni/ALEAPP.git
    # already have the repo? check out this version:
    $ git checkout v3.0.0

    • Introduces a new plugin loader system to replace the previous mechanism

    1 detail in Everything

29. v2.0.09 Jun 28, 2022 · release notes

    Adds Kijiji artifacts, DuckDuckGo tab thumbnails, GBoard sessions, Samsung SmartThings Quick Connect, Mega transfers, NQVault decryption, and My Files cache media support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.0.09 https://github.com/abrignoni/ALEAPP.git
    # already have the repo? check out this version:
    $ git checkout v2.0.09

    • Adds parsing of DuckDuckGo tab thumbnails
    • Adds parsing of GBoard sessions
    • Adds Mega Transfers artifact support
    • NQVault Decryption (PIN + Media) handler parses encrypted NQVault files using PIN and media keys

    4 details in Everything

30. v2.0.05 May 9, 2022 · release notes

    Adds new parsers for Google Chat, Vaulty, Chess.com, and Burner; Viber hidden messages PIN bruteforce

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.0.05 https://github.com/abrignoni/ALEAPP.git
    # already have the repo? check out this version:
    $ git checkout v2.0.05

    • Adds google_chat parser support for extracting Google Chat conversation data.
    • Adds vaulty parser support for extracting Vaulty application metadata.
    • Adds chess_com parser support for extracting Chess.com user activity.
    • Adds burner parser support for extracting Burner phone number usage data.
    • Enables viber.hidden_messages_pin_bruteforce capability to attempt brute-forcing PINs on hidden Viber messages.

    +2 more show less

    • Adds google_fit parser support for extracting Google Fit health data.
    • Adds mega_chat parser support for extracting MEGA Chat logs.

    7 details in Everything

31. v2.0.03 Jan 21, 2022 · release notes

    ALEAPP v2.0.03 adds parsers for Google Duo, Chrome Autofill, Cash App, Airtags, and more.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.0.03 https://github.com/abrignoni/ALEAPP.git
    # already have the repo? check out this version:
    $ git checkout v2.0.03

    • Adds Chromium Autofill artifact parsing
    • Adds Google Photos Cache artifact parsing
    • Adds Facebook & installed apps parsing updates
    • Adds Fitbit artifact - Exercise parsing
    • Adds Microsoft Teams artifact parsing

    +19 more show less

    • Adds Skout Messages artifact parsing
    • Adds Google Keep - Notes artifact parsing
    • Adds WhatsApp profile retrieval
    • Adds Google Duo parser
    • Adds Google Call Screen parser
    • Adds Samsung Wipe & Recovery History artifact parsing
    • Adds Samsung eRR.p artifact parsing
    • Adds Google Tasks artifact parsing
    • Adds Cash App parser
    • Adds Power Off Reset and HideX parsers
    • Adds Samsung Weather Clock artifact parsing
    • Adds Factory Reset Timestamp parser
    • Adds Last Boot Time parser
    • Adds Clipboard Data parser
    • Adds Airtags artifact parsing
    • Adds Waze & Shutdown Checkpoints parsing
    • Adds Firefox History and Brave naming support
    • Adds Privacy Dashboard parser
    • Adds Google Maps Voice Guidance parsing

    24 details in Everything