https://cybertoolchain.io/tools/aleapp New releases and features in ALEAPP, tracked by The Cyber Toolchain. en Tue, 03 Nov 2026 07:22:49 GMT https://github.com/abrignoni/ALEAPP/releases/tag/v2026.4.5 https://github.com/abrignoni/ALEAPP/releases/tag/v2026.4.5 Tue, 03 Nov 2026 07:22:49 GMT ALEAPP adds Android bug report parsing, SQLite WAL multi-generation reads, and dozens of new artifacts including Health Connect, Hive, and C2PA provenance⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `is_sqlite_sidecar` to replace hand-written sidecar filters across 56 modules, and reads committed state, previous WAL generation leftover frames, and uncommitted tails from `sqlite_wal` v0.1.0 — recovering hidden rows from Samsung Honeyboard, Snapchat, Phone Link, Discord, Telegram, and Google Chat.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds new artifacts for Google Play Store App Data Usage (reading `data_usage.db`, one row per package, date, and network state combination including byte counts), Google Play Services Screen Lock State History, Telegram Push Messages (`unread_push_messages`), Phone Accounts (alongside call logs that now include the SIM ICCID for each call), Health Connect (Android 14+), Samsung Smart Switch, Bluetooth File Transfers (`btopp.db`), Blocked Numbers, Android Auto Rejected Cars, Setup Flags, boot reason entries from the persistent property store, one database per Android user in frosting, Calendar, Settings Search, My Files recents, Android Auto, image rows from `cmh` when `location_view` cannot be queried (Android 16), Instagram Pending Media, Samsung Launcher Search History, Samsung Wi-Fi networks and foreground apps (`TcpMonitorApInfo.json`), Package Rollback Records, Permission Controller Safety Label History, Permission Change Dates, Permission Controller Log, Google Maps Sync places and people, Battery Stats Daily Package Changes, Wi-Fi IP Memory Store, Call Data Logs (Scone), and Mozilla browser profile times. • Adds C2PA provenance reading through the vendored `c2pareader` 0.2.0. • Adds a Hive box inventory artifact through the vendored `hive-parser`. • Adds Chromium artifacts for Omnibox Shortcuts, Browsing Topics API usage, web notifications, website usage events and share history, Site Permissions with permission prompt actions and counts, the File System API including bucket storage, AccountBookmarks in Bookmarks, and ETag and Last-Modified fields in Downloads. • Names Chromium browsers from the package folder rather than the full path, so WebViews in Microsoft and other apps are attributed to their host app instead of being misidentified as Edge. • Facebook now reads Messenger's contacts store and `prefs_db`, with an Android User column. • Supports `-t raw` NTFS, ReFS, exFAT, and FAT name case-matching on macOS and Linux to match existing Windows behaviour. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aleapp https://github.com/abrignoni/ALEAPP/releases/tag/v2026.4.4 https://github.com/abrignoni/ALEAPP/releases/tag/v2026.4.4 Sat, 24 Oct 2026 17:31:50 GMT ALEAPP v2026.4.4 adds Yandex Disk, Google Pay, DJI flight records, Discord Servers, SHA-256 staging hashes, LVM2/LUKS/RAID raw image support, and more.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `--hash` flag (and a matching GUI checkbox) to record SHA-256 hashes for staged files, capturing container-recorded timestamps from ZIP NTFS/extended timestamp fields, tar headers (GNU, PAX), L01/AD1 entries, FAT/exFAT entries, and ext/APFS/HFS+ times.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Extends `-t raw` acquisition reading: qnxprobe advances from 1.58 to 1.76 and ewfprobe to 0.15.0, adding LVM2 logical volumes (split, striped, RAID1), LUKS containers opened with a passphrase, RAID member images read together, and FAT12/FAT16 filesystems. • Raw image input now offers free space, flash filesystem deleted files, and NTFS directory indexes to artifacts that request them. • Adds new artifact modules: Yandex Disk (cloud files, uploads, accounts, trash, downloads, notes, settings, video positions, image cache, local media), KeepSafe, Google Pay, offline DJI TXT flight records, Shortcut Service, Chrome Cache - Videos, Chromium downloads matched to MediaStore, Google app suggestion and key-value caches, and Discord - Servers. • Adds a new ODLH Path Points artifact to Google ODLH, plus activity start/end, distance, and type fields. • Reads Cellebrite CLBX ZIP times from `metadata.msgpack` (adding msgpack as a dependency), and extracts creation time from the fourth value of four-value extended timestamp blocks. • A WAL-mode SQLite database staged without its `-wal` file is now opened read-only with `immutable=1`. • Tar links are now read as the member they point to; corrupt ZIP members are skipped rather than halting the run. • Windows releases ship as a single portable file per architecture (`-windows-x64-portable.zip`, `-windows-arm64-portable.zip`) with no installer required. Breaking changes: • Python 3.11 or newer is now required to run ALEAPP from source (previously Python 3.10 was sufficient). • There is no `aleappGUI` executable any more — `aleapp` without arguments now opens the window. • Windows releases no longer ship an installer; the distribution is a single portable file (`aleapp.exe`) that must be placed wherever a calling tool expects it. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aleapp https://github.com/abrignoni/ALEAPP/releases/tag/v2026.4.3 https://github.com/abrignoni/ALEAPP/releases/tag/v2026.4.3 Fri, 02 Oct 2026 00:35:36 GMT ALEAPP v2026.4.3 adds SwiftKey language model artifacts, Telegram layer 227 support, and improved raw NTFS image staging⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds four SwiftKey language model artifacts from `dynamic.lm` files — Models, Terms, Term Sequences, and Terms by App — covering both the Samsung Keyboard (`app_SwiftKey`) and SwiftKey app paths.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Supports Telegram layer 227, including sender rank and guest peer fields on older constructors (`0x3ae56482`, `0x95ef6f2b`), seventeen older message classes (including secret chat ones), service message sender reporting, and table preservation when a single record cannot be walked. • Updates `qnxprobe` to 1.57 for `-t raw` acquisitions, now correctly staging OneDrive Files On-Demand placeholders (instead of zeros), XPRESS-compressed files (via Windows Overlay Filter) as their content, and NTFS-compressed files with early-ending compression units at their full length. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aleapp https://github.com/abrignoni/ALEAPP/releases/tag/v2026.4.2 https://github.com/abrignoni/ALEAPP/releases/tag/v2026.4.2 Tue, 29 Sep 2026 20:55:11 GMT ALEAPP v2026.4.2 adds E01/AFF/DMG/APFS image support, WhatsApp channels, ExoPlayer media rejoining, and unified `aleapp` binary across all platforms.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Extends `-t raw` to read E01, Ex01, SMART, AFF, and AFD acquisitions, Apple disk images (`.dmg`, `.sparseimage`, sparse bundles, segmented sets), encrypted Apple disk images, FTK Imager AD-encrypted images, and encrypted APFS volumes — each opened with a supplied password.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds NTFS alternate data stream support under `-t raw`. • Adds WhatsApp channels and channel messages as their own artifacts, resolves LID jids for 1:1 chats, groups, and call logs, and reports `status text`, `wa_name`, and group pictures in Contacts and Group Details. • Adds new artifacts for Nova AI Chatbot, Samsung Gallery Hidden Album, and Calculator Lock — including a new Calculator History artifact from `HISTORY.DB` and note contacts for every Android user. • Rejoins and displays ExoPlayer media (including HLS streams) directly on Reddit, Twitter, and Instagram cache rows. • Replaces separate `aleapp` and `aleappGUI` binaries with a single unified `aleapp` program: run without arguments to open the GUI, run with arguments for CLI — available as Windows installer/portable zip, signed macOS disk image, and Linux AppImage for both Intel/AMD and ARM. • Snapchat Android artifact now reports only the users the account added. • GUI now accepts `.tar.xz` archives directly. Breaking changes: • The separate `aleappGUI` binary is gone; `aleapp` without arguments now opens the window. Automation or scripts that launched `aleappGUI` must be updated to call `aleapp` instead. • Download filenames changed shape (e.g. `-windows-x64-setup.exe`, `-linux-x64.AppImage`); any pipeline that fetches a release artifact by its old filename will need updating. • On Windows and macOS, `aleapp` must be run from the folder it was installed into — copying the executable elsewhere on its own will not work. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aleapp https://github.com/abrignoni/ALEAPP/releases/tag/v2026.4.1 https://github.com/abrignoni/ALEAPP/releases/tag/v2026.4.1 Sun, 20 Sep 2026 10:51:27 GMT ALEAPP v2026.4.1 adds a Nova AI Chatbot forensic parser and dramatically speeds up NTFS/APFS image reads with qnxprobe 1.30.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds forensic parser modules for Nova AI Chatbot (`com.scaleup.chatai`), including conversation history, shared preferences, and user media submissions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Reads NTFS and APFS disk images in a single pass using `qnxprobe` 1.30 — listing a 32 GB macOS E01 drops from 139.8 s to 8.5 s, and a full run from 226.7 s to 85.7 s. • Adds `ArtifactResult`, a streaming result path for handling large artifacts more efficiently. • Commits the LAVA database once per artifact instead of once per staged file, cutting a 4,000-message WhatsApp artifact from 20.6 s to 9.5 s. • Records evidence-relative source paths for directory and single-file inputs. • Oversized HTML report tables are held back and replaced with a summarized view instead of rendering an unbounded table. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aleapp https://github.com/abrignoni/ALEAPP/releases/tag/v2026.4.0 https://github.com/abrignoni/ALEAPP/releases/tag/v2026.4.0 Sun, 13 Sep 2026 19:30:16 GMT ALEAPP v2026.4.0 adds raw/E01 image input via `-t raw`, F2FS support, and new Android app coverage for Blink, Kwai, Avast Cleanup, YouCam Perfect, and MEGA.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `-t raw` flag to read raw disk images and E01 acquisitions directly, enabling forensic analysis without prior extraction.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds F2FS filesystem support via re-vendored qnxprobe, allowing parsing of Android devices formatted with F2FS. • Adds full Blink camera/doorbell artifact support for Android, covering Camera Information, Camera Entitlements, Syncmodule Information, Syncmodule Entitlements, and Network Information from the BlinkRoom database. • Adds MEGA cloud storage node cache and media caches support for Android. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aleapp https://github.com/abrignoni/ALEAPP/releases/tag/v2026.3.3 https://github.com/abrignoni/ALEAPP/releases/tag/v2026.3.3 Wed, 09 Sep 2026 19:52:43 GMT ALEAPP v2026.3.3 adds 70+ new app parsers, deep Android system artifacts, MMKV decryption, and a combined SMS/MMS artifact.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds a combined SMS and MMS Messages artifact that merges both transports into one table sorted by date, with a `Message Type` column (SMS or MMS) and a `Source Table` column naming the originating table (`sms`, `spam_sms`, or `pdu`).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds a new MMS Attachments artifact reporting every part row joined to its message, including unreferenced files under `app_parts` and `parts` with stored content type, sniffed type, size, and a status column. • Adds MMKV decryption support via a vendored `mmkv_parser`, correct varint header handling, and a new 'MMKV - Recovered Records' artifact. • Adds Xiaohongshu account data, recent chats, and app launches parsed directly from MMKV. • Adds Android system artifacts covering Android users, ADB authorizations, and telecom phone accounts. • Adds install sessions, per-user package state, and per-app SSAID artifacts. • Adds Android dropbox, tombstone, and ANR crash record artifacts. • Adds Nearby Fast Pair and discovered item artifacts. • Adds Chrome sync synced tabs and session devices artifacts. • Adds Chromium tab restore files reporting navigation entries. • Adds Chromium browsers' HTTP cache artifacts for Android. • Adds Phone Link linked accounts artifact. • Adds ExoPlayer media cache artifacts for Twitter, Snapchat, Instagram, and Reddit. • Adds Life360 API cache artifacts and cached photos on chat messages. • Adds Discord API cache artifacts and renders cached attachments on chats. • Adds Samsung IMS service logs support for Android. • Adds App Ops artifacts covering recent accesses, standby buckets, and permission modes, plus permission subsystem `access.abx` parsing. • Adds 70+ new app parsers spanning secure messaging (WeChat, Element X, Silent Phone, Tutanota, Dust), password/security managers (Bitwarden, KeePassDX, Aegis, Magisk), productivity/note apps (Joplin, Tasks.org, Orgzly Revived, ColorNote), media/streaming (NewPipe, AntennaPod, Snapseed, Musicolet, InShot, VivaVideo), navigation/fitness (Organic Maps, OsmAnd, OpenTracks, Trail Sense, Sleep as Android), and others including GETTR, Xiaohongshu, Houseparty, CCleaner, Aurora Store, Breezy Weather, RedReader, Aves Gallery, Solid Explorer, HERE WeGo, Moovit, QR and Barcode Scanner, MX Player, Nova Launcher, Flipboard, Easy Voice Recorder, and CamScanner. • WeChat messages are now fully human-readable with decoded content and media correctly attached to their parent messages. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aleapp https://github.com/abrignoni/ALEAPP/releases/tag/v2026.3.2 https://github.com/abrignoni/ALEAPP/releases/tag/v2026.3.2 Thu, 27 Aug 2026 19:40:58 GMT ALEAPP v2026.3.2 adds 35+ new app parsers including Uber, Facebook, Zoom, Threema, and TeleGuard for Android forensics. • Adds parsers for over 35 new Android apps: Uber, Facebook, Threads, Twitch, Zoom, PayPal, Revolut, Outlook, Yahoo Mail, Adobe Acrobat Reader, Disney+, Amazon Prime Video, Pinterest, Hinge, NordVPN, Roblox, eBay, Etsy, Vinted, Booking.com, Ryanair, DHL, CapCut, Shazam, Truecaller, SimpleX Chat, TeleGuard (calls, account, drafts, downloads), Threema, Opera Browser, Samsung Bixby Routines, Spotify (6 artifacts), and Private Photo Vault. • Adds TeleGuard artifact coverage for calls, account, drafts, and downloads on Android. • Adds Threema account, contacts, and messages parsing (requires new `sqlcipher3` version 0.6.2 dependency to decrypt Threema databases). • Adds Uber location artifacts with KML output for coordinates and timestamps, plus sessions, payment profiles, telemetry messages, cached images, and app settings. • Adds Ryanair boarding pass parsing with decryption using the key stored in the app's own preferences, plus bookings, flights, passengers, and sessions. • Adds Truecaller call history, contacts, SMS senders, call cache, and settings from `tc.db`, `insights.db`, and `calling-cache.db`. • Gmail parsing now reads every account store across all Android users instead of only the first, and Gmail bodies are now shown as readable text with a dedicated Links column. • Reports now use real device/source paths instead of examiner folder paths, with extraction-relative paths enforced library-wide. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aleapp https://github.com/abrignoni/ALEAPP/releases/tag/v2026.3.1 https://github.com/abrignoni/ALEAPP/releases/tag/v2026.3.1 Tue, 18 Aug 2026 15:42:16 GMT ALEAPP v2026.3.1 adds parsers for Instagram, Tinder, Netflix, Reddit, Amazon Shopping, Proton Mail MailX, expanded Snapchat/TikTok/WhatsApp/Wire/LINE/GroupMe/Chrome artifacts. • Adds new Proton Mail `db-mail` (MailX) Room store parser via `protonmailDbMail.py`, surfacing four artifacts: MailX Messages (time, subject, sender/recipient addresses decoded from JSON, read/replied/forwarded flags, attachment count, size, conversation ID, message ID), MailX Attachments (name, size, MIME type, disposition, saved content URI from `MessageAttachmentMetadataEntity`), MailX Contacts (`ContactEmailEntity` rows), and MailX Account (`UserEntity` + `AccountEntity` including `createdAtUtc` in Unix millis). • Adds six WhatsApp add-on artifacts: reactions, edits, revokes, polls, receipts, and system events. • Adds Snapchat chat media, `core.db`, and session artifacts; TikTok Account artifact; TikTok activity artifacts with multi-account database handling for IM data and deduplication of duplicate extraction paths. • Adds Wire data recovery for data surviving encrypted app generations. • Adds Instagram support for Android. • Adds Tinder support for Android. • Adds Netflix support for Android. • Adds Reddit support for Android. • Adds Amazon Shopping support for Android. • Adds Chrome saved credit cards artifact and Chrome payments customer data artifact. • Adds seven Samsung My Files artifacts from previously unparsed databases, with cached thumbnails displayed inline in local file listings. • Adds GroupMe FCM queued messages artifact, message deletion state reporting, and scoped group-creator lookup. • Adds LINE message and call reporting even when contact tables are empty. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aleapp https://github.com/abrignoni/ALEAPP/releases/tag/v2026.3.0 https://github.com/abrignoni/ALEAPP/releases/tag/v2026.3.0 Fri, 14 Aug 2026 09:25:55 GMT ALEAPP v2026.3.0 adds Signal/Telegram/Session decryption, 15+ new app parsers, and deep Android system artifact expansion • Adds Signal for Android parsing with full SQLCipher decryption, attachment and thumbnail decryption, and message-linking. • Adds Telegram for Android artifacts covering accounts, chats, peers, group/channel members, VoIP call logs, and service message actions parsed from `cache4.db` and shared preferences. • Adds Session messenger account parsing from shared preferences. • Adds Snapchat `arroyo.db` conversation parsing, including recovery of WAL-only rows with row-provenance columns. • Adds Kik artifacts for Android. • Adds BeReal artifacts for Android from app caches. • Adds JusTalk and JusTalk Kids artifacts from the Realm store and MMKV stores for account identity and app state. • Adds Weibo artifacts for Android, including bidirectional image-to-post linking. • Adds Xiaohongshu (RED) artifacts for Android. • Adds Slack artifacts for Android. • Adds AllTrails artifacts for Android. • Adds BRD (BreadWallet) artifacts for Android. • Adds Dropbox artifacts for Android. • Adds what3words artifacts for Android via a vendored Realm parser. • Adds DJI drone flight track parsing. • Adds Claude artifacts for Android. • Adds MeWe artifacts covering posts, comments, media, polls, reactions, and groups. • Adds Smart Sidebar File Dock artifacts for OxygenOS/ColorOS. • Adds Google Play services database parsing (constellation, account history, icing, ODLH). • Adds Samsung system database parsing covering Privacy Dashboard, WiFi, Sleep Detection, CMH tagging, and media provider. • Adds modernized UsageStats and Recent Tasks artifact parsing. • Adds Google Dialer and Google Calendar artifact parsing. • ProtonVPN hostname resolution no longer touches the network at parse time. • Adds a CI guard for HTML report injection and remote destinations; evidence names are now escaped in report media tags and all remote CDN/URL destinations removed from HTML reports. • Adds stale-allowlist detection and always-on `NOT CHECKED` reporting to `admin/scripts/check_claim_language.py`, closing a coverage-audit gap present in ALEAPP but not the other LEAPP cores. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aleapp https://github.com/abrignoni/ALEAPP/releases/tag/v2026.2.0 https://github.com/abrignoni/ALEAPP/releases/tag/v2026.2.0 Fri, 24 Jul 2026 22:50:30 GMT ALEAPP v2026.2.0 adds C2PA AI provenance parsing, Mister Skinnylegs browser artifact integration, and enhanced Samsung clipboard/CMH extraction. • New C2PA Content Provenance artifact parses AI-generated media provenance data including signer certificate, signing time, case-insensitive media path matching, and a Media State column grouping manifest rows per media file. • New Mister Skinnylegs artifact plugin integrates browser artifact processing targeting every Chromium-based browser or browser-style app. • Samsung Honeyboard clipboard artifact reworked with WAL recovery, SEFT support, and dual-schema handling (including old-schema UID resolution from ABX packages.xml on Android 12+). • Samsung CMH now parsed directly from the `files` table, recovering records on Android 15 devices where the `images` view was dropped. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aleapp https://github.com/abrignoni/ALEAPP/releases/tag/v3.6.0 https://github.com/abrignoni/ALEAPP/releases/tag/v3.6.0 Tue, 26 May 2026 21:04:28 GMT ALEAPP v3.6.0 adds DeepSeek ChatMessages module and SVG image matching support • `Deepseek_ChatMessages` forensic parser module added for extracting chat logs from DeepSeek applications. • Support for `LinkedIn` and `Withings HealthMate` modules integrated via LAVA framework. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aleapp https://github.com/abrignoni/ALEAPP/releases/tag/v3.5.0 https://github.com/abrignoni/ALEAPP/releases/tag/v3.5.0 Mon, 18 May 2026 21:21:47 GMT ALEAPP v3.5.0 adds JPEG XL and DDS image type matching to artifact extraction • Adds `JPEG XL` and `DDS` image type matcher for expanded file support Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aleapp https://github.com/abrignoni/ALEAPP/releases/tag/v3.4.1 https://github.com/abrignoni/ALEAPP/releases/tag/v3.4.1 Tue, 21 Apr 2026 21:08:29 GMT ALEAPP v3.4.1 adds ALEX Live Data support, Agency logo in reports, and over 20 new artifact parsers. • `ALEAPP` now supports `ALEX Live Data`, enabling real-time artifact extraction from active devices. • Reports include an `Agency logo` embedded in the Case data section. • New parsers added for LinkedIn, DuckDuckGo Browser, knuddels chat, ChatGPT2, Kik FCM notifications, Zepp Life heart rate, Android Auto, Speedtest, IMAP Email, Call Transcription, FairEMail Messages, ZangiChat, Thunderbird Mail, Google Voice, Citymapper, SwissMeteo, App Ops (via ALEX), Pixel Watch Fitbit, shistorylog, RandoChat, Samsung Notes, SDHMS, Samsung Trash Provider, Romeo Dating, SBB Mobile, and batterystats-daily. Breaking changes: • Requires Python 3.10+ due to Pillow 12.1.1 dependency. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aleapp https://github.com/abrignoni/ALEAPP/releases/tag/v3.4.0 https://github.com/abrignoni/ALEAPP/releases/tag/v3.4.0 Fri, 25 Apr 2025 19:52:27 GMT ALEAPP v3.4.0 adds LAVA output format support, OneDrive Metadata parsing, and FairMail App module. • Adds `LAVA` output format for extracted artifacts • Adds `OneDrive Metadata` artifact parser module • Adds `FairMail App` (Contacts and Accounts) parser module Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aleapp https://github.com/abrignoni/ALEAPP/releases/tag/v3.3.0 https://github.com/abrignoni/ALEAPP/releases/tag/v3.3.0 Sat, 22 Feb 2025 11:04:46 GMT ALEAPP v3.3.0 adds Bluesky, Google Keep Notes, and MeetMe Chats modules alongside a new GUI with module filtering • Adds Bluesky module for parsing Bluesky artifacts • Adds MeetMe Chats module for parsing MeetMe Chats • Adds new Graphical User Interface with module filtering • Adds new template for HTML report Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aleapp https://github.com/abrignoni/ALEAPP/releases/tag/v3.2.5 https://github.com/abrignoni/ALEAPP/releases/tag/v3.2.5 Wed, 20 Nov 2024 17:08:46 GMT Adds support for parsing Life360 Driver Behavior data and Bluesky search logs • Adds `life360DriverBehavior` extraction to parse Life360 driver behavior events • Adds `blueskysearches.py` to extract and parse Bluesky search log history Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aleapp https://github.com/abrignoni/ALEAPP/releases/tag/v3.2.4 https://github.com/abrignoni/ALEAPP/releases/tag/v3.2.4 Thu, 03 Oct 2024 14:22:11 GMT Adds support for reading sms_backup and mms_backup files • Add support for reading `*sms_backup` and `*mms_backup` files Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aleapp https://github.com/abrignoni/ALEAPP/releases/tag/v3.2.3 https://github.com/abrignoni/ALEAPP/releases/tag/v3.2.3 Sat, 13 Jul 2024 14:09:59 GMT ALEAPP v3.2.3 adds new parsers for App K-9 Mail, MS Authenticator, Likee, Samsung clipboard, and on-device location history • Added artifact parser for App K-9 Mail • Added artifact parser for MS Authenticator • Added data analysis for Likee application • Adding parser for Samsung Honeyboard clipboard • Added Samsung My Files Operation History and Trash decoders • Added Google on-device Location History parser • Adding parser for 'Notification History' feature • Contacts from com.samsung.android.providers supported • Call logs from com.samsung.android.providers.contacts supported Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aleapp https://github.com/abrignoni/ALEAPP/releases/tag/v3.2.2 https://github.com/abrignoni/ALEAPP/releases/tag/v3.2.2 Thu, 02 May 2024 21:09:35 GMT ALEAPP v3.2.2 adds Wire protocol support, global UTC timezone conversion, and Withings HealthMate artifact parsing • Adds `wireMessenger.py` to support parsing data from the Wire messaging application • Adds global timezone conversion to UTC for parsed artifacts via the `Errp Update & Global Local to UTC` logic Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aleapp https://github.com/abrignoni/ALEAPP/releases/tag/v3.2.1 https://github.com/abrignoni/ALEAPP/releases/tag/v3.2.1 Sun, 24 Mar 2024 21:27:46 GMT Adds parsing for GMM MyPlaces, Life360, Burner, Teleguard, and ChatGPT; adds Case Data management and new Tkinter GUI • Adds `Case Data` management via CLI and GUI to create and manage profile or case data files • Adds parsing support for GMM MyPlaces (`GMM_MyPlaces.db`) • Adds parsing support for Life360 locations • Adds parsing support for Teleguard messaging • Adds parsing support for Burner phone apps • Adds parsing support for ChatGPT conversations • Adds a new Tkinter-based GUI interface • Enables processing of multiple Gmail databases simultaneously Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aleapp https://github.com/abrignoni/ALEAPP/releases/tag/v3.1.9 https://github.com/abrignoni/ALEAPP/releases/tag/v3.1.9 Fri, 01 Dec 2023 02:04:50 GMT ALEAPP v3.1.9 adds profile file support in CLI and new artifact parsers • Adds `--profile` argument to the CLI for loading configuration files • Adds Airtag detection support via new `airtagAndroid.py` and `airGuard.py` parsers • Adds Discord Chats parsing capability • Adds Libre Torrent artifact parsing with path expansion • Adds PodcastAddict artifact support • Adds Google Maps Searches navigation artifacts Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aleapp https://github.com/abrignoni/ALEAPP/releases/tag/v3.1.8 https://github.com/abrignoni/ALEAPP/releases/tag/v3.1.8 Tue, 16 May 2023 05:57:17 GMT ALEAPP v3.1.8 adds parsers for Garmin Connect, Strava, Hikvision DMSS, Dahua DMSS, Chromium DIPS, PikPak, badoo, and more. • Adds parsing support for Garmin Connect modules (directory and API) • Adds parsing support for the Strava activity artifact • Adds parsing support for Hikvision App database • Adds parsing support for Dahua Technology (DMSS) CCTV & IoT data • Adds Chromium DIPS parser • Adds PikPak cloud list and artifacts parser • Adds badoo modules parser • Adds Nike Run Club activities artifact parser • Adds User defined goals from Adidas Running parser • Adds Torrent artifacts parser Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aleapp https://github.com/abrignoni/ALEAPP/releases/tag/v3.1.6 https://github.com/abrignoni/ALEAPP/releases/tag/v3.1.6 Mon, 06 Feb 2023 02:01:36 GMT ALEAPP v3.1.6 adds parsers for Garmin data (incl. REM sleep), Samsung Wipe History, Offline Pages, Android Chrome cache, Firefox browser cache, and Brigs. • Adds Garmin parser with REM Sleep data support • Adds Samsung Wipe History Log parser • Adds Offline pages parser • Adds Android Chrome browser cache files parser • Adds Firefox browser cache parser (browserCachefirefox.py) Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aleapp https://github.com/abrignoni/ALEAPP/releases/tag/v3.1.5 https://github.com/abrignoni/ALEAPP/releases/tag/v3.1.5 Thu, 12 Jan 2023 17:48:09 GMT Adds parsers for Bumble, Tusky, Gmail emails, Calendar, Downloads and more. • Adds support for parsing Bumble data • Adds parser for Tusky (Mastodon client) alongside Mastodon updates • Adds parsing of Gmail emails • Adds Google Calendar parser • Adds Downloads parser • Adds SimpleStorage App Launch parsing • Adds gmm_storage.db parsing Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aleapp https://github.com/abrignoni/ALEAPP/releases/tag/v3.1.1 https://github.com/abrignoni/ALEAPP/releases/tag/v3.1.1 Wed, 19 Oct 2022 17:35:46 GMT ALEAPP v3.1.1 adds ProtonVPN artifacts and saveable processing profiles to the CLI • Add `ProtonVPN Artifacts` support including VPN Connection History parsing • Add save-able/load-able processing profiles via the CLI Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aleapp https://github.com/abrignoni/ALEAPP/releases/tag/v3.0.0 https://github.com/abrignoni/ALEAPP/releases/tag/v3.0.0 Sat, 16 Jul 2022 00:18:18 GMT Adds `Usage-history.xml` artifact support and a new plugin loader architecture. • Introduces a new plugin loader system to replace the previous mechanism Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aleapp https://github.com/abrignoni/ALEAPP/releases/tag/v2.0.09 https://github.com/abrignoni/ALEAPP/releases/tag/v2.0.09 Tue, 28 Jun 2022 00:33:53 GMT Adds Kijiji artifacts, DuckDuckGo tab thumbnails, GBoard sessions, Samsung SmartThings Quick Connect, Mega transfers, NQVault decryption, and My Files cache media support. • Adds parsing of DuckDuckGo tab thumbnails • Adds parsing of GBoard sessions • Adds Mega Transfers artifact support • NQVault Decryption (PIN + Media) handler parses encrypted NQVault files using PIN and media keys Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aleapp https://github.com/abrignoni/ALEAPP/releases/tag/v2.0.05 https://github.com/abrignoni/ALEAPP/releases/tag/v2.0.05 Mon, 09 May 2022 20:01:02 GMT Adds new parsers for Google Chat, Vaulty, Chess.com, and Burner; Viber hidden messages PIN bruteforce • Adds `google_chat` parser support for extracting Google Chat conversation data. • Adds `vaulty` parser support for extracting Vaulty application metadata. • Adds `chess_com` parser support for extracting Chess.com user activity. • Adds `burner` parser support for extracting Burner phone number usage data. • Enables `viber.hidden_messages_pin_bruteforce` capability to attempt brute-forcing PINs on hidden Viber messages. • Adds `google_fit` parser support for extracting Google Fit health data. • Adds `mega_chat` parser support for extracting MEGA Chat logs. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aleapp https://github.com/abrignoni/ALEAPP/releases/tag/v2.0.03 https://github.com/abrignoni/ALEAPP/releases/tag/v2.0.03 Fri, 21 Jan 2022 19:09:28 GMT ALEAPP v2.0.03 adds parsers for Google Duo, Chrome Autofill, Cash App, Airtags, and more. • Adds `Chromium Autofill` artifact parsing • Adds `Google Photos Cache` artifact parsing • Adds `Facebook & installed apps` parsing updates • Adds `Fitbit artifact - Exercise` parsing • Adds `Microsoft Teams` artifact parsing • Adds `Skout Messages` artifact parsing • Adds `Google Keep - Notes` artifact parsing • Adds `WhatsApp` profile retrieval • Adds `Google Duo` parser • Adds `Google Call Screen` parser • Adds `Samsung Wipe & Recovery History` artifact parsing • Adds `Samsung eRR.p` artifact parsing • Adds `Google Tasks` artifact parsing • Adds `Cash App` parser • Adds `Power Off Reset` and `HideX` parsers • Adds `Samsung Weather Clock` artifact parsing • Adds `Factory Reset Timestamp` parser • Adds `Last Boot Time` parser • Adds `Clipboard Data` parser • Adds `Airtags` artifact parsing • Adds `Waze & Shutdown Checkpoints` parsing • Adds `Firefox History` and `Brave naming` support • Adds `Privacy Dashboard` parser • Adds `Google Maps Voice Guidance` parsing Full history on Cyber Toolchain: https://cybertoolchain.io/tools/aleapp