iLEAPP

No entries match these filters. Clear filters

1. v2026.4.6 Nov 3, 2026 · issue 129

   iLEAPP adds over 20 new artifact parsers including Hive box inventory, C2PA provenanceprovenanceEvidence recording where a software artifact came from and how it was built, including its source and build process. It helps a consumer check that the artifact matches a trusted build., SQLite WALSQLite WALA write-ahead logging mode for SQLite databases where changes are written to a separate log file before the main database, allowing concurrent reads during writes and faster commit performance. recovery, and Chrome Sync for iOS⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2026.4.6 https://github.com/abrignoni/iLEAPP.git
   # already have the repo? check out this version:
   $ git checkout v2026.4.6

   • Parse SQLite WALWALWrite-Ahead Log: a durability mechanism in databases where changes are recorded to an append-only log before being applied to main storage, giving tools crash recovery and atomic transactions without full-page rewrites. state with a shared reader — vendored from sqlite-wal v0.1.0 — that reads committed rows, the previous WAL generation, and an uncommitted tail; is_sqlite_sidecar replaces hand-written sidecar filters in eleven modules, and Snapchat, Google Photos, Google Chat, Life360, Discord and Bluetooth LE now surface rows only earlier WAL states hold.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Improves -t raw acquisitions: matches NTFSNTFSThe default file system format for Windows, developed by Microsoft, storing files with rich metadata and access controls; cyber tools target it to parse artifacts like timestamps, alternate data streams, and the MFT., ReFS, exFAT and FAT filenames case-insensitively on macOS and Linux, processes a file matched by two patterns of one artifact only once, and now matches Call History Transactions, Spotlight Index and Twint stores at a bare Data volume root.
   • Adds new artifacts: Hive box inventory (vendored hive-parser); C2PA provenance (vendored c2pareader 0.2.0); Chrome Sync and Chromium Open Tabs for iOS Chromium browsers; Focus mode configurations and assertions; Find My cache; HomeKitHomeKitApple's smart-home platform and protocol that lets apps control lights, locks, sensors, and other accessories through a unified API, giving cyber tools a standard interface to audit or automate home devices. Homes, Users and Accessories (read from homed/datastore.sqlite and homed/core.sqlite); Suggestions Store contact details and URLs (from Suggestions/entities.db); Widget Engagements (from _ATXInfoSuggestionStore.db); Meta Apps Time In App (from time_in_app_<id>.db); Quick LookQuick LookA macOS feature from Apple that lets users preview file contents without opening the associated application, useful for cyber tools that need to surface file data quickly in a UI. Thumbnails (thumbnails.data rendered); Keyboard Text Replacements (TextReplacements.db); and Playback Session Archives, Life360 Location State Samples, mt.lastLaunch App Dates, CarKit Connection Events, Contacts Me Card Donations, FaceTime Messages, Line Calls, Lockdown Pair Records, Pending Notifications, and Photos Picker Log.
   • Adds new unified log artifacts covering Lockdown Mode, passkeypasskeyPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices. record loads, background shortcut actions, and VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. connectivity, plus new artifacts for Screen Time store artifacts (RMAdminStore), SMSSMSShort Message Service, the protocol built into cellular networks for sending text messages between phones; cyber tools use it for alerting, two-factor authentication delivery, or phishing simulation over mobile channels. and iMessage reactions, edit history, unsent parts, replies, recently deleted, link previews and app messages, sysdiagnose associated domains, MC event lists, Network Extension, iCloud Drive (brctl), and process task info, contributed by @danjethh.
   • Improves Chromium browser handling: reads every Chrome and Edge profile folder, not only Chrome/Default, including Login Data For Account and the Google app's Login Data, surfaces AccountBookmarks in the Bookmarks artifact, and names each Chromium browser from its app container's MCMMetadataIdentifier rather than words in the staged path.

   +1 more show less

   • Read Wi-Fi plists from sysdiagnose archives, and find archives saved as <identifier>_sysdiagnose.tar.gz.
   • Parse SQLite WALWALWrite-Ahead Log: a durability mechanism in databases where changes are recorded to an append-only log before being applied to main storage, giving tools crash recovery and atomic transactions without full-page rewrites. state with a shared reader — vendored from sqlite-wal v0.1.0 — that reads committed rows, the previous WAL generation, and an uncommitted tail; is_sqlite_sidecar replaces hand-written sidecar filters in eleven modules, and Snapchat, Google Photos, Google Chat, Life360, Discord and Bluetooth LE now surface rows only earlier WAL states hold.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds new artifacts: Hive box inventory (vendored hive-parser); C2PA provenance (vendored c2pareader 0.2.0); Chrome Sync and Chromium Open Tabs for iOS Chromium browsers; Focus mode configurations and assertions; Find My cache; HomeKitHomeKitApple's smart-home platform and protocol that lets apps control lights, locks, sensors, and other accessories through a unified API, giving cyber tools a standard interface to audit or automate home devices. Homes, Users and Accessories (read from homed/datastore.sqlite and homed/core.sqlite); Suggestions Store contact details and URLs (from Suggestions/entities.db); Widget Engagements (from _ATXInfoSuggestionStore.db); Meta Apps Time In App (from time_in_app_<id>.db); Quick LookQuick LookA macOS feature from Apple that lets users preview file contents without opening the associated application, useful for cyber tools that need to surface file data quickly in a UI. Thumbnails (thumbnails.data rendered); Keyboard Text Replacements (TextReplacements.db); and Playback Session Archives, Life360 Location State Samples, mt.lastLaunch App Dates, CarKit Connection Events, Contacts Me Card Donations, FaceTime Messages, Line Calls, Lockdown Pair Records, Pending Notifications, and Photos Picker Log.
   • Adds new unified log artifacts covering Lockdown Mode, passkeypasskeyPhishing-resistant sign-in credentials built on FIDO2/WebAuthn: the device holds a private key and proves possession instead of the user typing a password. They sync across a user's devices. record loads, background shortcut actions, and VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. connectivity, plus new artifacts for Screen Time store artifacts (RMAdminStore), SMSSMSShort Message Service, the protocol built into cellular networks for sending text messages between phones; cyber tools use it for alerting, two-factor authentication delivery, or phishing simulation over mobile channels. and iMessage reactions, edit history, unsent parts, replies, recently deleted, link previews and app messages, sysdiagnose associated domains, MC event lists, Network Extension, iCloud Drive (brctl), and process task info, contributed by @danjethh.

   3 more in Everything

2. v2026.4.5 Oct 24, 2026 · issue 120

   iLEAPP v2026.4.5 adds raw-image LVM2LVM2The Linux Logical Volume Manager, maintained by the kernel community, that pools physical disks into flexible logical volumes so tools can resize, snapshot, or migrate storage without repartitioning./LUKSLUKSA disk-encryption standard built into the Linux kernel that stores encryption metadata in a header on the volume itself, letting cyber tools unlock encrypted drives portably across distributions and implementations./RAIDRAIDA storage architecture that combines multiple physical disks into one logical volume using mirroring, striping, or parity to trade capacity for redundancy, speed, or both. support, 30+ new app artifacts, and SHA-256SHA-256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. staging hashes via --hash⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2026.4.5 https://github.com/abrignoni/iLEAPP.git
   # already have the repo? check out this version:
   $ git checkout v2026.4.5

   • Adds --hash flag (and a matching GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands. checkbox) to record a SHA-256 digest for each staged file, covering zip NTFSNTFSThe default file system format for Windows, developed by Microsoft, storing files with rich metadata and access controls; cyber tools target it to parse artifacts like timestamps, alternate data streams, and the MFT. and extended timestamp fields, tar headers (GNU and PAX), L01 and AD1 entries, FAT/exFAT entries, and ext/APFSAPFSApple's proprietary filesystem introduced in 2017, replacing HFS+, designed for SSDs with native encryption, snapshots, and space sharing — giving cyber tools reliable forensic primitives on modern Apple devices./HFS+ times.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Extends -t raw support to LVM2 logical volumes (split, striped and RAID1), LUKS containers opened with a passphrase (via --image_password_file, --image_password_env, a prompt, or the GUI), RAID member images read together, and FAT12/FAT16 filesystems, and further extends it to expose free space, flash-filesystem deleted files, and NTFS directory indexes to artifact modules that request them, naming each file read through missing acquisition data.
   • Reads Cellebrite CLBX zip timestamps from metadata.msgpack (adding msgpack as a dependency), and reads the creation time from the fourth value of four-value extended timestamp blocks (GrayKey-style files_full.zip).
   • Adds new artifacts: logarchive entries from sysdiagnose for unlock, buttons, orientation, gestures, USB host, wake source, AirDrop, calls, weather, family hotspot, charging state, app snapshots, container entries, and data usage; logarchive entries for URL and link opens, camera and microphone capture sessions, TCC authorization cache, location manager state, Screen Time (ManagedSettings), BatteryUI per-app runtime, and Container Manager State for iOS 27; 32 new Life360 artifacts (including crash-detection diagnostics and recovered history) plus generic Mixpanel and Crashlytics artifacts; and Apple Watch photo collections, registry history, Mail registry, Weather Cities, Photos Graph Moment Locations, routined visits and vehicle events, Cache Locations (course, altitude and accuracy), KeepSafe photo vault, Reddit post and subreddit history, Anonymous Chat, Emoji Recents/Usage/Preferences, an account-wide encryption key hash artifact, offline DJI TXT flight records, Discord Servers, Battery Center, Alarms sleep alarms, Apple Music search, Media Experience, Media Remote, Photos Recent Searches, Hashtag Images, and supplementary WebKit cache parsers.
   • Reads logarchive from within a sysdiagnose archive.

   +1 more show less

   • Supports Python 3.15 (including Windows wheels for Python 3.15 and ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead.) and packages Windows releases as a single portable file per architecture (-windows-x64-portable.zip and -windows-arm64-portable.zip) with no installer.
   • Adds --hash flag (and a matching GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands. checkbox) to record a SHA-256 digest for each staged file, covering zip NTFSNTFSThe default file system format for Windows, developed by Microsoft, storing files with rich metadata and access controls; cyber tools target it to parse artifacts like timestamps, alternate data streams, and the MFT. and extended timestamp fields, tar headers (GNU and PAX), L01 and AD1 entries, FAT/exFAT entries, and ext/APFSAPFSApple's proprietary filesystem introduced in 2017, replacing HFS+, designed for SSDs with native encryption, snapshots, and space sharing — giving cyber tools reliable forensic primitives on modern Apple devices./HFS+ times.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Reads Cellebrite CLBX zip timestamps from metadata.msgpack (adding msgpack as a dependency), and reads the creation time from the fourth value of four-value extended timestamp blocks (GrayKey-style files_full.zip).
   • Adds new artifacts: logarchive entries from sysdiagnose for unlock, buttons, orientation, gestures, USB host, wake source, AirDrop, calls, weather, family hotspot, charging state, app snapshots, container entries, and data usage; logarchive entries for URL and link opens, camera and microphone capture sessions, TCC authorization cache, location manager state, Screen Time (ManagedSettings), BatteryUI per-app runtime, and Container Manager State for iOS 27; 32 new Life360 artifacts (including crash-detection diagnostics and recovered history) plus generic Mixpanel and Crashlytics artifacts; and Apple Watch photo collections, registry history, Mail registry, Weather Cities, Photos Graph Moment Locations, routined visits and vehicle events, Cache Locations (course, altitude and accuracy), KeepSafe photo vault, Reddit post and subreddit history, Anonymous Chat, Emoji Recents/Usage/Preferences, an account-wide encryption key hash artifact, offline DJI TXT flight records, Discord Servers, Battery Center, Alarms sleep alarms, Apple Music search, Media Experience, Media Remote, Photos Recent Searches, Hashtag Images, and supplementary WebKit cache parsers.
   • Reads logarchive from within a sysdiagnose archive.

   2 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !Python 3.11 or newer is now required to run iLEAPP from source (previously Python 3.10 was supported).
   • !There is no ileappGUI executable any more; ileapp without arguments opens the window instead.
3. v2026.4.4 Oct 2, 2026 · issue 092

   iLEAPP v2026.4.4 adds Safari history tags, knowledgeC location activity, sysdiagnose Wi-Fi status, and broader flash-dump parsing via qnxprobe 1.57.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2026.4.4 https://github.com/abrignoni/iLEAPP.git
   # already have the repo? check out this version:
   $ git checkout v2026.4.4

   • Adds a Safari Browser - History Tags artifact with one row per tag-to-history-item link and one row per unlinked tag, and adds Tags, Tag Identifiers, and Profile Name columns to the existing Safari Browser - History artifact (profile name read from SafariTabs.db).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds a knowledgeC Location Activity artifact for the /app/locationActivity stream, surfacing place name, address, coordinates, activity UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide., bundle ID, and the other coordinate pairs in the compressed payload with per-pair distances.
   • Adds a Sysdiagnose - Wifi Status artifact and extends TCC app-permission parsing to read from a sysdiagnose archive packed inside an extraction.
   • Extends Session contact parsing to databases written by older Session versions that lack the lastKnownClientVersion column, and links Session 2.14.2 attachments named by a hash of the download URL.
   • Updates -t raw acquisition reading via qnxprobe 1.57: adds JFFS2 compressed with OpenWrt's LZMA, UBI/UBIFS with bit errors, two adjacent JFFS2 partitions read as two separate filesystems, U-Boot environment and Belkin NVRM stores listed as single-file volumes (uboot-env.bin / nvram.bin), correct staging of OneDrive Files On-Demand placeholders, XPRESS-compressed NTFSNTFSThe default file system format for Windows, developed by Microsoft, storing files with rich metadata and access controls; cyber tools target it to parse artifacts like timestamps, alternate data streams, and the MFT. files, and NTFS-compressed files with early-ending compression units.
   • Adds a Safari Browser - History Tags artifact with one row per tag-to-history-item link and one row per unlinked tag, and adds Tags, Tag Identifiers, and Profile Name columns to the existing Safari Browser - History artifact (profile name read from SafariTabs.db).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds a knowledgeC Location Activity artifact for the /app/locationActivity stream, surfacing place name, address, coordinates, activity UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide., bundle ID, and the other coordinate pairs in the compressed payload with per-pair distances.
   • Adds a Sysdiagnose - Wifi Status artifact and extends TCC app-permission parsing to read from a sysdiagnose archive packed inside an extraction.

   2 more in Everything

4. v2026.4.3 Sep 29, 2026 · issue 089

   iLEAPP v2026.4.3 adds unified ileapp binary for all platforms, E01E01A forensic disk image format that stores a drive's contents in segmented files with built-in checksums and metadata, widely used in digital forensics because it supports compression and chain-of-custody verification./AFD/APFSAPFSApple's proprietary filesystem introduced in 2017, replacing HFS+, designed for SSDs with native encryption, snapshots, and space sharing — giving cyber tools reliable forensic primitives on modern Apple devices. image support via -t raw, and nine new iOS app parsers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2026.4.3 https://github.com/abrignoni/iLEAPP.git
   # already have the repo? check out this version:
   $ git checkout v2026.4.3

   └──▷ TRY IT
   Parse an EnCase E01 acquisition directly — no mounting or admin rights needed — useful when working from a forensic image on a case workstation.
   copy

   $ ileapp -t raw -i /evidence/acquisition.E01 -o /cases/output/

   • Extends -t raw to support E01 and Ex01, SMART, AFFAFFAdvanced Forensic Format, an open disk-image container standard maintained by Simson Garfinkel, designed to store forensic evidence with built-in compression, metadata, and cryptographic hashing. and AFD images, Apple disk images (.dmg, .sparseimage, sparse bundles and segmented sets), encrypted Apple disk images, FTK Imager AD-encrypted images, and encrypted APFS volumes (opened with a supplied password).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds NTFSNTFSThe default file system format for Windows, developed by Microsoft, storing files with rich metadata and access controls; cyber tools target it to parse artifacts like timestamps, alternate data streams, and the MFT. alternate data stream reading under -t raw.
   • Adds iOS artifact support for Roblox, KakaoTalk (with message/attachment/phone field decryption and inline media), WeChat, Telekom Mail, BOTIM, VK Messenger, Odnoklassniki, and SimpleX Chat (SQLCipher, keychain key).
   • Adds iOS Health walking and running distance artifact.
   • Adds Intelligence Platform artifact family for iOS: knowledge graphknowledge graphA representation of entities and the relationships between them. Software can follow those connections to answer questions or combine information from different sources., expired interactions, behaviors timeline, and event locations.

   +7 more show less

   • Adds Biome sync merged events artifact.
   • Renames Snapchat Friends to Snapchatter Records and adds friends-list parsing.
   • Adds Call History columns for iOS 26.
   • Adds Sysdiagnose Process tree built from ps.txt.
   • Unifies all platform downloads into a single ileapp binary: Windows gets -windows-x64-setup.exe / -windows-x64-portable.zip and -windows-arm64-setup.exe / -windows-arm64-portable.zip; macOS gets signed and notarised -macos-arm64.dmg / -macos-x64.dmg; Linux gets -linux-x64.AppImage / -linux-arm64.AppImage.
   • Accepts .tar.xz archives in the GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands. (already supported on the CLI via -t tar).
   • Updates qnxprobe to version 1.51.
   • Extends -t raw to support E01 and Ex01, SMART, AFFAFFAdvanced Forensic Format, an open disk-image container standard maintained by Simson Garfinkel, designed to store forensic evidence with built-in compression, metadata, and cryptographic hashing. and AFD images, Apple disk images (.dmg, .sparseimage, sparse bundles and segmented sets), encrypted Apple disk images, FTK Imager AD-encrypted images, and encrypted APFS volumes (opened with a supplied password).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds NTFSNTFSThe default file system format for Windows, developed by Microsoft, storing files with rich metadata and access controls; cyber tools target it to parse artifacts like timestamps, alternate data streams, and the MFT. alternate data stream reading under -t raw.
   • Adds iOS artifact support for Roblox, KakaoTalk (with message/attachment/phone field decryption and inline media), WeChat, Telekom Mail, BOTIM, VK Messenger, Odnoklassniki, and SimpleX Chat (SQLCipher, keychain key).
   • Adds iOS Health walking and running distance artifact.
   • Adds Intelligence Platform artifact family for iOS: knowledge graphknowledge graphA representation of entities and the relationships between them. Software can follow those connections to answer questions or combine information from different sources., expired interactions, behaviors timeline, and event locations.

   +1 more show less

   • Adds Biome sync merged events artifact.

   6 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !The separate ileappGUI binary no longer exists; both GUI and CLI are now the single ileapp binary (GUI when run without arguments, CLI when run with arguments). Automated tooling that invokes ileappGUI must be updated.
   • !Download file names changed: the previous naming scheme (e.g. ileappGUI-v*-Windows_x86_64.zip) is replaced by new names such as -windows-x64-setup.exe, -windows-x64-portable.zip, -macos-arm64.dmg, -linux-x64.AppImage, etc.
5. v2026.4.2 Sep 20, 2026 · issue 080

   iLEAPP v2026.4.2 adds sysdiagnose parsing, Snapchat Memories, NTFSNTFSThe default file system format for Windows, developed by Microsoft, storing files with rich metadata and access controls; cyber tools target it to parse artifacts like timestamps, alternate data streams, and the MFT./APFSAPFSApple's proprietary filesystem introduced in 2017, replacing HFS+, designed for SSDs with native encryption, snapshots, and space sharing — giving cyber tools reliable forensic primitives on modern Apple devices. single-pass image reads, and Calculator Vault/Photos media handling.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2026.4.2 https://github.com/abrignoni/iLEAPP.git
   # already have the repo? check out this version:
   $ git checkout v2026.4.2

   • Adds initial sysdiagnose parsers, including PowerLog database reads inside packed sysdiagnoses and AppleDouble sidecar filtering from sysdiagnose readers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Reads NTFS and APFS images in one pass with qnxprobe 1.30, replacing the previous multi-pass approach.
   • Adds Calculator Vault videos as proper media artifacts, looked up in their own album folder.
   • Reports Photos.sqlite face crops as media instead of a raw report folder path.
   • Commits the LAVA database once per artifact instead of once per staged file, improving write performance.

   +4 more show less

   • Decodes chat type and party from Keyboard Input Contexts identifiers (scoped to the Messenger _0 form).
   • Records evidence-relative source paths for directory and single-file inputs.
   • Deduplicates Mobile Installation log lines reported across multiple files.
   • Stages zip and tar member names stored more than once as a single file.
   • Adds initial sysdiagnose parsers, including PowerLog database reads inside packed sysdiagnoses and AppleDouble sidecar filtering from sysdiagnose readers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   8 more in Everything

6. v2026.4.1 Sep 14, 2026 · issue 075

   iLEAPP v2026.4.1 upgrades the Apple Unified Logs engine to unifiedlog_iterator v0.7.0 and adds iOS/macOS/tvOS/visionOS/watchOS 26–27 version recognition.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2026.4.1 https://github.com/abrignoni/iLEAPP.git
   # already have the repo? check out this version:
   $ git checkout v2026.4.1

   • Upgrades the Apple Unified Logs parsing engine to unifiedlog_iterator v0.7.0, filling previously empty process paths on Simpledump and Statedump rows and logging the parser version at import time.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds recognition for iOS 26.7, iOS 27.0, macOS 15.8, macOS 26.7, macOS 27.0, tvOS 27.0, visionOS 27.0, and watchOS 27.0 in apple_build_id_to_os_version.json.
   • Upgrades the Apple Unified Logs parsing engine to unifiedlog_iterator v0.7.0, filling previously empty process paths on Simpledump and Statedump rows and logging the parser version at import time.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 more in Everything

7. v2026.4.0 Sep 13, 2026 · issue 074

   iLEAPP v2026.4.0 adds -t raw for disk images and E01s, F2FSF2FSA Linux filesystem developed by Samsung, optimized for NAND flash storage by reducing write amplification and managing erase cycles efficiently, making it attractive for tools running on flash-based devices. support, and new artifacts for Garmin Connect, Tutanota, MEGA, and SMSSMSShort Message Service, the protocol built into cellular networks for sending text messages between phones; cyber tools use it for alerting, two-factor authentication delivery, or phishing simulation over mobile channels. previews.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2026.4.0 https://github.com/abrignoni/iLEAPP.git
   # already have the repo? check out this version:
   $ git checkout v2026.4.0

   • Adds -t raw input type to parse raw disk images and E01E01A forensic disk image format that stores a drive's contents in segmented files with built-in checksums and metadata, widely used in digital forensics because it supports compression and chain-of-custody verification. acquisitions directly from the CLI.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds F2FS filesystem support via re-vendored qnxprobe 1.28/1.29, enabling raw image parsing of F2FS volumes.
   • Adds full artifact coverage for Garmin Connect (including the Move IQ activity series) on iOS.
   • Adds artifact coverage for Tutanota on iOS.
   • Adds artifact coverage for MEGA cloud storage on iOS.

   +5 more show less

   • Adds apple_sms_preview_ktx_atx artifact (SMS & iMessage category) to surface Apple SMS preview attachments stored as ATX containers with .ktx extensions under com.apple.MobileSMS/Previews/Attachments/.
   • Adds a Shared Name column to the Apple SMS Preview Cache artifact, reporting contact card and location share titles from companion plists.
   • Expands WhatsApp call record parsing to include additional call record fields on iOS.
   • Links WiFi network store geotags to their networks through recorded relationships in the WiFi Known Networks artifact.
   • Names KMLKMLAn XML-based file format maintained by the OGC for storing geographic data such as points, paths, and polygons. Cyber tools use it to visualize location-based intelligence on maps. placemarks by timestamp in two location artifacts for clearer geographic reporting.
   • Adds -t raw input type to parse raw disk images and E01E01A forensic disk image format that stores a drive's contents in segmented files with built-in checksums and metadata, widely used in digital forensics because it supports compression and chain-of-custody verification. acquisitions directly from the CLI.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds F2FS filesystem support via re-vendored qnxprobe 1.28/1.29, enabling raw image parsing of F2FS volumes.
   • Adds full artifact coverage for Garmin Connect (including the Move IQ activity series) on iOS.
   • Adds artifact coverage for Tutanota on iOS.
   • Adds artifact coverage for MEGA cloud storage on iOS.

   +1 more show less

   • Adds apple_sms_preview_ktx_atx artifact (SMS & iMessage category) to surface Apple SMS preview attachments stored as ATX containers with .ktx extensions under com.apple.MobileSMS/Previews/Attachments/.

   4 more in Everything

8. v2026.3.3 Sep 8, 2026 · issue 069

   iLEAPP v2026.3.3 adds 25+ new app parsers including smart home/IoTIoTA collective label for internet-connected physical devices — sensors, cameras, routers, appliances — that tools target because they run embedded firmware with limited patching and broad network exposure., crypto, and social apps, plus iOS diagnostic report (.ips) ingestion and MMKVMMKVA key-value storage library from Tencent, built on memory-mapped files, that gives apps fast persistent storage without explicit write calls — useful for tools that need low-latency local state or config caching. decryption support.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2026.3.3 https://github.com/abrignoni/iLEAPP.git
   # already have the repo? check out this version:
   $ git checkout v2026.3.3

   └──▷ TRY IT
   Generate ready-to-paste sample_data blocks for all modules changed on your branch, using a full extraction as input.
   copy

   $ python admin/scripts/validate_sample_data.py --emit extraction.zip --key my_test_image

   • Adds --emit flag to validate_sample_data.py to generate sample_data values directly from a test extraction image.
   • Adds support for ingesting iOS diagnostic reports (.ips files) as a new input format.
   • Adds a Sysdiagnose Extraction Helper to expand raw forensic input options.
   • Adds 25+ new app parsers including Nest, August/Yale, Google Home, myQ, Samsung Family Hub, Coinbase Wallet, Spotify, TextNow, Zoom chat, Brave, Notion, GETTR, Houseparty, CoverMe, Skout, Private Photo Vault, IFTTT, LG ThinQ, New York Times, GPS Tracks/GPX, and Foursquare Pilgrim.
   • Adds MMKV decryption support via a vendored mmkv_parser, with correct varint header handling and a new MMKV - Recovered Records artifact.

   +8 more show less

   • Reworks the Discord iOS account artifact to read account data directly from its MMKV store.
   • Adds Sender, Chat Name, and Chat Participants fields to the SMSSMSShort Message Service, the protocol built into cellular networks for sending text messages between phones; cyber tools use it for alerting, two-factor authentication delivery, or phishing simulation over mobile channels. artifact.
   • Adds Life360 location samples and motion activity parsed from app logs.
   • Adds WhatsApp log sessions artifact for iOS.
   • Adds Signal app launches and call events parsed from iOS debug logs.
   • Adds Chromium tab restore file parsing on iOS.
   • Scopes TikTok IM, Pitaya, and WatchHistory artifacts to TikTok-owned containers, preventing false matches from files with identical names in other app containers.
   • Extends Line messenger to read every database store rather than only the first, and reports orphaned attachments.
   • Adds support for ingesting iOS diagnostic reports (.ips files) as a new input format.
   • Adds a Sysdiagnose Extraction Helper to expand raw forensic input options.
   • Adds 25+ new app parsers including Nest, August/Yale, Google Home, myQ, Samsung Family Hub, Coinbase Wallet, Spotify, TextNow, Zoom chat, Brave, Notion, GETTR, Houseparty, CoverMe, Skout, Private Photo Vault, IFTTT, LG ThinQ, New York Times, GPS Tracks/GPX, and Foursquare Pilgrim.
   • Adds MMKV decryption support via a vendored mmkv_parser, with correct varint header handling and a new MMKV - Recovered Records artifact.
   • Adds Life360 location samples and motion activity parsed from app logs.

   +3 more show less

   • Adds WhatsApp log sessions artifact for iOS.
   • Adds Signal app launches and call events parsed from iOS debug logs.
   • Adds Chromium tab restore file parsing on iOS.

   5 more in Everything

9. v2026.3.2 Aug 27, 2026 · issue 058

   iLEAPP v2026.3.2 adds 13 new app parsers including Amazon Shopping, Google Photos, Netflix, and Firefox for iOS forensic analysis.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2026.3.2 https://github.com/abrignoni/iLEAPP.git
   # already have the repo? check out this version:
   $ git checkout v2026.3.2

   • Adds Google Calendar, Google Sheets, Google Docs, and Google Maps artifact support for iOS.
   • Adds Netflix artifact support for iOS, reporting only rows an examiner can act on, including cached stream segments with subtitle cues.
   • Adds Pinterest artifact support for iOS.
   • Adds Coinbase artifact support for iOS.
   • Adds Firefox artifact support for iOS.

   +7 more show less

   • Adds Grindr artifact support for iOS, including conversation link counts.
   • Adds Fitbit artifact support for iOS.
   • Adds KeepSafe artifact support for iOS: vault items, albums, and account/PIN security.
   • Adds TeleGuard calls, account, and drafts artifacts for iOS.
   • Adds container-scoping enforcement for Pinterest, Tinder, and Google Drive/Sheets artifacts, preventing cross-app data bleed.
   • Reports real device/source paths instead of the examiner's local folder structure, enforced across 83+ modules including Biome, CNACNACVE Numbering Authority — an organization authorized by MITRE to assign CVE IDs within a defined scope, letting cyber tools reference vulnerabilities under a globally consistent identifier., and Privacy Accounting artifacts.
   • Adds admin/scripts/check_artifact_paths.py CI guard (with --self-test and --list flags) that fails when an artifact's paths tuple contains two patterns differing only in case, wired into the lint workflow.

   12 details in Everything

10. v2026.3.1 Aug 18, 2026 · issue 050

    iLEAPP v2026.3.1 adds Snapchat, Tinder, TikTok, Reddit, OneDrive, and Google Drive artifacts plus WhatsApp add-on and logarchive dialed-number coverage.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2026.3.1 https://github.com/abrignoni/iLEAPP.git
    # already have the repo? check out this version:
    $ git checkout v2026.3.1

    • Adds new logarchive dialed numbers artifact extracting CommCenter call.provider setup/teardown blocks, Call(StatusUpdate) state chains, and ContactSearchManager digit-sequence entries from unified log archives.
    • Adds Snapchat iOS artifacts including Memories Search Index.
    • Adds Tinder iOS artifacts.
    • Adds four TikTok artifacts: Watch History, Account, Published Videos, and App Sessions.
    • Adds Reddit iOS artifacts covering user and subscription data.

    +7 more show less

    • Adds OneDrive iOS artifacts.
    • Adds Google Drive DriveKit artifacts for iOS.
    • Adds four WhatsApp iOS add-on artifacts: reactions, channel tallies, group events, and membership changes.
    • Adds Chrome saved credit cards artifact and Chrome payments customer data artifact.
    • Upgrades Proton Mail Inbox Messages to a conversation view with inline media, adding remote_conversation_id, Conversation Subject, From Me direction, and first cached Attachment columns via a data_views.conversation block.
    • Skips Chromium databases that cannot be opened instead of aborting the entire artifact.
    • Adds GroupMe message deletion state reporting for iOS.

    12 details in Everything

11. v2026.3.0 Aug 14, 2026 · issue 046

    iLEAPP v2026.3.0 adds Apple Unified Logs, 16+ new artifacts, Telegram/Wickr/Session parsers, and sysdiagnose PowerLog support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2026.3.0 https://github.com/abrignoni/iLEAPP.git
    # already have the repo? check out this version:
    $ git checkout v2026.3.0

    • Adds parsing of *.PLSQL.gz rotated PowerLog archives (decompressed to a session temp directory, reused across all PowerLog artifacts) alongside CurrentPowerlog.PLSQL, with per-archive time-offset correction — extending recoverable history by weeks on most images.
    • Adds Apple Unified Logs support with the parser bundled into all builds and 16+ new artifacts surfaced from a predicate survey.
    • Adds Telegram artifacts for iOS: Accounts (from accounts-metadata/atomic-state and Postbox t0), Contacts & Peers (full t2 peer dump with avatar images and Spotlight cache), Chats (Postbox chat list), Cached Peer Details (Postbox t18), Device Contacts (Postbox t54), Peer Presence, and Message Tags.
    • Adds Wickr artifacts parsed from wickrLocal.sqlite and app logs, plus Wickr account identity recovered from the keychain.
    • Adds Session/Oxen artifacts including decrypted messages, contacts, and attachments.

    +5 more show less

    • Adds new app parsers for DuckDuckGo, MEGA, Onion Browser (including Realm-based artifacts via a vendored Realm parser), what3words, Dubox/Terabox, Claude, Apple Intelligence Report, and Lidl Plus (SQLCipher + Keychain).
    • Adds Biome/SEGB coverage for Networking Edge Selection, DuetExpertCenter notifications, Privacy Accounting streams, and Contact Autocomplete Feedback.
    • Adds a new CI tripwire guarding against unsupported claim language in artifact documentation.
    • Adds a CI guard for HTML report injection and remote destinations in generated reports.
    • Adds CI test coverage for Python 3.13 and 3.14 runtime contract, and Windows/Linux/ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead. test builds.

    10 details in Everything

12. v2026.2.1 Jul 27, 2026 · issue 027

    iLEAPP v2026.2.1 adds 60+ Biome streams, full Signal for iOS parsing, expanded keychain handling, and notifications overhaul.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2026.2.1 https://github.com/abrignoni/iLEAPP.git
    # already have the repo? check out this version:
    $ git checkout v2026.2.1

    └──▷ TRY IT
    Supply an examiner-provided keychain file alongside an iTunes backup to enable keychain lookups across the new artifacts.
    copy

    $ ileapp -t itunes -i /path/to/backup/ -o /path/to/output/ --itunes_password <password>

    • Adds 60+ new Biome artifact streams covering device power/lock state, location visit, app location activity, camera AutoFocus ROI, energy mode, boot session, emergency voice calls, emoji engagement, Device.Timezone, Wallet transactions, Siri Remembers Message/Audio History, Discoverability Signals, Siri UI, Siri suggestions, and a full Apple Intelligence family including Safety Overrides.
    • New Signal for iOS support: full message and contact parsing, conversation view with attachments, and detection of Signal's timestamped GRDB directories.
    • Expanded keychain handling: accepts examiner-supplied keychain input, adds a lookup helper, includes a pure-Python SQLCipher reader, supports UFED encrypted keychain dumps, and can reuse a keychain already present in the extraction.
    • Notifications overhaul: attachments now checked in as media, images embedded in notification payloads recovered, and payload fields split into dedicated columns.
    • Adds Notes – Password Protected artifact for password hint and recoverability triage.

    5 details in Everything

13. v2026.2.0 Jul 20, 2026 · issue 020

    iLEAPP v2026.2.0 adds Biome, C2PA AI provenanceprovenanceEvidence recording where a software artifact came from and how it was built, including its source and build process. It helps a consumer check that the artifact matches a trusted build., and United Airlines artifacts with full iOS 26 and Python 3.13/3.14 support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2026.2.0 https://github.com/abrignoni/iLEAPP.git
    # already have the repo? check out this version:
    $ git checkout v2026.2.0

    └──▷ TRY IT
    Parse an iOS 26 extraction to capture new Biome and C2PA artifacts in a full HTML/TSVTSVA plain-text format storing tabular data with fields separated by tab characters, making it easy for cyber tools to parse and exchange structured records without a CSV parser's quoting complexity. report.
    copy

    $ ileapp -t zip -i /path/to/ios26_extraction.zip -o /path/to/output/

    Limit a parse run to only the new Biome and C2PA modules using a saved profile, to reduce processing time on large extractions.
    copy

    $ ileapp -t fs -i /path/to/extraction/ -o /path/to/output/ -m /path/to/biome_c2pa.ilprofile

    • Adds 14+ new Biome database artifacts parsing SQLite stores under Library/Biome/databases/ (app openings, cable plug events, backlight events, CarPlay activity, intelligence platform entities, and more).
    • Adds Biome Set.db artifacts for installed apps and other syncable streams under Library/Biome/sets/.
    • Adds Biome stream artifacts for harvested mail/messages, reads, screen time, and keyboard data.
    • Adds C2PA Content Provenance artifact parsing AI-generated image provenance, including signer certificate, signing time, Media State column, and case-insensitive media path matching.
    • Adds new United Airlines app artifact module extracting travel data from the United Airlines iOS app.

    +3 more show less

    • Reworks Photos.sqlite parser with full iOS 26 support, context form, and generator compatibility.
    • Adds Python 3.13 and 3.14 support.
    • Expands iOS test corpus coverage to 13 archives spanning iOS 13.3.1 through the latest releases.

    8 details in Everything

14. v2026.1.0 Jul 10, 2026 · issue 014

    iLEAPP v2026.1.0 adds 10+ new parsers, conversation views, custom artifact paths, and broad LAVA migration.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2026.1.0 https://github.com/abrignoni/iLEAPP.git
    # already have the repo? check out this version:
    $ git checkout v2026.1.0

    └──▷ TRY IT
    Load custom or case-specific artifact modules from a separate folder without touching the iLEAPP install — useful for proprietary parsers or in-progress modules.
    copy

    $ ileapp -t zip -i /cases/iphone_extraction.zip -o /cases/output/ --custom_artifacts_path /cases/my_custom_artifacts/

    Name the report subfolder after a case or device for cleaner multi-device output directories.
    copy

    $ ileapp -t fs -i /mnt/extraction/ -o /cases/output/ --custom_output_folder iPhone13_JohnDoe_2026

    Parse an encrypted iTunes backup by supplying the backup password directly on the CLI for scripted/automated workflows.
    copy

    $ ileapp -t itunes -i /cases/backup/ -o /cases/output/ --itunes_password S3cr3tPassw0rd

    • Adds new parsers for Zalo Chat and Users, Discord cache, Home Depot app, Oura Ring, App Web Usage (Biome), Biome NotificationUsage, springboard wallpaper, Apple ATX image files, iOS Widgets, and keychain artifacts.
    • Adds conversation views to WhatsApp, Viber, Kik, Slack, Life360, TikTok, Discord, Teleguard, Reddit, LinkedIn, and Telegram.
    • Adds --custom_artifacts_path CLI flag to load artifact modules from an extra folder, enabling third-party or case-specific parsers without modifying the install.
    • Adds --custom_output_folder CLI flag to set a custom name for the report output subfolder.
    • Adds an App Inventory module for parsing-coverage analysis across installed apps.

    +9 more show less

    • Expands Telegram messages parser with Chat, Chat ID, Thread ID columns and splits Author into Author (name) and Author ID (user ID).
    • Migrates dozens of artifact modules (Kik cluster, mobileBackup/Install, notifications, geod, Safari cluster, Slack, ChatGPT, Life360, mailprotect, photos, iCloud cluster, Proton Mail, SIM info, and more) to the LAVA @artifact_processor decorator, standardizing UTC timestamps and relative source paths.
    • Full refactor of Swarm (Foursquare) and Waze iOS parsers with expanded data extraction and accuracy fields.
    • Adds SMSSMSShort Message Service, the protocol built into cellular networks for sending text messages between phones; cyber tools use it for alerting, two-factor authentication delivery, or phishing simulation over mobile channels. attributedBody parsing via pytypedstream to recover rich-text message content.
    • Adds LAVA launch actions to the final GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands. window for direct post-scan LAVA access.
    • Migrates UI icons to Tabler webfont-based icons with CSS/dark theme updates for HTML reports.
    • Enables KMLKMLAn XML-based file format maintained by the OGC for storing geographic data such as points, paths, and polygons. Cyber tools use it to visualize location-based intelligence on maps. output for coordinate-bearing artifacts.
    • Adds optional recent app history tracking module (CarPlay recentApphistory).
    • Converts HEIC map tiles to JPEG in the geodMapTiles module for broader viewer compatibility.

    14 details in Everything

15. v2.5.0 May 26, 2026 · release notes

    iLEAPP v2.5.0 adds SVG support, AirBNB conversation views, a rebuilt Swarm parser, and LAVA processed-file tracking.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.5.0 https://github.com/abrignoni/iLEAPP.git
    # already have the repo? check out this version:
    $ git checkout v2.5.0

    • Adds SVG image type matcher for artifact extraction.
    • Adds Conversation View functionality to the AirBNB parser for LAVA output.
    • Rewrites the iOS Swarm parser with a full re-engineering for improved coverage.
    • Outputs processed files to the LAVA database and run information to the LAVA JSON file.

    4 details in Everything

16. v2.4.0 May 18, 2026 · release notes

    iLEAPP v2.4.0 adds Reddit Chat and iOS Cache Locations parsers plus JPEG XL/DDS image support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.4.0 https://github.com/abrignoni/iLEAPP.git
    # already have the repo? check out this version:
    $ git checkout v2.4.0

    • New Reddit Chat Parser module extracts and parses Reddit chat data from iOS extractions.
    • New iOS Cache Locations module surfaces cached location data from iOS artifacts.
    • Adds JPEG XL and DDS image type matchers, enabling iLEAPP to recognize and process these additional image formats.

    3 details in Everything

17. v2.3.1 Apr 20, 2026 · release notes

    iLEAPP v2.3.1 adds 11 new artifact modules including Threema, Discord, Zangi, Apple Maps Trips, and Spotlight Index Cache.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.3.1 https://github.com/abrignoni/iLEAPP.git
    # already have the repo? check out this version:
    $ git checkout v2.3.1

    • New Spotlight Index Cache module for extracting indexed file metadata.
    • New Threema messenger parser for chat artifact extraction.
    • New Discord2026 module for parsing updated Discord artifacts.
    • New Zangi Messenger parser for call and message artifacts.
    • New meteoSwiss app module for weather app artifact analysis.

    +8 more show less

    • New Apple Maps Trips/Significant Locations parser for movement history.
    • New batteryBDC module for battery health and charging artifact extraction.
    • New Box for iOS artifact parser for cloud storage activity.
    • New Device artifacts module from Find My Friends.
    • GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands. window is now resizable for improved usability on varied screen sizes.
    • Supports iTunes encrypted backups via Evanole VM.
    • LAVA output now includes module metadata in .lava files.
    • Modules updated to emit LAVA-compatible output, including Potato Chat and Kleinanzeigen with conversation thread view.

    13 details in Everything

18. v2.3.0 Aug 31, 2025 · release notes

    iLEAPP v2.3.0 adds iTunes encrypted backup support, Unified Logs artifacts, and six new app parsers with ~20x faster media lookup.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.3.0 https://github.com/abrignoni/iLEAPP.git
    # already have the repo? check out this version:
    $ git checkout v2.3.0

    • Supports iTunes encrypted backups natively, enabling direct processing without manual decryption.
    • New Unified Logs (logarchive) artifacts expand Apple system log analysis coverage.
    • Adds progress and status count to console output for real-time processing visibility.
    • Media file lookup is approximately 20x faster, enabling practical use on large datasets.
    • New Sysdiagnose module parses sysdiagnose archives including Account Devices and Mobile Installation Logs.

    +6 more show less

    • New AMDSQLiteDB parser module extracts Apple Mobile Device data.
    • New Airbnb messages artifact parser.
    • New Potato Chat parser module.
    • New CashApp parser module.
    • New User Defaults parser module.
    • Modules updated for LAVA output compatibility.

    11 details in Everything

19. v2.2.0 May 19, 2025 · release notes

    iLEAPP v2.2.0 adds Apple Unified Log processing, agency logo branding, hardlinked media, and a Biome keybag module.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.2.0 https://github.com/abrignoni/iLEAPP.git
    # already have the repo? check out this version:
    $ git checkout v2.2.0

    └──▷ HOW TO FIND IT
    Add your agency's logo to every HTML report for professional case documentation.
    📍python ileappGUI.py
    • Adds processing of Apple Unified Logs (logarchive.json parser) for timeline analysis of iOS log archives.
    • Enables embeddingembeddingLists of numbers a model produces to represent the meaning of text, images or code, so similar items sit close together. They power semantic search and RAG. a custom agency logo in HTML reports via case data settings.
    • Supports hardlinks for media files in HTML reports, reducing storage duplication.
    • New Biome keybag module for parsing iOS Biome keybag artifacts.
    • Booking and burnerCache modules updated with LAVA output support.

    5 details in Everything

20. v2.1.3 Apr 25, 2025 · release notes

    iLEAPP v2.1.3 adds a new storeUser parser and enhances Voicemail, Discord, and WithingsHealthMate modules.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.1.3 https://github.com/abrignoni/iLEAPP.git
    # already have the repo? check out this version:
    $ git checkout v2.1.3

    • Enhanced Voicemail module with additional artifact coverage.
    • Enhanced Discord module with updated parsing support.
    • WithingsHealthMate module updated to support LAVA output format.

    3 details in Everything

21. v2.1.2 Apr 10, 2025 · release notes

    iLEAPP v2.1.2 adds Kleinanzeigen.de, Apple WorldClock, and BeReal parsers plus new GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands. keyboard shortcuts.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.1.2 https://github.com/abrignoni/iLEAPP.git
    # already have the repo? check out this version:
    $ git checkout v2.1.2

    • New artifact parser for Kleinanzeigen.de (German classifieds app), extracting messages and message direction.
    • New parser for Apple WorldClock app data.
    • New parser for BeReal app artifacts.
    • Adds WhatsApp mono module for WhatsApp artifact extraction.
    • Adds metadata extraction from forwarded messages, including links and attachments.

    +1 more show less

    • New GUI keyboard shortcuts: Ctrl+I focuses the Input File field, Ctrl+O focuses the Output File field, Ctrl+F focuses the Filter field.

    6 details in Everything

22. v2.1.0 Feb 16, 2025 · release notes

    iLEAPP v2.1.0 adds GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands. module filtering, a pre-release media manager for LAVA, and new forensic modules including call history group calls and Apple Clock stopwatch/timer artifacts.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.1.0 https://github.com/abrignoni/iLEAPP.git
    # already have the repo? check out this version:
    $ git checkout v2.1.0

    • Adds GUI module filter to quickly select or deselect analysis modules before a run.
    • Introduces pre-release Media Manager for LAVA, enabling media artifact handling and export across modules (voicemail, address book, app snapshots).
    • New Call History Group Call module extracts group call records from iOS call history.
    • Enhances Apple Clock artifacts with new Stopwatch and Timer artifact extraction.
    • Adds support for the updated Photos.sqlite database schema with report icons.

    +1 more show less

    • Updates Health module with expanded artifact coverage.

    6 details in Everything

23. v2.0.4 Jan 28, 2025 · release notes

    iLEAPP v2.0.4 adds a Calculator# app artifact parser and refreshes the HTML report with a new icon and logo.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.0.4 https://github.com/abrignoni/iLEAPP.git
    # already have the repo? check out this version:
    $ git checkout v2.0.4

    • New artifact parser for the Calculator# application.
    • Updated HTML report with a new icon and logo.

    2 details in Everything

24. v2.0.3 Jan 16, 2025 · release notes

    iLEAPP v2.0.3 adds Foursquare Swarm artifact support and expands LAVA output to Wire, Splitwise, and Google Translate modules.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.0.3 https://github.com/abrignoni/iLEAPP.git
    # already have the repo? check out this version:
    $ git checkout v2.0.3

    • Adds Foursquare Swarm artifact parser for extracting location check-in data from iOS devices.
    • Adds LAVA output support to Wire, Splitwise, and Google Translate modules.
    • Improves KMLKMLAn XML-based file format maintained by the OGC for storing geographic data such as points, paths, and polygons. Cyber tools use it to visualize location-based intelligence on maps. generation in ilapfuncs.py for richer geolocation artifact output.
    • Updates build IDs database with expanded iOS version coverage.
    • Updates fsCachedData.py with new artifact handling improvements.

    +1 more show less

    • Updates Files app parser (filesApp.py) with LAVA output support.

    6 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The does_table_exist function is renamed to does_table_exist_in_db; any custom modules or scripts calling does_table_exist will break.
    • !The does_view_exist function is renamed to does_view_exist_in_db; any custom modules or scripts calling does_view_exist will break.
    • !The version field is removed from artifact_v2 and replaced with last_update_date; any downstream tooling reading the version field from artifact metadata will break.
25. v2.0.2 Dec 15, 2024 · release notes

    iLEAPP v2.0.2 adds PayByPhone parsing, Trusted Peers DB, call history temp merging, and new SQLite/file helper APIs

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.0.2 https://github.com/abrignoni/iLEAPP.git
    # already have the repo? check out this version:
    $ git checkout v2.0.2

    • Adds new get_sqlite_db_records(path, query) function in ilapfuncs.py for streamlined SQLite querying across modules
    • Adds new get_file_path function in ilapfuncs.py for safer artifact file resolution
    • Adds PayByPhone module to parse parking payment app artifacts
    • Adds Trusted Peers Database module for parsing iCloud trust relationship data
    • Merges callHistoryTemp artifacts into the main callHistory module, surfacing temporary call history records alongside permanent ones

    +3 more show less

    • Adds iOS-version-aware file detection to select the correct artifact file based on the device's iOS version
    • Improves kmlgen function with enhanced KMLKMLAn XML-based file format maintained by the OGC for storing geographic data such as points, paths, and polygons. Cyber tools use it to visualize location-based intelligence on maps. generation capabilities for location artifact mapping
    • Adds admin scripts to audit and verify which modules parse SQLite databases

    8 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !filesApps.py is renamed to filesApp.py — any external scripts or references pointing to filesApps.py will break.
26. v2.0.1 Nov 20, 2024 · release notes

    iLEAPP v2.0.1 adds LAVA output across modules, artifact icons, new plist helpers, subscriber info module, and expanded GeoD map tile support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.0.1 https://github.com/abrignoni/iLEAPP.git
    # already have the repo? check out this version:
    $ git checkout v2.0.1

    • Adds LAVA output format support across numerous modules including health, knowledgeC, Chrome, CarCD, and others.
    • Adds artifact_icon support in the Artifact Info Block Structure for richer LAVA output.
    • Adds new subscriberInfo module to extract subscriber/SIM identity data.
    • Adds plist handling helper functions in ilapfuncs.py for module authors.
    • Expands GeoD Maptiles module to support the Tiles table with updated LAVA output.

    +1 more show less

    • Merges WatchSleepData into the health module and merges Ph99SystemVersionPlist into lastBuild for consolidated reporting.

    6 details in Everything

27. v2.0.0 Nov 7, 2024 · release notes

    iLEAPP v2.0.0 adds LAVA output support, new artifact parsers, redesigned HTML report structure, and a module test harness.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.0.0 https://github.com/abrignoni/iLEAPP.git
    # already have the repo? check out this version:
    $ git checkout v2.0.0

    • Adds LAVA (Latent Evidence Analysis) structured outputstructured outputForcing a model's response to match a given format or JSON schema, so software can parse it reliably instead of hoping the text is well formed. across modules, enabling integration with the LAVA forensic platform.
    • New HTML report folder structure reorganizes output for easier navigation.
    • New artifact parser for LinkedIn app data.
    • New artifact parser for Apple Wallet nano passes.
    • New module for WebKit storage artifacts.

    +13 more show less

    • New Spotlight Search Engagements module.
    • Adds Apple Maps last activity camera artifact parsing.
    • Adds ApplicationState artifact parsing.
    • Adds AppConduit and TCC LAVA-compatible artifact support.
    • Embeds the ccl-segb library for parsing Segmented Binary format artifacts (used in Biomes and other Apple frameworks).
    • Adds LAVA output support for Biomes artifacts.
    • Adds LAVA output support for Control Center artifacts.
    • Adds LAVA output for Data Usage and system shutdown artifacts.
    • Introduces a Module Info Script for inspecting module metadata.
    • Introduces a Filepath Search Script for querying which modules target specific file paths.
    • Introduces a module test harness for validating parsers against test data.
    • Files processed are now logged only when running in research mode, reducing noise in standard runs.
    • HTML report now shows source file path as the filename and adds source file path tooltip in DeviceInfo.html.

    18 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The airtags module file is renamed from airtags.py to findMyItems.py; any external references or scripts invoking the old filename will break.
28. v1.19.5 Oct 3, 2024 · release notes

    iLEAPP v1.19.5 adds Apple Watch sleep data, Identity Lookup Service, Withings Health Mate, Oops app, and Brave Browser artifact support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.19.5 https://github.com/abrignoni/iLEAPP.git
    # already have the repo? check out this version:
    $ git checkout v1.19.5

    • New WatchSleepData.py module extracts Apple Watch sleep data artifacts.
    • New Identity Lookup Service artifact parser added for iOS forensic analysis.
    • New mobileInstallb.py module for mobile installation artifact parsing.
    • Adds support for the Withings Health Mate app artifacts.
    • Adds support for Brave Browser by including its artifact locations in Chrome artifact parsing.

    +7 more show less

    • New Oops: Make New Friends app artifact parser added.
    • Updated TikTok parser now includes replied/referenced artifact extraction.
    • Updated ChatGPT artifact parser with expanded coverage.
    • Updated Burner app artifact parser.
    • Adds Close logs button in the GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands. after processing completes.
    • HTML report now displays the loaded profile.
    • Windows binaries now include version metadata via file_version_info.txt.

    12 details in Everything

29. v1.19.4 Jul 11, 2024 · release notes

    Adds parsers for Watch Worn Data, AudiTripData, cloudkit cache, Booking.com, accountsd/Assetsd cloudServiceEnableLog, and iOS18 Photos.sqlite support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.19.4 https://github.com/abrignoni/iLEAPP.git
    # already have the repo? check out this version:
    $ git checkout v1.19.4

    • Adds new Watch Worn Data.py parser to extract wearable activity data.
    • Adds new audiTripdata.py parser for Audi trip information.
    • Adds new cloudkit cache parser for iCloud synchronization data.
    • Adds new Booking.com - Hotels & Travel parser for travel bookings.
    • Adds parsers for accountsd and Assetsd cloudServiceEnableLog.plist files.

    +1 more show less

    • Adds support for mbdb manifests to enable old iTunes backup analysis.

    6 details in Everything

30. v1.19.3 May 2, 2024 · release notes

    Adds parsing for Uber Locations, Uber Places, Splitwise data, and Zangi chats.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.19.3 https://github.com/abrignoni/iLEAPP.git
    # already have the repo? check out this version:
    $ git checkout v1.19.3

    • Adds uber_locations parser to extract Uber location history from device backups
    • Adds uber_places parser to extract saved Uber places from device backups
    • Adds splitwise parser to extract Splitwise expense data from device backups
    • Adds zangi parser to extract Zangi chat histories from device backups

    4 details in Everything

31. v1.19.1 Mar 23, 2024 · release notes

    Adds parsers for Teleguard, Life360, Wire, SiriRemembers, ChatGPT, iOS Burner; Load/Save Case Data in CLI/GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands.; new Tkinter GUI.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.19.1 https://github.com/abrignoni/iLEAPP.git
    # already have the repo? check out this version:
    $ git checkout v1.19.1

    • Load and Save Case Data file support added to both the GUI and the CLI.
    • Adds Teleguard support parser.
    • Adds Life360 Log Parser.
    • Adds basic support for Wire Messenger.
    • Adds SiriRemembers parser (new SiriRemembers.py module).

    +4 more show less

    • Adds ChatGPT parser.
    • Adds iOS Burner parser.
    • New Tkinter Graphical User Interface replaces the previous GUI implementation.
    • Supports multiple plugin names in one module via ileappGUI.py.

    9 details in Everything

32. v.1.18.7 Dec 3, 2023 · release notes

    iLEAPP v1.18.7 adds artifact parsers for MetaMask, AshHistory, Secret Calculator, CoreAccessories, Voicemail, Google Chat, Duet locations, Data Usage, iTunes Backup Info, Discord attachments, Twint Prepaid, Line Messenger, and Address Book.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v.1.18.7 https://github.com/abrignoni/iLEAPP.git
    # already have the repo? check out this version:
    $ git checkout v.1.18.7

    • Artifact parser for MetaMask
    • Artifact parser for AshHistory (AshHistory.py)
    • Artifact parser for Secret Calculator artifacts
    • Artifact parser for Core Accessories
    • Artifact parser for Voicemail

    +8 more show less

    • Artifact parser for Google Chat (iOS)
    • Artifact parser for Duet locations
    • Artifact parser for Data Usage
    • Artifact parser for iTunes Backup Info (iTunesBackupInfo.py)
    • Discord attachment support in the Discord artifact parser
    • Artifact parser for Twint Prepaid
    • Basic support for Line Messenger
    • New Address Book parser

    13 details in Everything

33. v1.18.7 May 23, 2023 · release notes

    Adds FitnessWorkoutsLocationData detection and updates builds_id/biomeIntents parsers in iLEAPP v1.18.7

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.18.7 https://github.com/abrignoni/iLEAPP.git
    # already have the repo? check out this version:
    $ git checkout v1.18.7

    • Adds FitnessWorkoutsLocationData parser for iOS forensic artifacts
    • Updates builds_ids.py for improved system version identification
    • Updates biomeIntents.py parser logic

    3 details in Everything

34. v1.18.6 May 16, 2023 · release notes

    Adds parsers for Gmail, Chrome, Hikvision, Dahua DMSS, and Telegram; HTML reports now include case data.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.18.6 https://github.com/abrignoni/iLEAPP.git
    # already have the repo? check out this version:
    $ git checkout v1.18.6

    • Ports Chrome parser from ALEAPP to iLEAPP for browser forensics
    • Introduces Hikvision App's Parser for CCTV and IoTIoTA collective label for internet-connected physical devices — sensors, cameras, routers, appliances — that tools target because they run embedded firmware with limited patching and broad network exposure. device data
    • Introduces Dahua Technology (DMSS) CCTV & IoT Parser for surveillance data
    • Adds Telegram messages parser for encrypted chat extraction
    • Adds case data support to the generated HTML report output

    5 details in Everything

35. v.1.18.1 Nov 3, 2022 · release notes

    iLEAPP v1.18.1 adds parsers for Biome artifacts including Notes and Bluetooth data

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v.1.18.1 https://github.com/abrignoni/iLEAPP.git
    # already have the repo? check out this version:
    $ git checkout v.1.18.1

    • Adds support for parsing iOS Biome general artifacts

    1 detail in Everything

36. v.1.18.0 Oct 19, 2022 · release notes

    iLEAPP v1.18 adds Biome support, AppIntents parsing, and a new plugin loader.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v.1.18.0 https://github.com/abrignoni/iLEAPP.git
    # already have the repo? check out this version:
    $ git checkout v.1.18.0

    • Adds Biome artifact support for location and activity data via the new biomeHardware.py and related parsers
    • Adds AppIntents parsing capability for app-specific intent history

    2 details in Everything

37. 1.17.6 Jun 28, 2022 · release notes

    iLEAPP 1.17.6 adds parsers for Viber, Bumble, Gmail, Control Center, AllTrails, Kijiji, and Vipps, plus sidebar toggle UI.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.17.6 https://github.com/abrignoni/iLEAPP.git
    # already have the repo? check out this version:
    $ git checkout 1.17.6

    • Adds Viber parser support including attachment extraction
    • Adds Kik group artifact support (users in groups)
    • Adds Bumble parser support
    • Adds Gmail parser support
    • Adds Control Center and AllTrails parser support

    +5 more show less

    • Adds Kijiji Conversations artifact support
    • Adds Vipps app parser support
    • Supports com.apple.wifi.known-networks.plist
    • Adds MapSync support for map data synchronization
    • Adds sidebar toggle UI feature in the report view

    10 details in Everything