iLEAPP — The Cyber Toolchain

iLEAPP v2026.4.6

Tue, 03 Nov 2026 07:12:50 GMT

iLEAPP adds over 20 new artifact parsers including Hive box inventory, C2PA provenance, SQLite WAL recovery, and Chrome Sync for iOS⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Parse SQLite WAL state with a shared reader — vendored from `sqlite-wal` v0.1.0 — that reads committed rows, the previous WAL generation, and an uncommitted tail; `is_sqlite_sidecar` replaces hand-written sidecar filters in eleven modules, and Snapchat, Google Photos, Google Chat, Life360, Discord and Bluetooth LE now surface rows only earlier WAL states hold.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Improves `-t raw` acquisitions: matches NTFS, ReFS, exFAT and FAT filenames case-insensitively on macOS and Linux, processes a file matched by two patterns of one artifact only once, and now matches Call History Transactions, Spotlight Index and Twint stores at a bare Data volume root. • Adds new artifacts: Hive box inventory (vendored `hive-parser`); C2PA provenance (vendored `c2pareader` 0.2.0); Chrome Sync and Chromium Open Tabs for iOS Chromium browsers; Focus mode configurations and assertions; Find My cache; HomeKit Homes, Users and Accessories (read from `homed/datastore.sqlite` and `homed/core.sqlite`); Suggestions Store contact details and URLs (from `Suggestions/entities.db`); Widget Engagements (from `_ATXInfoSuggestionStore.db`); Meta Apps Time In App (from `time_in_app_.db`); Quick Look Thumbnails (`thumbnails.data` rendered); Keyboard Text Replacements (`TextReplacements.db`); and Playback Session Archives, Life360 Location State Samples, `mt.lastLaunch` App Dates, CarKit Connection Events, Contacts Me Card Donations, FaceTime Messages, Line Calls, Lockdown Pair Records, Pending Notifications, and Photos Picker Log. • Adds new unified log artifacts covering Lockdown Mode, passkey record loads, background shortcut actions, and VPN connectivity, plus new artifacts for Screen Time store artifacts (RMAdminStore), SMS and iMessage reactions, edit history, unsent parts, replies, recently deleted, link previews and app messages, sysdiagnose associated domains, MC event lists, Network Extension, iCloud Drive (`brctl`), and process task info, contributed by @danjethh. • Improves Chromium browser handling: reads every Chrome and Edge profile folder, not only `Chrome/Default`, including `Login Data For Account` and the Google app's `Login Data`, surfaces `AccountBookmarks` in the Bookmarks artifact, and names each Chromium browser from its app container's `MCMMetadataIdentifier` rather than words in the staged path. • Read Wi-Fi plists from sysdiagnose archives, and find archives saved as `_sysdiagnose.tar.gz`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ileapp

iLEAPP v2026.4.5

Sat, 24 Oct 2026 17:21:08 GMT

iLEAPP v2026.4.5 adds raw-image LVM2/LUKS/RAID support, 30+ new app artifacts, and SHA-256 staging hashes via `--hash`⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `--hash` flag (and a matching GUI checkbox) to record a SHA-256 digest for each staged file, covering zip NTFS and extended timestamp fields, tar headers (GNU and PAX), L01 and AD1 entries, FAT/exFAT entries, and ext/APFS/HFS+ times.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Extends `-t raw` support to LVM2 logical volumes (split, striped and RAID1), LUKS containers opened with a passphrase (via `--image_password_file`, `--image_password_env`, a prompt, or the GUI), RAID member images read together, and FAT12/FAT16 filesystems, and further extends it to expose free space, flash-filesystem deleted files, and NTFS directory indexes to artifact modules that request them, naming each file read through missing acquisition data. • Reads Cellebrite CLBX zip timestamps from `metadata.msgpack` (adding msgpack as a dependency), and reads the creation time from the fourth value of four-value extended timestamp blocks (GrayKey-style `files_full.zip`). • Adds new artifacts: logarchive entries from sysdiagnose for unlock, buttons, orientation, gestures, USB host, wake source, AirDrop, calls, weather, family hotspot, charging state, app snapshots, container entries, and data usage; logarchive entries for URL and link opens, camera and microphone capture sessions, TCC authorization cache, location manager state, Screen Time (`ManagedSettings`), `BatteryUI` per-app runtime, and Container Manager State for iOS 27; 32 new Life360 artifacts (including crash-detection diagnostics and recovered history) plus generic Mixpanel and Crashlytics artifacts; and Apple Watch photo collections, registry history, Mail registry, Weather Cities, Photos Graph Moment Locations, routined visits and vehicle events, Cache Locations (course, altitude and accuracy), KeepSafe photo vault, Reddit post and subreddit history, Anonymous Chat, Emoji Recents/Usage/Preferences, an account-wide encryption key hash artifact, offline DJI TXT flight records, Discord Servers, Battery Center, Alarms sleep alarms, Apple Music search, Media Experience, Media Remote, Photos Recent Searches, Hashtag Images, and supplementary WebKit cache parsers. • Reads logarchive from within a sysdiagnose archive. • Supports Python 3.15 (including Windows wheels for Python 3.15 and ARM64) and packages Windows releases as a single portable file per architecture (`-windows-x64-portable.zip` and `-windows-arm64-portable.zip`) with no installer. Breaking changes: • Python 3.11 or newer is now required to run iLEAPP from source (previously Python 3.10 was supported). • There is no `ileappGUI` executable any more; `ileapp` without arguments opens the window instead. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ileapp

iLEAPP v2026.4.4

Fri, 02 Oct 2026 00:35:33 GMT

iLEAPP v2026.4.4 adds Safari history tags, knowledgeC location activity, sysdiagnose Wi-Fi status, and broader flash-dump parsing via qnxprobe 1.57.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds a `Safari Browser - History Tags` artifact with one row per tag-to-history-item link and one row per unlinked tag, and adds `Tags`, `Tag Identifiers`, and `Profile Name` columns to the existing `Safari Browser - History` artifact (profile name read from `SafariTabs.db`).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds a `knowledgeC Location Activity` artifact for the `/app/locationActivity` stream, surfacing place name, address, coordinates, activity UUID, bundle ID, and the other coordinate pairs in the compressed payload with per-pair distances. • Adds a `Sysdiagnose - Wifi Status` artifact and extends TCC app-permission parsing to read from a sysdiagnose archive packed inside an extraction. • Extends Session contact parsing to databases written by older Session versions that lack the `lastKnownClientVersion` column, and links Session 2.14.2 attachments named by a hash of the download URL. • Updates `-t raw` acquisition reading via qnxprobe 1.57: adds JFFS2 compressed with OpenWrt's LZMA, UBI/UBIFS with bit errors, two adjacent JFFS2 partitions read as two separate filesystems, U-Boot environment and Belkin NVRM stores listed as single-file volumes (`uboot-env.bin` / `nvram.bin`), correct staging of OneDrive Files On-Demand placeholders, XPRESS-compressed NTFS files, and NTFS-compressed files with early-ending compression units. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ileapp

iLEAPP v2026.4.3

Tue, 29 Sep 2026 03:18:33 GMT

iLEAPP v2026.4.3 adds unified `ileapp` binary for all platforms, E01/AFD/APFS image support via `-t raw`, and nine new iOS app parsers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Extends `-t raw` to support E01 and Ex01, SMART, AFF and AFD images, Apple disk images (`.dmg`, `.sparseimage`, sparse bundles and segmented sets), encrypted Apple disk images, FTK Imager AD-encrypted images, and encrypted APFS volumes (opened with a supplied password).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds NTFS alternate data stream reading under `-t raw`. • Adds iOS artifact support for Roblox, KakaoTalk (with message/attachment/phone field decryption and inline media), WeChat, Telekom Mail, BOTIM, VK Messenger, Odnoklassniki, and SimpleX Chat (SQLCipher, keychain key). • Adds iOS Health walking and running distance artifact. • Adds Intelligence Platform artifact family for iOS: knowledge graph, expired interactions, behaviors timeline, and event locations. • Adds Biome sync merged events artifact. • Renames Snapchat Friends to Snapchatter Records and adds friends-list parsing. • Adds Call History columns for iOS 26. • Adds Sysdiagnose Process tree built from `ps.txt`. • Unifies all platform downloads into a single `ileapp` binary: Windows gets `-windows-x64-setup.exe` / `-windows-x64-portable.zip` and `-windows-arm64-setup.exe` / `-windows-arm64-portable.zip`; macOS gets signed and notarised `-macos-arm64.dmg` / `-macos-x64.dmg`; Linux gets `-linux-x64.AppImage` / `-linux-arm64.AppImage`. • Accepts `.tar.xz` archives in the GUI (already supported on the CLI via `-t tar`). • Updates `qnxprobe` to version 1.51. Breaking changes: • The separate `ileappGUI` binary no longer exists; both GUI and CLI are now the single `ileapp` binary (GUI when run without arguments, CLI when run with arguments). Automated tooling that invokes `ileappGUI` must be updated. • Download file names changed: the previous naming scheme (e.g. `ileappGUI-v*-Windows_x86_64.zip`) is replaced by new names such as `-windows-x64-setup.exe`, `-windows-x64-portable.zip`, `-macos-arm64.dmg`, `-linux-x64.AppImage`, etc. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ileapp

iLEAPP v2026.4.2

Sun, 20 Sep 2026 10:51:23 GMT

iLEAPP v2026.4.2 adds sysdiagnose parsing, Snapchat Memories, NTFS/APFS single-pass image reads, and Calculator Vault/Photos media handling.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds initial sysdiagnose parsers, including PowerLog database reads inside packed sysdiagnoses and AppleDouble sidecar filtering from sysdiagnose readers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Reads NTFS and APFS images in one pass with qnxprobe 1.30, replacing the previous multi-pass approach. • Adds Calculator Vault videos as proper media artifacts, looked up in their own album folder. • Reports Photos.sqlite face crops as media instead of a raw report folder path. • Commits the LAVA database once per artifact instead of once per staged file, improving write performance. • Decodes chat type and party from Keyboard Input Contexts identifiers (scoped to the Messenger `_0` form). • Records evidence-relative source paths for directory and single-file inputs. • Deduplicates Mobile Installation log lines reported across multiple files. • Stages zip and tar member names stored more than once as a single file. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ileapp

iLEAPP v2026.4.1

Mon, 14 Sep 2026 20:03:32 GMT

iLEAPP v2026.4.1 upgrades the Apple Unified Logs engine to unifiedlog_iterator v0.7.0 and adds iOS/macOS/tvOS/visionOS/watchOS 26–27 version recognition.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Upgrades the Apple Unified Logs parsing engine to `unifiedlog_iterator` v0.7.0, filling previously empty process paths on Simpledump and Statedump rows and logging the parser version at import time.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds recognition for iOS 26.7, iOS 27.0, macOS 15.8, macOS 26.7, macOS 27.0, tvOS 27.0, visionOS 27.0, and watchOS 27.0 in `apple_build_id_to_os_version.json`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ileapp

iLEAPP v2026.4.0

Sun, 13 Sep 2026 19:30:07 GMT

iLEAPP v2026.4.0 adds `-t raw` for disk images and E01s, F2FS support, and new artifacts for Garmin Connect, Tutanota, MEGA, and SMS previews.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `-t raw` input type to parse raw disk images and E01 acquisitions directly from the CLI.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds F2FS filesystem support via re-vendored qnxprobe 1.28/1.29, enabling raw image parsing of F2FS volumes. • Adds full artifact coverage for Garmin Connect (including the Move IQ activity series) on iOS. • Adds artifact coverage for Tutanota on iOS. • Adds artifact coverage for MEGA cloud storage on iOS. • Adds `apple_sms_preview_ktx_atx` artifact (SMS & iMessage category) to surface Apple SMS preview attachments stored as ATX containers with `.ktx` extensions under `com.apple.MobileSMS/Previews/Attachments/`. • Adds a Shared Name column to the Apple SMS Preview Cache artifact, reporting contact card and location share titles from companion plists. • Expands WhatsApp call record parsing to include additional call record fields on iOS. • Links WiFi network store geotags to their networks through recorded relationships in the WiFi Known Networks artifact. • Names KML placemarks by timestamp in two location artifacts for clearer geographic reporting. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ileapp

iLEAPP v2026.3.3

Tue, 08 Sep 2026 20:07:02 GMT

iLEAPP v2026.3.3 adds 25+ new app parsers including smart home/IoT, crypto, and social apps, plus iOS diagnostic report (.ips) ingestion and MMKV decryption support. • Adds `--emit` flag to `validate_sample_data.py` to generate `sample_data` values directly from a test extraction image. • Adds support for ingesting iOS diagnostic reports (`.ips` files) as a new input format. • Adds a Sysdiagnose Extraction Helper to expand raw forensic input options. • Adds 25+ new app parsers including Nest, August/Yale, Google Home, myQ, Samsung Family Hub, Coinbase Wallet, Spotify, TextNow, Zoom chat, Brave, Notion, GETTR, Houseparty, CoverMe, Skout, Private Photo Vault, IFTTT, LG ThinQ, New York Times, GPS Tracks/GPX, and Foursquare Pilgrim. • Adds MMKV decryption support via a vendored `mmkv_parser`, with correct varint header handling and a new 'MMKV - Recovered Records' artifact. • Reworks the Discord iOS account artifact to read account data directly from its MMKV store. • Adds `Sender`, `Chat Name`, and `Chat Participants` fields to the SMS artifact. • Adds Life360 location samples and motion activity parsed from app logs. • Adds WhatsApp log sessions artifact for iOS. • Adds Signal app launches and call events parsed from iOS debug logs. • Adds Chromium tab restore file parsing on iOS. • Scopes TikTok IM, Pitaya, and WatchHistory artifacts to TikTok-owned containers, preventing false matches from files with identical names in other app containers. • Extends Line messenger to read every database store rather than only the first, and reports orphaned attachments. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ileapp

iLEAPP v2026.3.2

Thu, 27 Aug 2026 19:40:23 GMT

iLEAPP v2026.3.2 adds 13 new app parsers including Amazon Shopping, Google Photos, Netflix, and Firefox for iOS forensic analysis. • Adds Google Calendar, Google Sheets, Google Docs, and Google Maps artifact support for iOS. • Adds Netflix artifact support for iOS, reporting only rows an examiner can act on, including cached stream segments with subtitle cues. • Adds Pinterest artifact support for iOS. • Adds Coinbase artifact support for iOS. • Adds Firefox artifact support for iOS. • Adds Grindr artifact support for iOS, including conversation link counts. • Adds Fitbit artifact support for iOS. • Adds KeepSafe artifact support for iOS: vault items, albums, and account/PIN security. • Adds TeleGuard calls, account, and drafts artifacts for iOS. • Adds container-scoping enforcement for Pinterest, Tinder, and Google Drive/Sheets artifacts, preventing cross-app data bleed. • Reports real device/source paths instead of the examiner's local folder structure, enforced across 83+ modules including Biome, CNA, and Privacy Accounting artifacts. • Adds `admin/scripts/check_artifact_paths.py` CI guard (with `--self-test` and `--list` flags) that fails when an artifact's `paths` tuple contains two patterns differing only in case, wired into the lint workflow. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ileapp

iLEAPP v2026.3.1

Tue, 18 Aug 2026 15:41:51 GMT

iLEAPP v2026.3.1 adds Snapchat, Tinder, TikTok, Reddit, OneDrive, and Google Drive artifacts plus WhatsApp add-on and logarchive dialed-number coverage. • Adds new `logarchive dialed numbers` artifact extracting CommCenter `call.provider` setup/teardown blocks, Call(StatusUpdate) state chains, and `ContactSearchManager` digit-sequence entries from unified log archives. • Adds Snapchat iOS artifacts including Memories Search Index. • Adds Tinder iOS artifacts. • Adds four TikTok artifacts: Watch History, Account, Published Videos, and App Sessions. • Adds Reddit iOS artifacts covering user and subscription data. • Adds OneDrive iOS artifacts. • Adds Google Drive DriveKit artifacts for iOS. • Adds four WhatsApp iOS add-on artifacts: reactions, channel tallies, group events, and membership changes. • Adds Chrome saved credit cards artifact and Chrome payments customer data artifact. • Upgrades Proton Mail Inbox Messages to a conversation view with inline media, adding `remote_conversation_id`, Conversation Subject, From Me direction, and first cached Attachment columns via a `data_views.conversation` block. • Skips Chromium databases that cannot be opened instead of aborting the entire artifact. • Adds GroupMe message deletion state reporting for iOS. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ileapp

iLEAPP v2026.3.0

Fri, 14 Aug 2026 09:22:51 GMT

iLEAPP v2026.3.0 adds Apple Unified Logs, 16+ new artifacts, Telegram/Wickr/Session parsers, and sysdiagnose PowerLog support. • Adds parsing of `*.PLSQL.gz` rotated PowerLog archives (decompressed to a session temp directory, reused across all PowerLog artifacts) alongside `CurrentPowerlog.PLSQL`, with per-archive time-offset correction — extending recoverable history by weeks on most images. • Adds Apple Unified Logs support with the parser bundled into all builds and 16+ new artifacts surfaced from a predicate survey. • Adds Telegram artifacts for iOS: Accounts (from `accounts-metadata/atomic-state` and Postbox `t0`), Contacts & Peers (full `t2` peer dump with avatar images and Spotlight cache), Chats (Postbox chat list), Cached Peer Details (Postbox `t18`), Device Contacts (Postbox `t54`), Peer Presence, and Message Tags. • Adds Wickr artifacts parsed from `wickrLocal.sqlite` and app logs, plus Wickr account identity recovered from the keychain. • Adds Session/Oxen artifacts including decrypted messages, contacts, and attachments. • Adds new app parsers for DuckDuckGo, MEGA, Onion Browser (including Realm-based artifacts via a vendored Realm parser), what3words, Dubox/Terabox, Claude, Apple Intelligence Report, and Lidl Plus (SQLCipher + Keychain). • Adds Biome/SEGB coverage for Networking Edge Selection, DuetExpertCenter notifications, Privacy Accounting streams, and Contact Autocomplete Feedback. • Adds a new CI tripwire guarding against unsupported claim language in artifact documentation. • Adds a CI guard for HTML report injection and remote destinations in generated reports. • Adds CI test coverage for Python 3.13 and 3.14 runtime contract, and Windows/Linux/ARM64 test builds. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ileapp

iLEAPP v2026.2.1

Mon, 27 Jul 2026 12:54:32 GMT

iLEAPP v2026.2.1 adds 60+ Biome streams, full Signal for iOS parsing, expanded keychain handling, and notifications overhaul. • Adds 60+ new Biome artifact streams covering device power/lock state, location visit, app location activity, camera AutoFocus ROI, energy mode, boot session, emergency voice calls, emoji engagement, Device.Timezone, Wallet transactions, Siri Remembers Message/Audio History, Discoverability Signals, Siri UI, Siri suggestions, and a full Apple Intelligence family including Safety Overrides. • New Signal for iOS support: full message and contact parsing, conversation view with attachments, and detection of Signal's timestamped GRDB directories. • Expanded keychain handling: accepts examiner-supplied keychain input, adds a lookup helper, includes a pure-Python SQLCipher reader, supports UFED encrypted keychain dumps, and can reuse a keychain already present in the extraction. • Notifications overhaul: attachments now checked in as media, images embedded in notification payloads recovered, and payload fields split into dedicated columns. • Adds Notes – Password Protected artifact for password hint and recoverability triage. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ileapp

iLEAPP v2026.2.0

Mon, 20 Jul 2026 12:21:49 GMT

iLEAPP v2026.2.0 adds Biome, C2PA AI provenance, and United Airlines artifacts with full iOS 26 and Python 3.13/3.14 support. • Adds 14+ new Biome database artifacts parsing SQLite stores under Library/Biome/databases/ (app openings, cable plug events, backlight events, CarPlay activity, intelligence platform entities, and more). • Adds Biome Set.db artifacts for installed apps and other syncable streams under Library/Biome/sets/. • Adds Biome stream artifacts for harvested mail/messages, reads, screen time, and keyboard data. • Adds C2PA Content Provenance artifact parsing AI-generated image provenance, including signer certificate, signing time, Media State column, and case-insensitive media path matching. • Adds new United Airlines app artifact module extracting travel data from the United Airlines iOS app. • Reworks Photos.sqlite parser with full iOS 26 support, context form, and generator compatibility. • Adds Python 3.13 and 3.14 support. • Expands iOS test corpus coverage to 13 archives spanning iOS 13.3.1 through the latest releases. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ileapp

iLEAPP v2026.1.0

Fri, 10 Jul 2026 22:38:03 GMT

iLEAPP v2026.1.0 adds 10+ new parsers, conversation views, custom artifact paths, and broad LAVA migration. • Adds new parsers for Zalo Chat and Users, Discord cache, Home Depot app, Oura Ring, App Web Usage (Biome), Biome NotificationUsage, springboard wallpaper, Apple ATX image files, iOS Widgets, and keychain artifacts. • Adds conversation views to WhatsApp, Viber, Kik, Slack, Life360, TikTok, Discord, Teleguard, Reddit, LinkedIn, and Telegram. • Adds `--custom_artifacts_path` CLI flag to load artifact modules from an extra folder, enabling third-party or case-specific parsers without modifying the install. • Adds `--custom_output_folder` CLI flag to set a custom name for the report output subfolder. • Adds an App Inventory module for parsing-coverage analysis across installed apps. • Expands Telegram messages parser with Chat, Chat ID, Thread ID columns and splits Author into Author (name) and Author ID (user ID). • Migrates dozens of artifact modules (Kik cluster, mobileBackup/Install, notifications, geod, Safari cluster, Slack, ChatGPT, Life360, mailprotect, photos, iCloud cluster, Proton Mail, SIM info, and more) to the LAVA `@artifact_processor` decorator, standardizing UTC timestamps and relative source paths. • Full refactor of Swarm (Foursquare) and Waze iOS parsers with expanded data extraction and accuracy fields. • Adds SMS `attributedBody` parsing via `pytypedstream` to recover rich-text message content. • Adds LAVA launch actions to the final GUI window for direct post-scan LAVA access. • Migrates UI icons to Tabler webfont-based icons with CSS/dark theme updates for HTML reports. • Enables KML output for coordinate-bearing artifacts. • Adds optional recent app history tracking module (CarPlay recentApphistory). • Converts HEIC map tiles to JPEG in the geodMapTiles module for broader viewer compatibility. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ileapp

iLEAPP v2.5.0

Tue, 26 May 2026 20:57:36 GMT

iLEAPP v2.5.0 adds SVG support, AirBNB conversation views, a rebuilt Swarm parser, and LAVA processed-file tracking. • Adds SVG image type matcher for artifact extraction. • Adds Conversation View functionality to the AirBNB parser for LAVA output. • Rewrites the iOS Swarm parser with a full re-engineering for improved coverage. • Outputs processed files to the LAVA database and run information to the LAVA JSON file. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ileapp

iLEAPP v2.4.0

Mon, 18 May 2026 20:58:27 GMT

iLEAPP v2.4.0 adds Reddit Chat and iOS Cache Locations parsers plus JPEG XL/DDS image support. • New Reddit Chat Parser module extracts and parses Reddit chat data from iOS extractions. • New iOS Cache Locations module surfaces cached location data from iOS artifacts. • Adds JPEG XL and DDS image type matchers, enabling iLEAPP to recognize and process these additional image formats. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ileapp

iLEAPP v2.3.1

Mon, 20 Apr 2026 21:53:00 GMT

iLEAPP v2.3.1 adds 11 new artifact modules including Threema, Discord, Zangi, Apple Maps Trips, and Spotlight Index Cache. • New Spotlight Index Cache module for extracting indexed file metadata. • New Threema messenger parser for chat artifact extraction. • New Discord2026 module for parsing updated Discord artifacts. • New Zangi Messenger parser for call and message artifacts. • New meteoSwiss app module for weather app artifact analysis. • New Apple Maps Trips/Significant Locations parser for movement history. • New batteryBDC module for battery health and charging artifact extraction. • New Box for iOS artifact parser for cloud storage activity. • New Device artifacts module from Find My Friends. • GUI window is now resizable for improved usability on varied screen sizes. • Supports iTunes encrypted backups via Evanole VM. • LAVA output now includes module metadata in `.lava` files. • Modules updated to emit LAVA-compatible output, including Potato Chat and Kleinanzeigen with conversation thread view. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ileapp

iLEAPP v2.3.0

Sun, 31 Aug 2025 20:55:01 GMT

iLEAPP v2.3.0 adds iTunes encrypted backup support, Unified Logs artifacts, and six new app parsers with ~20x faster media lookup. • Supports iTunes encrypted backups natively, enabling direct processing without manual decryption. • New Unified Logs (logarchive) artifacts expand Apple system log analysis coverage. • Adds progress and status count to console output for real-time processing visibility. • Media file lookup is approximately 20x faster, enabling practical use on large datasets. • New Sysdiagnose module parses sysdiagnose archives including Account Devices and Mobile Installation Logs. • New AMDSQLiteDB parser module extracts Apple Mobile Device data. • New Airbnb messages artifact parser. • New Potato Chat parser module. • New CashApp parser module. • New User Defaults parser module. • Modules updated for LAVA output compatibility. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ileapp

iLEAPP v2.2.0

Mon, 19 May 2025 08:24:28 GMT

iLEAPP v2.2.0 adds Apple Unified Log processing, agency logo branding, hardlinked media, and a Biome keybag module. • Adds processing of Apple Unified Logs (logarchive.json parser) for timeline analysis of iOS log archives. • Enables embedding a custom agency logo in HTML reports via case data settings. • Supports hardlinks for media files in HTML reports, reducing storage duplication. • New Biome keybag module for parsing iOS Biome keybag artifacts. • Booking and burnerCache modules updated with LAVA output support. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ileapp

iLEAPP v2.1.3

Fri, 25 Apr 2025 19:51:33 GMT

iLEAPP v2.1.3 adds a new storeUser parser and enhances Voicemail, Discord, and WithingsHealthMate modules. • Enhanced Voicemail module with additional artifact coverage. • Enhanced Discord module with updated parsing support. • WithingsHealthMate module updated to support LAVA output format. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ileapp

iLEAPP v2.1.2

Thu, 10 Apr 2025 17:49:59 GMT

iLEAPP v2.1.2 adds Kleinanzeigen.de, Apple WorldClock, and BeReal parsers plus new GUI keyboard shortcuts. • New artifact parser for Kleinanzeigen.de (German classifieds app), extracting messages and message direction. • New parser for Apple WorldClock app data. • New parser for BeReal app artifacts. • Adds WhatsApp mono module for WhatsApp artifact extraction. • Adds metadata extraction from forwarded messages, including links and attachments. • New GUI keyboard shortcuts: Ctrl+I focuses the Input File field, Ctrl+O focuses the Output File field, Ctrl+F focuses the Filter field. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ileapp

iLEAPP v2.1.0

Sun, 16 Feb 2025 16:36:48 GMT

iLEAPP v2.1.0 adds GUI module filtering, a pre-release media manager for LAVA, and new forensic modules including call history group calls and Apple Clock stopwatch/timer artifacts. • Adds GUI module filter to quickly select or deselect analysis modules before a run. • Introduces pre-release Media Manager for LAVA, enabling media artifact handling and export across modules (voicemail, address book, app snapshots). • New Call History Group Call module extracts group call records from iOS call history. • Enhances Apple Clock artifacts with new Stopwatch and Timer artifact extraction. • Adds support for the updated Photos.sqlite database schema with report icons. • Updates Health module with expanded artifact coverage. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ileapp

iLEAPP v2.0.4

Tue, 28 Jan 2025 22:32:52 GMT

iLEAPP v2.0.4 adds a Calculator# app artifact parser and refreshes the HTML report with a new icon and logo. • New artifact parser for the Calculator# application. • Updated HTML report with a new icon and logo. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ileapp

iLEAPP v2.0.3

Thu, 16 Jan 2025 17:15:34 GMT

iLEAPP v2.0.3 adds Foursquare Swarm artifact support and expands LAVA output to Wire, Splitwise, and Google Translate modules. • Adds Foursquare Swarm artifact parser for extracting location check-in data from iOS devices. • Adds LAVA output support to Wire, Splitwise, and Google Translate modules. • Improves KML generation in ilapfuncs.py for richer geolocation artifact output. • Updates build IDs database with expanded iOS version coverage. • Updates fsCachedData.py with new artifact handling improvements. • Updates Files app parser (filesApp.py) with LAVA output support. Breaking changes: • The `does_table_exist` function is renamed to `does_table_exist_in_db`; any custom modules or scripts calling `does_table_exist` will break. • The `does_view_exist` function is renamed to `does_view_exist_in_db`; any custom modules or scripts calling `does_view_exist` will break. • The `version` field is removed from `artifact_v2` and replaced with `last_update_date`; any downstream tooling reading the `version` field from artifact metadata will break. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ileapp

iLEAPP v2.0.2

Sun, 15 Dec 2024 20:34:36 GMT

iLEAPP v2.0.2 adds PayByPhone parsing, Trusted Peers DB, call history temp merging, and new SQLite/file helper APIs • Adds new get_sqlite_db_records(path, query) function in ilapfuncs.py for streamlined SQLite querying across modules • Adds new `get_file_path` function in ilapfuncs.py for safer artifact file resolution • Adds PayByPhone module to parse parking payment app artifacts • Adds Trusted Peers Database module for parsing iCloud trust relationship data • Merges callHistoryTemp artifacts into the main callHistory module, surfacing temporary call history records alongside permanent ones • Adds iOS-version-aware file detection to select the correct artifact file based on the device's iOS version • Improves `kmlgen` function with enhanced KML generation capabilities for location artifact mapping • Adds admin scripts to audit and verify which modules parse SQLite databases Breaking changes: • `filesApps.py` is renamed to `filesApp.py` — any external scripts or references pointing to `filesApps.py` will break. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ileapp

iLEAPP v2.0.1

Wed, 20 Nov 2024 16:55:39 GMT

iLEAPP v2.0.1 adds LAVA output across modules, artifact icons, new plist helpers, subscriber info module, and expanded GeoD map tile support. • Adds LAVA output format support across numerous modules including health, knowledgeC, Chrome, CarCD, and others. • Adds `artifact_icon` support in the Artifact Info Block Structure for richer LAVA output. • Adds new `subscriberInfo` module to extract subscriber/SIM identity data. • Adds plist handling helper functions in `ilapfuncs.py` for module authors. • Expands GeoD Maptiles module to support the Tiles table with updated LAVA output. • Merges WatchSleepData into the health module and merges Ph99SystemVersionPlist into lastBuild for consolidated reporting. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ileapp

iLEAPP v2.0.0

Thu, 07 Nov 2024 13:05:34 GMT

iLEAPP v2.0.0 adds LAVA output support, new artifact parsers, redesigned HTML report structure, and a module test harness. • Adds LAVA (Latent Evidence Analysis) structured output across modules, enabling integration with the LAVA forensic platform. • New HTML report folder structure reorganizes output for easier navigation. • New artifact parser for LinkedIn app data. • New artifact parser for Apple Wallet nano passes. • New module for WebKit storage artifacts. • New Spotlight Search Engagements module. • Adds Apple Maps last activity camera artifact parsing. • Adds ApplicationState artifact parsing. • Adds AppConduit and TCC LAVA-compatible artifact support. • Embeds the ccl-segb library for parsing Segmented Binary format artifacts (used in Biomes and other Apple frameworks). • Adds LAVA output support for Biomes artifacts. • Adds LAVA output support for Control Center artifacts. • Adds LAVA output for Data Usage and system shutdown artifacts. • Introduces a Module Info Script for inspecting module metadata. • Introduces a Filepath Search Script for querying which modules target specific file paths. • Introduces a module test harness for validating parsers against test data. • Files processed are now logged only when running in research mode, reducing noise in standard runs. • HTML report now shows source file path as the filename and adds source file path tooltip in DeviceInfo.html. Breaking changes: • The airtags module file is renamed from `airtags.py` to `findMyItems.py`; any external references or scripts invoking the old filename will break. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ileapp

iLEAPP v1.19.5

Thu, 03 Oct 2024 13:03:12 GMT

iLEAPP v1.19.5 adds Apple Watch sleep data, Identity Lookup Service, Withings Health Mate, Oops app, and Brave Browser artifact support. • New `WatchSleepData.py` module extracts Apple Watch sleep data artifacts. • New `Identity Lookup Service` artifact parser added for iOS forensic analysis. • New `mobileInstallb.py` module for mobile installation artifact parsing. • Adds support for the Withings Health Mate app artifacts. • Adds support for Brave Browser by including its artifact locations in Chrome artifact parsing. • New 'Oops: Make New Friends' app artifact parser added. • Updated TikTok parser now includes replied/referenced artifact extraction. • Updated ChatGPT artifact parser with expanded coverage. • Updated Burner app artifact parser. • Adds 'Close logs' button in the GUI after processing completes. • HTML report now displays the loaded profile. • Windows binaries now include version metadata via `file_version_info.txt`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ileapp

iLEAPP v1.19.4

Thu, 11 Jul 2024 15:51:26 GMT

Adds parsers for Watch Worn Data, AudiTripData, cloudkit cache, Booking.com, accountsd/Assetsd cloudServiceEnableLog, and iOS18 Photos.sqlite support. • Adds new `Watch Worn Data.py` parser to extract wearable activity data. • Adds new `audiTripdata.py` parser for Audi trip information. • Adds new `cloudkit cache` parser for iCloud synchronization data. • Adds new `Booking.com - Hotels & Travel` parser for travel bookings. • Adds parsers for `accountsd` and `Assetsd cloudServiceEnableLog.plist` files. • Adds support for `mbdb` manifests to enable old iTunes backup analysis. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ileapp

iLEAPP v1.19.3

Thu, 02 May 2024 10:48:39 GMT

Adds parsing for Uber Locations, Uber Places, Splitwise data, and Zangi chats. • Adds `uber_locations` parser to extract Uber location history from device backups • Adds `uber_places` parser to extract saved Uber places from device backups • Adds `splitwise` parser to extract Splitwise expense data from device backups • Adds `zangi` parser to extract Zangi chat histories from device backups Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ileapp

iLEAPP v1.19.1

Sat, 23 Mar 2024 18:11:59 GMT

Adds parsers for Teleguard, Life360, Wire, SiriRemembers, ChatGPT, iOS Burner; Load/Save Case Data in CLI/GUI; new Tkinter GUI. • `Load` and `Save` Case Data file support added to both the GUI and the CLI. • Adds Teleguard support parser. • Adds Life360 Log Parser. • Adds basic support for Wire Messenger. • Adds SiriRemembers parser (new `SiriRemembers.py` module). • Adds ChatGPT parser. • Adds iOS Burner parser. • New Tkinter Graphical User Interface replaces the previous GUI implementation. • Supports multiple plugin names in one module via `ileappGUI.py`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ileapp

iLEAPP v.1.18.7

Sun, 03 Dec 2023 22:48:51 GMT

iLEAPP v1.18.7 adds artifact parsers for MetaMask, AshHistory, Secret Calculator, CoreAccessories, Voicemail, Google Chat, Duet locations, Data Usage, iTunes Backup Info, Discord attachments, Twint Prepaid, Line Messenger, and Address Book. • Artifact parser for MetaMask • Artifact parser for AshHistory (`AshHistory.py`) • Artifact parser for Secret Calculator artifacts • Artifact parser for Core Accessories • Artifact parser for Voicemail • Artifact parser for Google Chat (iOS) • Artifact parser for Duet locations • Artifact parser for Data Usage • Artifact parser for iTunes Backup Info (`iTunesBackupInfo.py`) • Discord attachment support in the Discord artifact parser • Artifact parser for Twint Prepaid • Basic support for Line Messenger • New Address Book parser Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ileapp

iLEAPP v1.18.7

Tue, 23 May 2023 02:39:45 GMT

Adds FitnessWorkoutsLocationData detection and updates builds_id/biomeIntents parsers in iLEAPP v1.18.7 • Adds `FitnessWorkoutsLocationData` parser for iOS forensic artifacts • Updates `builds_ids.py` for improved system version identification • Updates `biomeIntents.py` parser logic Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ileapp

iLEAPP v1.18.6

Tue, 16 May 2023 23:13:33 GMT

Adds parsers for Gmail, Chrome, Hikvision, Dahua DMSS, and Telegram; HTML reports now include case data. • Ports Chrome parser from ALEAPP to iLEAPP for browser forensics • Introduces Hikvision App's Parser for CCTV and IoT device data • Introduces Dahua Technology (DMSS) CCTV & IoT Parser for surveillance data • Adds Telegram messages parser for encrypted chat extraction • Adds case data support to the generated HTML report output Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ileapp

iLEAPP v.1.18.1

Thu, 03 Nov 2022 16:31:47 GMT

iLEAPP v1.18.1 adds parsers for Biome artifacts including Notes and Bluetooth data • Adds support for parsing iOS 'Biome' general artifacts Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ileapp

iLEAPP v.1.18.0

Wed, 19 Oct 2022 17:09:57 GMT

iLEAPP v1.18 adds Biome support, AppIntents parsing, and a new plugin loader. • Adds `Biome` artifact support for location and activity data via the new `biomeHardware.py` and related parsers • Adds `AppIntents` parsing capability for app-specific intent history Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ileapp

iLEAPP 1.17.6

Tue, 28 Jun 2022 00:21:23 GMT

iLEAPP 1.17.6 adds parsers for Viber, Bumble, Gmail, Control Center, AllTrails, Kijiji, and Vipps, plus sidebar toggle UI. • Adds `Viber` parser support including attachment extraction • Adds `Kik` group artifact support (users in groups) • Adds `Bumble` parser support • Adds `Gmail` parser support • Adds `Control Center` and `AllTrails` parser support • Adds `Kijiji Conversations` artifact support • Adds `Vipps` app parser support • Supports `com.apple.wifi.known-networks.plist` • Adds `MapSync` support for map data synchronization • Adds `sidebar toggle` UI feature in the report view Full history on Cyber Toolchain: https://cybertoolchain.io/tools/ileapp