#LEAPPs
LightNews LightNews
stark4n6.bsky.social
The App Is Gone. The Story Isn't. #LEAPPs #DFIR #MobileForensics leapps.org/blog-post?po...
The App Is Gone. The Story Isn't. — LEAPPs Blog
A current app list answers one question. Installation logs, App Store databases, Biome streams, and deletion records answer several others. We went back to an iOS workflow from 2018, tested it from iO...
leapps.org
August 26, 2026 at 3:21 PM
abrignoni.com
All five LEAPPs just went v2026.3.0. LAVA v0.15.0. Same day.

iLEAPP: Apple Unified Logs bundled in every build ALEAPP: Signal with full SQLCipher decryption DLEAPP: Roblox and Telegram Desktop

leapps.org/releases
August 15, 2026 at 12:29 AM
abrignoni.com
A decent version of most #DFIR software can now be made at home, in a few hours, by someone who does not code.

So what makes anyone an expert now? Five qualities, and "has access to #AI" is not one.

leapps.org/blog-post?po...
Using AI Effectively in Digital Forensics — LEAPPs Blog
A decent version of most digital forensics software can now be made at home, in a few hours, by a user that does not code. What does that mean for vendors and for us as users, and what actually makes ...
leapps.org
August 7, 2026 at 7:24 PM
abrignoni.com
📱 Eight years after my Android UsageStats posts, the XML became protobuf, 4 event types became 32, and ALEAPP now parses all of it.

⚠️ ACTIVITY_RESUMED is not "the user tapped the app." It is a lifecycle state.

leapps.org/blog-post?post=2026-08-03-android-usagestats-recent-tasks

#DFIR
Every Step You Take, Eight Years Later: Android UsageStats and Recent Tasks — LEAPPs Blog
Android's pattern-of-life evidence grew from readable XML into tokenized protobufs carrying app lifecycle, lock state, notifications, services, task roots, and more. We went back to the source, update...
leapps.org
August 4, 2026 at 4:03 AM
abrignoni.com
Every Apple Unified Log predicate iLEAPP searches for, artifact by artifact.

34 artifacts, 230 predicates, each sourced and validated against real iOS extractions. Free, PDF included. #DFIR

leapps.org/blog-post?po...
Apple Unified Log Predicates in iLEAPP: The Reference — LEAPPs Blog
Every Unified Log message predicate iLEAPP searches for, artifact by artifact, with the processes involved, the iOS versions each pattern was observed on, the sources that documented them, and the cav...
leapps.org
August 2, 2026 at 4:39 AM
abrignoni.com
Apple Unified Logs may reveal locks, app launches, connectivity changes, screenshots, navigation, and more.

Updated: acquisition, iLEAPP processing, 132 message predicates, and LAVA/SQLite analysis.

leapps.org/blog-post?po...

#DFIR #iOSForensics
Extracting, Processing, and Querying Apple Unified Logs from an iOS Device — LEAPPs Blog
Apple Unified Logs can show locks, app launches, connectivity, navigation, and more. Here is the updated workflow for acquiring them, processing them with iLEAPP, and working the results in LAVA.
leapps.org
July 29, 2026 at 8:36 PM
abrignoni.com
New on the LEAPPs blog. ⚙️

astc_decomp_faster now builds on Python 3.13 and 3.14, every platform, including Apple Silicon. That unblocks the LEAPPs on the latest Python

A great deep-dive from Bruno Constanzo on ASTC, Cython, and bugs. #DFIR

leapps.org/blog-post?post=2026-07-22-astc-cython-and-bugs
ASTC, Cython, and bugs! — LEAPPs Blog
What do texture decompression, C-extensions for python, and LEAPPs have in common? Read to find out!
leapps.org
July 22, 2026 at 2:28 AM
abrignoni.com
New LEAPPs feature highlight! ✨

Run a parser and lose track of the output folder? LAVA now shows your recent iLEAPP, ALEAPP, RLEAPP, and VLEAPP runs right on the welcome screen. Opt-in by design.

Nice work by the awesome James Habben.

leapps.org/blog-post?post=feature-leapps-recent-run-history
Feature Highlight: Recent Run History in LAVA — LEAPPs Blog
A quick look at the new opt-in LEAPPs recent run history feature and how LAVA can use it to put recent parser outputs right on the welcome screen.
leapps.org
July 21, 2026 at 5:42 AM
stark4n6.bsky.social
A Trip Through the United iOS App #LEAPPs #iLEAPP #DFIR #MobileForensics leapps.org/blog-post?po...
A Trip Through the United iOS App — LEAPPs Blog
A look at United Airlines iOS app research in iLEAPP, including where the data lived, which rabbit holes mattered, and why nearby app/plugin data can change the shape of the parser.
leapps.org
July 17, 2026 at 4:07 PM
abrignoni.com
New iLEAPP parser: the United Airlines iOS app! ✈️

Trips, boarding passes, saved travelers, booking searches, inflight watch history, even iMessage recipients from a plugin cache. 12 artifacts.

Great write-up from the awesome James Habben. #DFIR

leapps.org/blog-post?post=united-ios-app-artifacts
A Trip Through the United iOS App — LEAPPs Blog
A look at United Airlines iOS app research in iLEAPP, including where the data lived, which rabbit holes mattered, and why nearby app/plugin data can change the shape of the parser.
leapps.org
July 16, 2026 at 10:40 PM
abrignoni.com
Photos.sqlite in LAVA! 📸
The full Photos.sqlite parser family in iLEAPP, 42 artifacts, now in LAVA. Assets, locations, GenAI images, faces, shared albums, iOS 14-26.
Data heavy reports crash HTML output. LAVA does not.
Massive work by the awesome Scott Koenig.
leapps.org/releases#section-ileapp
Releases — LEAPPs
Download the latest releases of iLEAPP, ALEAPP, RLEAPP, VLEAPP, and LAVA — free open-source digital forensics tools.
leapps.org
July 16, 2026 at 3:34 AM
abrignoni.com
Busy stretch on the LEAPPs blog, a lot of it about AI in forensics:

🪔 Be Careful What You Wish For
🖼️ Spotting AI Generated Images in iLEAPP and ALEAPP
🧬 The Rules Keep Changing

All free and open source.

leapps.org/blog
Blog — LEAPPs
Forensics deep dives, tool updates, artifact write-ups, and community contributions from the LEAPPs project.
leapps.org
July 16, 2026 at 2:31 AM
abrignoni.com
We are implementing AI in digital forensics wrong

A technology that works like a genie: make a wish, the genie provides. What is not to like?

Plenty. New post on wishes, monkey's paws and the one thing the genie can never grant you
leapps.org/blog-post?post=2026-07-12-be-careful-what-you-wish-for
Be Careful What You Wish For — LEAPPs Blog
The genie can grant almost anything. It cannot grant you judgment. And judgment is the one thing you need in order to control it.
leapps.org
July 14, 2026 at 1:51 AM
abrignoni.com
🚨 RELEASE THE LEAPPS! 🚨
New parsers, better timelines, AI-content flags, cleaner reports. All free, all open source.
🔗 Get them: leapps.org/releases
It's alive!!! #DFIR #MobileForensics #MobileForensics
July 13, 2026 at 11:00 AM
abrignoni.com
New in iLEAPP and ALEAPP: flag AI generated images! 🤖

The new C2PA Content Provenance artifact reads AI provenance two ways:
🧬 C2PA Content Credentials
🏷️ IPTC Digital Source Type (XMP)
🐍 Pure Python

Merged now, run from source today. 🔗 leapps.org/blog-post?po...

#DFIR #FLOSS #DigitalForensics
Spotting AI Generated Images in iLEAPP and ALEAPP — LEAPPs Blog
iLEAPP and ALEAPP can now flag AI generated images by reading content provenance two ways, C2PA Content Credentials manifests and the IPTC Digital Source Type in XMP. Pure Python, no new…
leapps.org
July 12, 2026 at 5:57 PM
abrignoni.com
What? Brigs using an LLM? Yes.

I had Claude generate a complete iLEAPP artifact for the new iOS Biome SQLite databases. 14 artifacts, 3,668 rows, clean first pass.

The LLM wrote the code. The examiner owned the verification.

leapps.org/blog-post?post=2026-07-11-the-rules-keep-changing
The Rules Keep Changing — LEAPPs Blog
The first fully LLM-generated set of artifacts lands in iLEAPP: fourteen Biome parsers built from public community research and test data, 3,668 rows of previously unparsed data on the first clean pas...
leapps.org
July 12, 2026 at 2:55 PM
abrignoni.com
🔎 New on the LEAPPs Artifact Browser: click "samples" on any parser to see the test images it was validated against, with row counts.

Knowing what a tool was tested against is the work, not a nice to have.

leapps.org/artifacts

#DFIR
Artifacts — LEAPPs
Browse all artifacts supported by iLEAPP, ALEAPP, RLEAPP, and VLEAPP.
leapps.org
July 12, 2026 at 2:34 PM
phillmoore.bsky.social
Week 28 - 2026 #DFIR
thisweekin4n6.com/2026/07/12/w...
Week 28 – 2026
If your organisation is interested in sponsoring an upcoming post then reach out via the contact form!No sponsor this week Forensic Analysis Alexis Brignoni at LEAPPs Blog The Apps We Are Not Parsi…
thisweekin4n6.com
July 12, 2026 at 7:35 AM
abrignoni.com
🚀 iLEAPP + ALEAPP v2026.1.0 are out!

New calendar versioning, the LAVA migration essentially complete, Tabler icons, and fresh parsers: Oura Ring, Zalo, Home Depot, HONOR, Samsung Secure Folder, plus new conversation views.

🔗 leapps.org/releases

#DFIR #MobileForensics
Releases — LEAPPs
Download the latest releases of iLEAPP, ALEAPP, RLEAPP, VLEAPP, and LAVA — free open-source digital forensics tools.
leapps.org
July 11, 2026 at 4:07 AM
abrignoni.com
Which apps are the LEAPPs NOT parsing? Batch LEAPP's new --coverage mode measures it against real test images and gives you the gaps ranked by evidence. Snapchat: unparsed in 5 of 5 iPhones, 29k files unread. Full write-up:

leapps.org/blog-post?po...

#DFIR #DigitalForensics #FLOSS #MobileForensics
The Apps We Are Not Parsing (Yet) — LEAPPs Blog
Batch LEAPP now answers a question I have wanted answered for years. Out of all the apps installed on our test devices, which ones do the LEAPPs actually parse, and which ones are we missing? One flag...
leapps.org
July 9, 2026 at 12:10 PM
abrignoni.com
New iLEAPP artifact by James Habben: Home Depot iOS App
Check out the blog post here:
👉 leapps.org/blog-post?po...
Getting It Done with Home Depot iOS Artifacts — LEAPPs Blog
A look at new iLEAPP parsing for the Home Depot iOS app, including account details, store preferences, searches, viewed products, shopping lists, cached location, and a few useful cache artifacts.
leapps.org
July 1, 2026 at 2:45 AM
abrignoni.com
🚨 Introducing Batch LEAPP.
Ever had a folder full of extractions and run them through iLEAPP one at a time? Not anymore. #DFIR

Batch LEAPP points at a directory, finds every extraction inside, and runs iLEAPP, ALEAPP, RLEAPP, or VLEAPP on each one.

🔗 Read the post:
leapps.org/blog-post?po...
Introducing Batch LEAPP — LEAPPs Blog
Batch LEAPP runs any LEAPP tool across an entire folder of extractions and builds one report index that links every result, with hashing and a manifest for your case file. Here is what it does and how...
leapps.org
June 30, 2026 at 2:27 AM
abrignoni.com
🚀 Django Faiola rebuilt the Waze parser for the new iLEAPP framework.
📍 Account details, GPS tracks, search history, recent destinations, favorites, shared locations, planned events, TTS navigation.
🔧 Fully integrated into LAVA too.
🔗 Read the blog post:
djangofaiola.blogspot.com/2026/06/comp...
Releases — LEAPPs
Download the latest releases of iLEAPP, ALEAPP, RLEAPP, VLEAPP, and LAVA — free open-source digital forensics tools.
leapps.org
June 29, 2026 at 3:41 AM
abrignoni.com
🚨 New blog post at LEAPPs.org!
🍺 The LEAPPs and LAVA now install on macOS through Homebrew.
➕ Add the tap and get your digital forensics on.
🙏 Thanks to James Habben for the implementation and post.
👇 Read the blog post here:
leapps.org/blog-post?po...
LEAPPs — Digital Forensics Tools
Free digital forensics tools. iLEAPP, ALEAPP, RLEAPP, VLEAPP, and LAVA — parse and visualize artifacts from iOS, Android, Windows, and more.
LEAPPs.org
June 29, 2026 at 1:01 AM
stark4n6.bsky.social
Decoding Apple ATX Images in #iLEAPP #DFIR leapps.org/blog-post?po...
Decoding Apple ATX Images in iLEAPP — LEAPPs Blog
Wallpaper research led to a broader Apple image-cache problem: ATX texture files. Here is how iLEAPP now parses and decodes many of them, with a reusable parser that should be easy to port into other ...
leapps.org
June 26, 2026 at 4:24 PM