#aleapp — Public Fediverse posts

📱 New post: Every Step You Take, Eight Years Later

Eight years after my original Android UsageStats and Recent Tasks research, the artifacts have changed underneath us:

🧩 Readable XML became two generations of protobuf with tokenized package mappings
🔢 Four headline event types became a vocabulary of 32 values
🔐 Modern UsageStats lives in credential-encrypted /data/system_ce/
🖼️ Snapshot metadata distinguishes a real app thumbnail from a theme-generated substitute

⚠️ Big caveat: ACTIVITY_RESUMED does not mean "the user tapped the app." It means an activity entered the resumed lifecycle state. Notifications, system processes, and configuration changes cause it too.

Current ALEAPP parses all of it, validated across Android 10 through 16 test extractions. Thank you to Jessica Hyde and Sarah Edwards for the research this builds on.

leapps.org/blog-post?post=2026-08-03-android-usagestats-recent-tasks

#DFIR #DigitalForensics #MobileForensics #Android #ALEAPP

🚀 New releases! iLEAPP and ALEAPP both hit v2026.1.0!

Been a while cooking and this one is big. Both tools move to a fresh calendar versioning scheme and land a mountain of work from the community.

What's new across iLEAPP and ALEAPP:

🌋 Massive LAVA migration is essentially complete. Nearly every artifact now runs on the modern processor with UTC timestamps, relative source paths, and consistent metadata.
🆕 New parsers: Zalo, Discord cache, Home Depot, Oura Ring, Biome app usage, HONOR Media Library, Samsung Secure Folder, Rema 1000, and more.
💬 Conversation views added to WhatsApp, Viber, Kik, Slack, Life360, TikTok, Discord, Reddit, Google Messages, and others.
🎨 Visual identity overhaul with Tabler icons and dark theme updates.
🔎 New App Inventory module to show you exactly what is and isn't parsed in an extraction.
🛠️ Tons of stability fixes: pre-1970 timestamps, reserved-word crashes, glob filename resolution, long Windows paths, and packaging.

Huge thank you to everyone who contributed parsers, fixes, and testing. This is what open source forensics looks like when the community shows up.

🔗 Get iLEAPP: https://www.leapps.org/releases#section-ileapp
🔗 Get ALEAPP: https://www.leapps.org/releases#section-aleapp

#DFIR #MobileForensics #DigitalForensics #iOS #Android #FLOSS #iLEAPP #ALEAPP

New applied #DigitalForensics research using #ALEAPP titled: Seeing the Evidence: A Forensic Framework for Analyzing Ray-Ban Meta AI Smart Glasses.

We have reached out to the researchers to see if and when the parser can be merged to #ALEAPP. Good stuff.

👉 Check it out the research here:
https://www.researchgate.net/publication/404038076_Seeing_the_Evidence_A_Forensic_Framework_for_Analyzing_Ray-Ban_Meta_AI_Smart_Glasses

CVE Alert: CVE-2026-40027 - abrignoni - ALEAPP - https://www.redpacketsecurity.com/cve-alert-cve-2026-40027-abrignoni-aleapp/

#OSINT #ThreatIntel #CyberSecurity #cve-2026-40027 #abrignoni #aleapp

🆕 #Android Samsung #Knox (Secure Folder) history log artifact in #ALEAPP.
🪵 SQLite database contains a log of items requested be moved in or out of the secure folder in Samsung Android devices.
👏 Thanks to HSI Digital Forensics Examiner Geovanny Perez for the discovery of this artifact.

#DFIR

#ALEAPP update, new parsers for DuckDuckGo🦆:

🔖Bookmarks
⭐Favorite Sites
🌐Web Browser History
📑Open Tabs
📌Updates to Tab Thumbnails

Big thanks to Damien Attoe for the contributions! #DFIR

Download 🔗: https://github.com/abrignoni/ALEAPP

#ALEAPP got a new release (v3.3.0) a few days ago, check it out. More stuff on the way! #DFIR https://github.com/abrignoni/ALEAPP/releases/tag/v3.3.0

New Bluesky parsers in #ALEAPP for Android #MobileForensics.
💬 Messages
📃 Feed posts
👥 Actors
🔎 Searches
📄 Posts
🔗 Get ALEAPP here: https://buff.ly/3Px6B1L

#DigitalForensics #DFIR

#ALEAPP v3.2.5 out now! #DFIR https://github.com/abrignoni/ALEAPP/releases/tag/v3.2.5

New #ALEAPP release v3.2.4 #DFIR #MobileForensics https://github.com/abrignoni/ALEAPP/releases/tag/v3.2.4

New #ALEAPP #DigitalForensics support added to Android's On-Device Location History.
🙏 Thank you so much Josh Hickman for your #MobileForensics research.
📖 Read the research below to know what important data you can obtain from these Level DB data sources.
🔗 Get ALEAPP here: https://github.com/abrignoni/ALEAPP
🔗 Research article: https://thebinaryhick.blog/2024/06/28/the-green-look-back-androids-on-device-location-history/

New #ALEAPP v3.2.2. has been released! Check out the changelog https://github.com/abrignoni/ALEAPP/releases/tag/v3.2.2

New #ALEAPP v3.2.1 release #DFIR https://github.com/abrignoni/ALEAPP/releases/tag/v3.2.1

New release of #ALEAPP is out #DFIR https://github.com/abrignoni/ALEAPP/releases/tag/v3.1.9

New #ALEAPP parser for #Discord in #Android:
💬 Chats
⏰ Timestamps
📸 URLs for sent/received attachment media
🗃️ Attachment filename
👤 Username
📺 Conversation channel & ID
➕ And more
🔗 Get ALEAPP: https://github.com/abrignoni/ALEAPP
#DigitalForensics #DFIR #MobileForensics

New #ALEAPP artifact for #Android extractions: Libre Torrent
⛈️ Torrent Information
☔ Torrent Fast Resume Information
📝 Infohash, saved path, bencoded data, filenames, statistics, & more
🔗 Get ALEAPP: https://github.com/abrignoni/aleapp

#DigitalForensics #MobileForensics #DFIR

New #ALEAPP #Android native #Airtag following detection artifact
🚨 Airtag Alerts
📶 Airtag Scans
👁️ Passive Scanning State
⏳ Last Scan Timestamp
🙏 Thanks to @joshua_hickman1 for his diligent research
🔗 Read his blog-post here: https://thebinaryhick.blog/2023/08/13/android-airtags-part-ii/
🔗 Get ALEAPP here: https://github.com/abrignoni/ALEAPP
#DigitalForensics #MobileForensics

Firebase Code Messaging.
If you are not looking at these in #Android #DigitalForensics extractions you are missing key data.

Check out this Cellebrite videocast:
https://cellebrite.com/en/episode-22-nothing-to-see-here-i-beg-to-dfir-leveldb-and-android-firebased-cloud-messaging/

Also use #ALEAPP for parsing. Best set of parsers so far:
https://github.com/abrignoni/ALEAPP

New #Android Verizon artifacts in #ALEAPP:
Verizon RDD Analytics - Battery history
📅Time
🎚️Level
🔋Charging
🖥️Screen on
🌡️Temp
🔆Brightness
📍GPS

Verizon RDD Analytics - WIFI
📅Time
🎫Event
📶BSSID + SSID
🌐IP
⌛SessionTime
📊DataTx - DataRx

Thanks to [email protected]
https://github.com/abrignoni/ALEAPP

New cleaned up FCM artifact in #ALEAPP: TikTok Notifications
💬 Replies to comments
🎥 Live Broadcast info
💙 Follows, likes, & mentions
⛏️ Less LevelDB digging for relevant items
➕ More of these types of artifacs planned
🔗 Get it: https://github.com/abrignoni/ALEAPP
#DigitalForensics #DFIR

New detailed FCM artifact in #ALEAPP: Google Search Box
📍 Lat & Long - Approximate location
⛈️ Data from Weather notifications
⛏️ Less LevelDB digging for relevant items
➕ More of these types of artifacs planned
🔗 Get it: https://github.com/abrignoni/ALEAPP

#DigitalForensics #DFIR

New cleaned up FCM artifact in #ALEAPP: Instagram Activity
💬 Direct messages + content
🎥 Live Broadcast info
📹 Video call start & end
⛏️ Less LevelDB digging for relevant items
➕ More of these types of artifacs planned
🔗 Get it: https://github.com/abrignoni/ALEAPP

#DigitalForensics #DFIR

#ALEAPP updates yesterday:

New Parsers:
✅Todoist
🔮 Package Predictions (Samsung)
🐤 Twitter searches

Fixes:
📲 Google Chat
🔋 Turbo battery

Download: https://github.com/abrignoni/ALEAPP

ALEAPP v3.1.8 released!
🙏 Thanks to all the contributors both new and experienced.
👨‍💻 Windows GUI & CMD/Terminal binaries.
🔗 Get #ALEAPP here:
https://github.com/abrignoni/ALEAPP/releases/tag/v3.1.8

#DFIR #DigitalForensics #Android #eDiscovery

#Stark4N6: Gboard and Clipboard History https://www.stark4n6.com/2023/05/gboard-and-clipboard-history.html #DFIR #ALEAPP #FOSS

#iOS #Telegram #DFIR parser for #ALEAPP:
🙏 Thanks to @stek29 for his code
👤 User IDs
📝 Messages
🖼️ Media
↔️ Directionality
🔗 Get ALEAPP: https://github.com/abrignoni/ALEAPP

#DigitalForensics #MobileForensics #InfoSec

Huge #DFIR activity app parsing from Fabian Nunes & team. #ALEAPP support for:
👟 Adidas Running
🎽 Pumatrac
🚶‍♀️ Map My Walk
🏃‍♂️ Runkeeper

More work to be done on these areas.
🤝 Contribute to ALEAPP ⤵️
🔗 Get ALEAPP: https://github.com/abrignoni

New #BitTorrent and #Torrent file artifacts for #ALEAPP:
ℹ️ Torrent Info + Infohash
➕ Torrent Resume Info
📃 BitTorrent client preferences
⬇️ To download list
🔗 Get ALEAPP: https://github.com/abrignoni/ALEAPP

#DFIR #DigitalForensics #Infosec #MobileForensics #Android

Another incredible artifact & cool research by Fabian Nunes for for #ALEAPP: Strava FIT decoding
🛰️ GPS tracks & routes
🔗 Read the description: https://github.com/abrignoni/ALEAPP/pull/349
🔗 Get ALEAPP: https://github.com/abrignoni/ALEAPP

#DFIR #DigitalForensics #Android

New #ALEAPP artifacts for PikPak Cloud:
📜 Historial list of cloud stored files
📝 Thumbnail links remain live even after data deletion. Beware!
⬇️ List of downloded files
⌛ Tons of timestamps & more
🔗 Get ALEAPP: https://github.com/abrignoni/ALEAPP

#DFIR #DigitalForensics #Infosec