#ileapp — Public Fediverse posts

Apple Unified Logs are no longer an edge-case data source.

🔒 Lock/unlock activity
📱 App launches
📶 Connectivity changes
📸 Screenshots
🧭 Navigation

My updated article covers acquisition, macOS 26.4 Info.plist requirements, iLEAPP processing, 132 message predicates across 23 evidentiary themes, and analysis in LAVA/SQLite.

Article + printable guide:
https://leapps.org/blog-post?post=2026-07-29-apple-unified-logs

#DFIR #iOSForensics #DigitalForensics #iLEAPP

🚀 iLEAPP v2026.2.1 is out!

The Biome rabbit hole keeps going deeper. This release adds 60+ new Biome streams:

🔋 Device power and lock state
📍 Location visits and app location activity
📸 Camera AutoFocus ROI
⚡ Energy mode and boot sessions
🚨 Emergency voice calls
😀 Emoji engagement
🧠 A full Apple Intelligence family, including Safety Overrides

Several of those came out of research by the awesome Mattia Epifani. Thank you Mattia!

Also in this release:

💬 Signal for iOS: full message and contact parsing, conversation view with attachments, and detection of Signal's timestamped GRDB directories
🔑 Expanded keychain handling: examiner-supplied keychains, a pure Python SQLCipher reader, UFED encrypted keychain dumps, and reuse of a keychain already carried by the extraction
🔔 Notifications overhaul: attachments checked in as media, embedded payload images recovered, payload fields split into their own columns, and notifications no longer reported three times over

Plus fixes for addressBook column pruning, a MemoryError during HTML report generation, several Timeline issues, and an SMS rendering crash.

Welcome to four first-time contributors: CynthiavDorp, JSap0914, Sanjays2402, and sandrzejewskipl!

🔗 Get iLEAPP: https://www.leapps.org/releases#section-ileapp

#DFIR #MobileForensics #DigitalForensics #iOS #FLOSS #iLEAPP

New iLEAPP parser: the United Airlines iOS app! ✈️

New blog post from the awesome James Habben walking through the research: where the data lived, which rabbit holes were worth chasing, and which ones he left alone.

12 new artifacts in iLEAPP:

👤 Account profile
🧳 Saved travelers and trip passengers
🎫 Trips, boarding passes, and PNR documents
🔎 Booking and flight status searches
📋 Boarding status log
🎬 Inflight entertainment watch history
⌚ Watch complications
💬 iMessage recipients from the app's plugin cache

The traveler/passenger split, the trip JSON mining, and that late-discovered iMessage plugin cache are the fun ones. Read the write-up, it shows the actual thinking, not just the results.

Thank you James!

📖 Read it: https://leapps.org/blog-post?post=united-ios-app-artifacts
🔗 Get iLEAPP: https://www.leapps.org/releases#section-ileapp

#DFIR #MobileForensics #DigitalForensics #iOS #FLOSS #iLEAPP

What? Brigs using an LLM? Yes.

New blog post: The Rules Keep Changing.

I asked Claude to generate a complete iLEAPP artifact on its own, targeting the newly documented SQLite databases in the iOS Biome directory. It came back with fourteen artifacts covering the pre-aggregated Biome databases and the protobuf-based Set.db stores.

All fourteen ran clean on the first full pass. That is 3,668 rows of previously unparsed data.

Was it hands-off? No, and that is exactly the point. The LLM wrote the code. The examiner owned the verification. I reviewed every schema, checked the timestamp conversions, and validated row counts against manual queries. That division of labor is the only version of this workflow I will vouch for.

Coding has been democratized. The days of waiting for a vendor to parse the artifacts you need are ending. But only an expert can and should be generating code with LLMs for casework, because only an expert can verify every output.

Big thanks to the awesome Charlie Rubisoft, whose Biome research made this possible, and to John Hyla, Geraldine Bly, and Alex Caithness for the SEGB work that started this whole thread.

The rules keep changing. Keep up.

📖 Read it: https://leapps.org/blog-post?post=2026-07-11-the-rules-keep-changing

#DFIR #MobileForensics #DigitalForensics #iOS #FLOSS #iLEAPP

🚀 New releases! iLEAPP and ALEAPP both hit v2026.1.0!

Been a while cooking and this one is big. Both tools move to a fresh calendar versioning scheme and land a mountain of work from the community.

What's new across iLEAPP and ALEAPP:

🌋 Massive LAVA migration is essentially complete. Nearly every artifact now runs on the modern processor with UTC timestamps, relative source paths, and consistent metadata.
🆕 New parsers: Zalo, Discord cache, Home Depot, Oura Ring, Biome app usage, HONOR Media Library, Samsung Secure Folder, Rema 1000, and more.
💬 Conversation views added to WhatsApp, Viber, Kik, Slack, Life360, TikTok, Discord, Reddit, Google Messages, and others.
🎨 Visual identity overhaul with Tabler icons and dark theme updates.
🔎 New App Inventory module to show you exactly what is and isn't parsed in an extraction.
🛠️ Tons of stability fixes: pre-1970 timestamps, reserved-word crashes, glob filename resolution, long Windows paths, and packaging.

Huge thank you to everyone who contributed parsers, fixes, and testing. This is what open source forensics looks like when the community shows up.

🔗 Get iLEAPP: https://www.leapps.org/releases#section-ileapp
🔗 Get ALEAPP: https://www.leapps.org/releases#section-aleapp

#DFIR #MobileForensics #DigitalForensics #iOS #Android #FLOSS #iLEAPP #ALEAPP

New blog post on leapps.org: how to write an artifact module for iLEAPP (and ALEAPP, RLEAPP, and VLEAPP — same process, different repo).

A module is one Python file. The framework handles the rest. The guide covers structure, SQLite and plist parsing, timestamps, LAVA conversation view, and a full working example you can copy and adapt.

👉 https://leapps.org/blog-post?post=2026-06-14-how-to-write-an-ileapp-module

#DFIR #MobileForensics #iLEAPP #OpenSource #DigitalForensics

🆕 New blog post on Apple Unified Logs (iOS) and how to query them effectively.
🪵 Learn how to generate a .logarchive using a macOS device, third-party tools, or straight from files in a full file system extraction.
🪵 Use a macOS device to convert the .logarchive into a JSON file for use outside of a macOS environment.
🪵 Process the JSON file with iLEAPP in order to query the data using SQLite.

If you are not looking at unified logs you are missing incredibly valuable evidence in your cases.

Thanks to the following researchers for their invaluable contributions:
🙏 Lionel Notari
🙏 Tim Korver
🙏 Johann POLEWCZYK
🙏 Heather Charpentier

Read the blog post here:

https://abrignoni.blogspot.com/2025/05/extraction-processing-querying-apple.html

#DigitalForensics #DFIR #MobileForensics #UnifiedLogs #AppleForensics #iOSForensics #iLEAPP
#DigitalForensics

How to install and run #iLEAPP on your computer or using the Atrio MK II from Arcpoint Forensics.

https://www.arcpointforensics.com/news-1/ileapp

#DFIR #DigitalForensics #MobileForensics

New #iLEAPP 2.1.0 release is out! #DFIR https://github.com/abrignoni/iLEAPP/releases/tag/v2.1.0

New #iLEAPP v2.0.4 is out, check those GUI updates! #DFIR https://github.com/abrignoni/iLEAPP/releases/tag/v2.0.4

Hey wake up, a new #iLEAPP release is out! https://github.com/abrignoni/iLEAPP/releases/tag/v2.0.2

#iLEAPP v2.0.1 out now! #DFIR https://github.com/abrignoni/iLEAPP/releases/tag/v2.0.1

#iLEAPP v2.0.0 out now #DFIR #MobileForensics https://github.com/abrignoni/iLEAPP/releases/tag/v2.0.0

New #iLEAPP release v1.19.5 too #DFIR #MobileForensics https://github.com/abrignoni/iLEAPP/releases/tag/v1.19.5

#iLEAPP Update: @kalinko added Withings Healthmate parsers! #DFIR

Download 🔗: https://github.com/abrignoni/iLEAPP

Research 🔗: https://bebinary4n6.blogspot.com/2024/09/withings-healthmate-on-ios.html

🗽Monumental #digitalforensics work by Scott Koenig implementing his well researched photos.sqlite queries into #iLEAPP artifacts.

🙇The blog post details the paths, artifact name descriptor, & data the artifact provides. Amazing work.

🔗Get iLEAPP here:
https://github.com/abrignoni/iLEAPP

🔗Read the blog post here:
https://theforensicscooter.com/2024/05/18/ileapp-parsers-photos-sqlite-queries/

New #iLEAPP v1.19.3 has been released! Check out the changelog https://github.com/abrignoni/iLEAPP/releases/tag/v1.19.3

🚨 New parsers alert! @DFIR_skoenig just contributed a bunch of Photos parsers for #iLEAPP https://github.com/abrignoni/iLEAPP

New #iLEAPP parsers for Splitwise:
💵 Expense Balances
💵 Expenses
👥 Groups
🔔 Notifications
💱 Total Balances
👤 Users/Friends

Download🔗: https://github.com/abrignoni/iLEAPP

More #ileapp parsers coming soon, blog to follow

New #iLEAPP v1.19.1 release #DFIR https://github.com/abrignoni/iLEAPP/releases/tag/v1.19.1

New iLEAPP parser: Keyboard Usage Stats

- Counts for words typed
- Counts for words autocorrected
- Counts for words from candidate bar
And more! #DFIR #FOSS #iLEAPP

Download: https://github.com/abrignoni/iLEAPP

I recently added parsers to account for shutdown log information from Sysdiagnose logs #DFIR #iLEAPP

Download 🔗: https://github.com/abrignoni/iLEAPP

New #DigitalForensics blog-post on cacheV0.db in #iOS devices.

📱 SQLite database keeps thumbnail images of app rendered media.

❌ Could contain images that were deleted from the app.

🤝 #iLEAPP support for the artifact here: https://github.com/abrignoni/iLEAPP

🔗 Read the post here: https://abrignoni.blogspot.com/2024/02/what-is-cachev0db-and-why-are-there.html

New SEGB artifacts from #iOS devices in #iLEAPP:
✈️ Airplane Mode
📶 WiFi connections with connecting device name.
🔗 Get iLEAPP: https://github.com/abrignoni/iLEAPP

#DigitalForensics #MobileForensics #DFIR

Updated #iOS SEGB Safari artifact support in #iLEAPP:

☝ First iLEAPP artifact to support SEGB v2 from iOS 17.
✌️ Supports SEGB v1 & v2.
🛠️ Additional SEGB v2 support incoming in other artifacts.
🙏 Thanks to CCL Solutions Group & Alex Caithness for providing the library to the #DigitalForensics community.
🔗 Get iLEAPP here: https://github.com/abrignoni/iLEAPP

New #iLEAPP artifact for iOS #DigitalForensics: Sync.db

💻 See what Apple devices are under the same account.

📱 Track /Biome/SEGB remote activity to a specific remote device.

🙏 Thanks to Johann POLEWCZYK for keeping the updated Apple model list in iLEAPP which is used to match the model number to the descriptive text.

🔗 Get iLEAPP here: https://github.com/abrignoni/iLEAPP

🐍 New Python parsers for Apple SEGB versions 1 & 2 file formats by Alex Caithness and CCL Solutions Group. Will be updating #iLEAPP soon to support both formats.

📚 These data structures are found in iOS and macOS operating systems. SEGB v2 are found on the latest versions of these operating systems.

🔎 Important note: If you expect Protobuf as the data payload (it usually is) make sure to skip the first 8 bytes before decoding a SEGB v2 file. See line 17 in the attached image.

ℹ Notice how the script provides the offset, metadata offset, and timestamp along with the data.

📎 Get the code here: https://github.com/cclgroupltd/ccl-segb

📖 Thanks to Cellebrite for the file format research found here: https://cellebrite.com/en/understanding-and-decoding-the-newest-ios-segb-format/

#DigitalForensics #MobileForensics #iOSForensics #SEGB #DFIR

Made the timestamp in the referenced #iLEAPP report to UTC as it should.
If all goes well James Habben has some really cool stuff coming in regards to timezone offsets and other record representations in the HTML report.

Will be actively working on the items mentioned in Mattia's blogpost.
🔗 Read the blog here:
https://blog.digital-forensics.it/2023/10/ios-15-image-forensics-analysis-and.html

#DigitalForensics #DFIR #iOS #MobileForensics

#iLEAPP - Media Playing update for #iOS
🙏 Thank you Johann for helping the community out. Incredibly grateful for all the parsers you update and the new ones you share.

🔗 Get iLEAPP here:
https://github.com/abrignoni/iLEAPP

#DigitalForensics #MobileForensics #DFIR #FOSS #FLOSS #iOS #Python