#mobileforensics — Public Fediverse posts
Live and recent posts from across the Fediverse tagged #mobileforensics, aggregated by home.social.
-
📱 New post: Every Step You Take, Eight Years Later
Eight years after my original Android UsageStats and Recent Tasks research, the artifacts have changed underneath us:
🧩 Readable XML became two generations of protobuf with tokenized package mappings
🔢 Four headline event types became a vocabulary of 32 values
🔐 Modern UsageStats lives in credential-encrypted /data/system_ce/
🖼️ Snapshot metadata distinguishes a real app thumbnail from a theme-generated substitute⚠️ Big caveat: ACTIVITY_RESUMED does not mean "the user tapped the app." It means an activity entered the resumed lifecycle state. Notifications, system processes, and configuration changes cause it too.
Current ALEAPP parses all of it, validated across Android 10 through 16 test extractions. Thank you to Jessica Hyde and Sarah Edwards for the research this builds on.
leapps.org/blog-post?post=2026-08-03-android-usagestats-recent-tasks
-
📱 New post: Every Step You Take, Eight Years Later
Eight years after my original Android UsageStats and Recent Tasks research, the artifacts have changed underneath us:
🧩 Readable XML became two generations of protobuf with tokenized package mappings
🔢 Four headline event types became a vocabulary of 32 values
🔐 Modern UsageStats lives in credential-encrypted /data/system_ce/
🖼️ Snapshot metadata distinguishes a real app thumbnail from a theme-generated substitute⚠️ Big caveat: ACTIVITY_RESUMED does not mean "the user tapped the app." It means an activity entered the resumed lifecycle state. Notifications, system processes, and configuration changes cause it too.
Current ALEAPP parses all of it, validated across Android 10 through 16 test extractions. Thank you to Jessica Hyde and Sarah Edwards for the research this builds on.
leapps.org/blog-post?post=2026-08-03-android-usagestats-recent-tasks
-
🚀 iLEAPP v2026.2.1 is out!
The Biome rabbit hole keeps going deeper. This release adds 60+ new Biome streams:
🔋 Device power and lock state
📍 Location visits and app location activity
📸 Camera AutoFocus ROI
⚡ Energy mode and boot sessions
🚨 Emergency voice calls
😀 Emoji engagement
🧠 A full Apple Intelligence family, including Safety OverridesSeveral of those came out of research by the awesome Mattia Epifani. Thank you Mattia!
Also in this release:
💬 Signal for iOS: full message and contact parsing, conversation view with attachments, and detection of Signal's timestamped GRDB directories
🔑 Expanded keychain handling: examiner-supplied keychains, a pure Python SQLCipher reader, UFED encrypted keychain dumps, and reuse of a keychain already carried by the extraction
🔔 Notifications overhaul: attachments checked in as media, embedded payload images recovered, payload fields split into their own columns, and notifications no longer reported three times overPlus fixes for addressBook column pruning, a MemoryError during HTML report generation, several Timeline issues, and an SMS rendering crash.
Welcome to four first-time contributors: CynthiavDorp, JSap0914, Sanjays2402, and sandrzejewskipl!
🔗 Get iLEAPP: https://www.leapps.org/releases#section-ileapp
#DFIR #MobileForensics #DigitalForensics #iOS #FLOSS #iLEAPP
-
🚀 iLEAPP v2026.2.1 is out!
The Biome rabbit hole keeps going deeper. This release adds 60+ new Biome streams:
🔋 Device power and lock state
📍 Location visits and app location activity
📸 Camera AutoFocus ROI
⚡ Energy mode and boot sessions
🚨 Emergency voice calls
😀 Emoji engagement
🧠 A full Apple Intelligence family, including Safety OverridesSeveral of those came out of research by the awesome Mattia Epifani. Thank you Mattia!
Also in this release:
💬 Signal for iOS: full message and contact parsing, conversation view with attachments, and detection of Signal's timestamped GRDB directories
🔑 Expanded keychain handling: examiner-supplied keychains, a pure Python SQLCipher reader, UFED encrypted keychain dumps, and reuse of a keychain already carried by the extraction
🔔 Notifications overhaul: attachments checked in as media, embedded payload images recovered, payload fields split into their own columns, and notifications no longer reported three times overPlus fixes for addressBook column pruning, a MemoryError during HTML report generation, several Timeline issues, and an SMS rendering crash.
Welcome to four first-time contributors: CynthiavDorp, JSap0914, Sanjays2402, and sandrzejewskipl!
🔗 Get iLEAPP: https://www.leapps.org/releases#section-ileapp
#DFIR #MobileForensics #DigitalForensics #iOS #FLOSS #iLEAPP
-
Passware Kit 2026 v3 is here with BitLocker PIN recovery for TPM-protected devices via Magic Drive, expanded file support, enhanced hashcat rules, usability upgrades, and native Apple silicon support in beta. https://www.forensicfocus.com/news/passware-kit-2026-v3-bitlocker-pin-recovery-for-tpm-protected-devices/ #Passware #MobileForensics
-
Mattia Epifani published "84 Streams Later", tracking Apple Biome from iOS 14 through iOS 26 and what it means for examiners.
Community work at its best: he found the streams and shared samples, we wrote and validated the parsers. iLEAPP went from 45 Biome artifacts to 101 in two days.
Where we could check a field against another source on the same device, we did. Call direction against CallHistory, message direction against sms.db, lock state against the DKEvent streams. Where we could not confirm a value, the column says raw and the notes say why.
Run from python code to benefit today. Parsers will be added to the next tool release soon
Free and open source, as always.
Blog: https://blog.digital-forensics.it/2026/07/84-streams-later-exploring-evolution-of.html iLEAPP: https://leapps.org/releases#section-ileapp
-
Mattia Epifani published "84 Streams Later", tracking Apple Biome from iOS 14 through iOS 26 and what it means for examiners.
Community work at its best: he found the streams and shared samples, we wrote and validated the parsers. iLEAPP went from 45 Biome artifacts to 101 in two days.
Where we could check a field against another source on the same device, we did. Call direction against CallHistory, message direction against sms.db, lock state against the DKEvent streams. Where we could not confirm a value, the column says raw and the notes say why.
Run from python code to benefit today. Parsers will be added to the next tool release soon
Free and open source, as always.
Blog: https://blog.digital-forensics.it/2026/07/84-streams-later-exploring-evolution-of.html iLEAPP: https://leapps.org/releases#section-ileapp
-
🌋 LAVA 0.14.0 is out.
Row tagging lands. Tag rows of interest in any artifact table with your own colored tags, add examiner notes, and review everything you flagged from one Tagged Rows hub.Export the tagged set two ways: a self contained HTML report (dark mode, playable media) or a subset LAVA project that reopens in LAVA with media, tags, and a tamper evident provenance record naming its source.
The LEAPP artifact db is opened read only and never written. Tags live in a sidecar SQLite file and each tagged row is anchored with a SHA256 hash.
https://leapps.org/releases#section-lava
#DFIR #DigitalForensics #MobileForensics #OpenSource #InfoSec
-
🌋 LAVA 0.14.0 is out.
Row tagging lands. Tag rows of interest in any artifact table with your own colored tags, add examiner notes, and review everything you flagged from one Tagged Rows hub.Export the tagged set two ways: a self contained HTML report (dark mode, playable media) or a subset LAVA project that reopens in LAVA with media, tags, and a tamper evident provenance record naming its source.
The LEAPP artifact db is opened read only and never written. Tags live in a sidecar SQLite file and each tagged row is anchored with a SHA256 hash.
https://leapps.org/releases#section-lava
#DFIR #DigitalForensics #MobileForensics #OpenSource #InfoSec
-
New iLEAPP artifact: Biome - Device TimeZone, contributed by Cynthia van Dorp.
Starting around iOS 17, the Device.TimeZone biome stream keeps a record of every timezone the device switches into, each entry with a SEGB timestamp. That means a built-in travel timeline: on one of our test images the output showed the device going New York, then Chicago, then Honolulu, then back, all with exact times.
Tested against 8 iOS 17 and 18 images from our corpus before merging. Free and open source, as always.
-
New iLEAPP artifact: Biome - Device TimeZone, contributed by Cynthia van Dorp.
Starting around iOS 17, the Device.TimeZone biome stream keeps a record of every timezone the device switches into, each entry with a SEGB timestamp. That means a built-in travel timeline: on one of our test images the output showed the device going New York, then Chicago, then Honolulu, then back, all with exact times.
Tested against 8 iOS 17 and 18 images from our corpus before merging. Free and open source, as always.
-
Happy to share that ALEAPP now integrates Mister Skinnylegs, the browser artifact framework from Alex Caithness and CCL Solutions Group.
This adds 28 artifacts targeting Chromium-based browsers and webviews on Android: browsing history, Google/Bing/DuckDuckGo searches, local and session storage, and app-specific data from Binance, Coinbase, Discord, ChatGPT, DeepSeek, Dropbox, Google Drive, Reddit and more.
Best part: the artifacts are generated at runtime, so ALEAPP picks up whatever Skinnylegs plugins ship with the version you have installed. Free and open source.
-
Happy to share that ALEAPP now integrates Mister Skinnylegs, the browser artifact framework from Alex Caithness and CCL Solutions Group.
This adds 28 artifacts targeting Chromium-based browsers and webviews on Android: browsing history, Google/Bing/DuckDuckGo searches, local and session storage, and app-specific data from Binance, Coinbase, Discord, ChatGPT, DeepSeek, Dropbox, Google Drive, Reddit and more.
Best part: the artifacts are generated at runtime, so ALEAPP picks up whatever Skinnylegs plugins ship with the version you have installed. Free and open source.
-
New iLEAPP parser: the United Airlines iOS app! ✈️
New blog post from the awesome James Habben walking through the research: where the data lived, which rabbit holes were worth chasing, and which ones he left alone.
12 new artifacts in iLEAPP:
👤 Account profile
🧳 Saved travelers and trip passengers
🎫 Trips, boarding passes, and PNR documents
🔎 Booking and flight status searches
📋 Boarding status log
🎬 Inflight entertainment watch history
⌚ Watch complications
💬 iMessage recipients from the app's plugin cacheThe traveler/passenger split, the trip JSON mining, and that late-discovered iMessage plugin cache are the fun ones. Read the write-up, it shows the actual thinking, not just the results.
Thank you James!
📖 Read it: https://leapps.org/blog-post?post=united-ios-app-artifacts
🔗 Get iLEAPP: https://www.leapps.org/releases#section-ileapp#DFIR #MobileForensics #DigitalForensics #iOS #FLOSS #iLEAPP
-
New iLEAPP parser: the United Airlines iOS app! ✈️
New blog post from the awesome James Habben walking through the research: where the data lived, which rabbit holes were worth chasing, and which ones he left alone.
12 new artifacts in iLEAPP:
👤 Account profile
🧳 Saved travelers and trip passengers
🎫 Trips, boarding passes, and PNR documents
🔎 Booking and flight status searches
📋 Boarding status log
🎬 Inflight entertainment watch history
⌚ Watch complications
💬 iMessage recipients from the app's plugin cacheThe traveler/passenger split, the trip JSON mining, and that late-discovered iMessage plugin cache are the fun ones. Read the write-up, it shows the actual thinking, not just the results.
Thank you James!
📖 Read it: https://leapps.org/blog-post?post=united-ios-app-artifacts
🔗 Get iLEAPP: https://www.leapps.org/releases#section-ileapp#DFIR #MobileForensics #DigitalForensics #iOS #FLOSS #iLEAPP
-
Did you know Samsung's keyboard, Honeyboard, keeps its own clipboard history? Screenshots and all. ALEAPP just got a big upgrade parsing it.
The rebuilt Samsung Honeyboard clipboard artifact now pulls:
⌨️ Clipboard text history (live entries)
🗑️ Deleted clipboard entries recovered from the SQLite WAL, no external tools
🖼️ Clipboard screenshot clips with embedded thumbnails
🕵️ Screenshot source app decoded from Samsung's hidden SEFT trailer
🏷️ Clipboard source app resolved from packages.xml, text or binary ABX on Android 12+
🧩 Dual schema support, old caller_app_uid and new caller_package_name
🕒 UTC timestamps, EXIF capture time, and image dimensionsHeads up: this is not in a tagged release yet. To use it right now you have to run ALEAPP from source. Clone the repo and run it from code, the artifact is already on main.
Big thanks to Al3x101 (MSAB) for the excellent rewrite behind all of this, and to segumarc for the original Honeyboard module we built on. Open source moving mobile forensics forward!
🔗 Run ALEAPP from source: https://github.com/abrignoni/ALEAPP
#DFIR #FLOSS #FOSS #MobileForensics #DigitalForensics #Android
-
Did you know Samsung's keyboard, Honeyboard, keeps its own clipboard history? Screenshots and all. ALEAPP just got a big upgrade parsing it.
The rebuilt Samsung Honeyboard clipboard artifact now pulls:
⌨️ Clipboard text history (live entries)
🗑️ Deleted clipboard entries recovered from the SQLite WAL, no external tools
🖼️ Clipboard screenshot clips with embedded thumbnails
🕵️ Screenshot source app decoded from Samsung's hidden SEFT trailer
🏷️ Clipboard source app resolved from packages.xml, text or binary ABX on Android 12+
🧩 Dual schema support, old caller_app_uid and new caller_package_name
🕒 UTC timestamps, EXIF capture time, and image dimensionsHeads up: this is not in a tagged release yet. To use it right now you have to run ALEAPP from source. Clone the repo and run it from code, the artifact is already on main.
Big thanks to Al3x101 (MSAB) for the excellent rewrite behind all of this, and to segumarc for the original Honeyboard module we built on. Open source moving mobile forensics forward!
🔗 Run ALEAPP from source: https://github.com/abrignoni/ALEAPP
#DFIR #FLOSS #FOSS #MobileForensics #DigitalForensics #Android
-
New blog post: Be Careful What You Wish For.
We are implementing AI in digital forensics wrong.
Here is a new technology that works like a genie. You make a wish, the genie provides. Need a timeline? Ask the genie. A data source you don't understand? Ask the genie, it comes back parsed. What is not to like?
Plenty, it turns out.
For the last few weeks I have been using Claude extensively on the LEAPPs codebase, reviewing every single PR. That work taught me exactly what the genie can do, what it cannot, and what happens the moment you forget the difference.
So I wrote it down. It is about wishes, monkey's paws, and the one thing the genie can never grant you.
📖 Read it: https://leapps.org/blog-post?post=2026-07-12-be-careful-what-you-wish-for
-
New blog post: Be Careful What You Wish For.
We are implementing AI in digital forensics wrong.
Here is a new technology that works like a genie. You make a wish, the genie provides. Need a timeline? Ask the genie. A data source you don't understand? Ask the genie, it comes back parsed. What is not to like?
Plenty, it turns out.
For the last few weeks I have been using Claude extensively on the LEAPPs codebase, reviewing every single PR. That work taught me exactly what the genie can do, what it cannot, and what happens the moment you forget the difference.
So I wrote it down. It is about wishes, monkey's paws, and the one thing the genie can never grant you.
📖 Read it: https://leapps.org/blog-post?post=2026-07-12-be-careful-what-you-wish-for
-
🚨 RELEASE THE LEAPPS! 🚨
New parsers, better timelines, AI-content flags, cleaner reports. All free, all open source.
🔗 Get them: https://leapps.org/releases
It's alive!!! #DFIR #MobileForensics #MobileForensics -
🚨 RELEASE THE LEAPPS! 🚨
New parsers, better timelines, AI-content flags, cleaner reports. All free, all open source.
🔗 Get them: https://leapps.org/releases
It's alive!!! #DFIR #MobileForensics #MobileForensics -
What? Brigs using an LLM? Yes.
New blog post: The Rules Keep Changing.
I asked Claude to generate a complete iLEAPP artifact on its own, targeting the newly documented SQLite databases in the iOS Biome directory. It came back with fourteen artifacts covering the pre-aggregated Biome databases and the protobuf-based Set.db stores.
All fourteen ran clean on the first full pass. That is 3,668 rows of previously unparsed data.
Was it hands-off? No, and that is exactly the point. The LLM wrote the code. The examiner owned the verification. I reviewed every schema, checked the timestamp conversions, and validated row counts against manual queries. That division of labor is the only version of this workflow I will vouch for.
Coding has been democratized. The days of waiting for a vendor to parse the artifacts you need are ending. But only an expert can and should be generating code with LLMs for casework, because only an expert can verify every output.
Big thanks to the awesome Charlie Rubisoft, whose Biome research made this possible, and to John Hyla, Geraldine Bly, and Alex Caithness for the SEGB work that started this whole thread.
The rules keep changing. Keep up.
📖 Read it: https://leapps.org/blog-post?post=2026-07-11-the-rules-keep-changing
#DFIR #MobileForensics #DigitalForensics #iOS #FLOSS #iLEAPP
-
What? Brigs using an LLM? Yes.
New blog post: The Rules Keep Changing.
I asked Claude to generate a complete iLEAPP artifact on its own, targeting the newly documented SQLite databases in the iOS Biome directory. It came back with fourteen artifacts covering the pre-aggregated Biome databases and the protobuf-based Set.db stores.
All fourteen ran clean on the first full pass. That is 3,668 rows of previously unparsed data.
Was it hands-off? No, and that is exactly the point. The LLM wrote the code. The examiner owned the verification. I reviewed every schema, checked the timestamp conversions, and validated row counts against manual queries. That division of labor is the only version of this workflow I will vouch for.
Coding has been democratized. The days of waiting for a vendor to parse the artifacts you need are ending. But only an expert can and should be generating code with LLMs for casework, because only an expert can verify every output.
Big thanks to the awesome Charlie Rubisoft, whose Biome research made this possible, and to John Hyla, Geraldine Bly, and Alex Caithness for the SEGB work that started this whole thread.
The rules keep changing. Keep up.
📖 Read it: https://leapps.org/blog-post?post=2026-07-11-the-rules-keep-changing
#DFIR #MobileForensics #DigitalForensics #iOS #FLOSS #iLEAPP
-
🚀 New releases! iLEAPP and ALEAPP both hit v2026.1.0!
Been a while cooking and this one is big. Both tools move to a fresh calendar versioning scheme and land a mountain of work from the community.
What's new across iLEAPP and ALEAPP:
🌋 Massive LAVA migration is essentially complete. Nearly every artifact now runs on the modern processor with UTC timestamps, relative source paths, and consistent metadata.
🆕 New parsers: Zalo, Discord cache, Home Depot, Oura Ring, Biome app usage, HONOR Media Library, Samsung Secure Folder, Rema 1000, and more.
💬 Conversation views added to WhatsApp, Viber, Kik, Slack, Life360, TikTok, Discord, Reddit, Google Messages, and others.
🎨 Visual identity overhaul with Tabler icons and dark theme updates.
🔎 New App Inventory module to show you exactly what is and isn't parsed in an extraction.
🛠️ Tons of stability fixes: pre-1970 timestamps, reserved-word crashes, glob filename resolution, long Windows paths, and packaging.Huge thank you to everyone who contributed parsers, fixes, and testing. This is what open source forensics looks like when the community shows up.
🔗 Get iLEAPP: https://www.leapps.org/releases#section-ileapp
🔗 Get ALEAPP: https://www.leapps.org/releases#section-aleapp#DFIR #MobileForensics #DigitalForensics #iOS #Android #FLOSS #iLEAPP #ALEAPP
-
🚀 New releases! iLEAPP and ALEAPP both hit v2026.1.0!
Been a while cooking and this one is big. Both tools move to a fresh calendar versioning scheme and land a mountain of work from the community.
What's new across iLEAPP and ALEAPP:
🌋 Massive LAVA migration is essentially complete. Nearly every artifact now runs on the modern processor with UTC timestamps, relative source paths, and consistent metadata.
🆕 New parsers: Zalo, Discord cache, Home Depot, Oura Ring, Biome app usage, HONOR Media Library, Samsung Secure Folder, Rema 1000, and more.
💬 Conversation views added to WhatsApp, Viber, Kik, Slack, Life360, TikTok, Discord, Reddit, Google Messages, and others.
🎨 Visual identity overhaul with Tabler icons and dark theme updates.
🔎 New App Inventory module to show you exactly what is and isn't parsed in an extraction.
🛠️ Tons of stability fixes: pre-1970 timestamps, reserved-word crashes, glob filename resolution, long Windows paths, and packaging.Huge thank you to everyone who contributed parsers, fixes, and testing. This is what open source forensics looks like when the community shows up.
🔗 Get iLEAPP: https://www.leapps.org/releases#section-ileapp
🔗 Get ALEAPP: https://www.leapps.org/releases#section-aleapp#DFIR #MobileForensics #DigitalForensics #iOS #Android #FLOSS #iLEAPP #ALEAPP
-
Batch LEAPP's new --coverage mode inventories every installed app and every file on your test devices, checks them against what the LEAPP modules actually touched, and hands you the gaps as a ranked list. Ran it against my test corpus today:
📱 5 iOS full filesystem images + a Pixel 8 Pro, one command each
🗃️ 1.3 million files inventoried and mapped to 6,000+ app containers
🚩 Snapchat: unparsed in 5 of 5 images — 29,482 files sitting on disk unread
📉 Facebook, Twitter, and YouTube: no app-specific coverage either
🔍 Instagram: parsed in 4 of 5 images — the odd one out is a bug report waiting to be filed
🤖 Android gaps: Instagram, Signal, Kik, and Telegram
🌋 The whole analysis opens in LAVA, one button from the batch reportIt even caught a mislabeled extraction in my collection — an "Android" image that turned out to be an iPhone 8 the whole time.
If you have ever wanted a data-backed answer to "what module should we build next?" — there it is. Full write-up, charts, and the how-to guides:
🔗 https://leapps.org/blog-post?post=2026-07-08-app-coverage-analysis
Free and open source, as always. Feedback and pull requests welcome!
#DFIR #FLOSS #MobileForensics #DigitalForensics #iOS #Android
-
Batch LEAPP's new --coverage mode inventories every installed app and every file on your test devices, checks them against what the LEAPP modules actually touched, and hands you the gaps as a ranked list. Ran it against my test corpus today:
📱 5 iOS full filesystem images + a Pixel 8 Pro, one command each
🗃️ 1.3 million files inventoried and mapped to 6,000+ app containers
🚩 Snapchat: unparsed in 5 of 5 images — 29,482 files sitting on disk unread
📉 Facebook, Twitter, and YouTube: no app-specific coverage either
🔍 Instagram: parsed in 4 of 5 images — the odd one out is a bug report waiting to be filed
🤖 Android gaps: Instagram, Signal, Kik, and Telegram
🌋 The whole analysis opens in LAVA, one button from the batch reportIt even caught a mislabeled extraction in my collection — an "Android" image that turned out to be an iPhone 8 the whole time.
If you have ever wanted a data-backed answer to "what module should we build next?" — there it is. Full write-up, charts, and the how-to guides:
🔗 https://leapps.org/blog-post?post=2026-07-08-app-coverage-analysis
Free and open source, as always. Feedback and pull requests welcome!
#DFIR #FLOSS #MobileForensics #DigitalForensics #iOS #Android
-
When critical evidence is locked inside feature phones or ultra-compact devices, MSAB helps investigators go further — enabling advanced mobile extraction and analysis where other forensic tools may fall short. https://www.forensicfocus.com/case-studies/from-inaccessible-to-actionable-how-punjab-police-recovered-critical-evidence-from-feature-phones/ #MSAB #MobileForensics
-
Location evidence is about more than coordinates — Jason Lesser explains how movement patterns from mobile devices can help investigators build a clearer picture of events. https://www.forensicfocus.com/interviews/jason-lesser-founder-map-and-track/ #MobileForensics #DigitalForensics
-
New blog post on leapps.org: how to write an artifact module for iLEAPP (and ALEAPP, RLEAPP, and VLEAPP — same process, different repo).
A module is one Python file. The framework handles the rest. The guide covers structure, SQLite and plist parsing, timestamps, LAVA conversation view, and a full working example you can copy and adapt.
👉 https://leapps.org/blog-post?post=2026-06-14-how-to-write-an-ileapp-module
#DFIR #MobileForensics #iLEAPP #OpenSource #DigitalForensics
-
New blog post on leapps.org: how to write an artifact module for iLEAPP (and ALEAPP, RLEAPP, and VLEAPP — same process, different repo).
A module is one Python file. The framework handles the rest. The guide covers structure, SQLite and plist parsing, timestamps, LAVA conversation view, and a full working example you can copy and adapt.
👉 https://leapps.org/blog-post?post=2026-06-14-how-to-write-an-ileapp-module
#DFIR #MobileForensics #iLEAPP #OpenSource #DigitalForensics
-
LLM tech shifts forensics work from front-end to back-end — the equation always requires balancing. Any shortcut in the forensic process carries serious consequences. Speed without care is just recklessness. Now is the time to develop policies, plan resource allocations, and ensure the human element is never outsourced. #DigitalForensics #MobileForensics #DFIR #LLM #AI
-
LLM tech shifts forensics work from front-end to back-end — the equation always requires balancing. Any shortcut in the forensic process carries serious consequences. Speed without care is just recklessness. Now is the time to develop policies, plan resource allocations, and ensure the human element is never outsourced. #DigitalForensics #MobileForensics #DFIR #LLM #AI
-
Coming to a department, lab, or office near you.
Let's be clear, LLM technology takes the work performed at the front end of our forensics process and places it at the back end. There is no free lunch and the promise of speed if you buy an LLM product is no exception. If you affect one side if the process the other side will be just as affected. The equation always requires balancing.
Never forget that any shortcut in the forensic process will carry serious consequences. Speed without care is just recklessness.
Now is the time to develop policies, plan resource allocations, and make sure that the human element is never outsourced.
-
Coming to a department, lab, or office near you.
Let's be clear, LLM technology takes the work performed at the front end of our forensics process and places it at the back end. There is no free lunch and the promise of speed if you buy an LLM product is no exception. If you affect one side if the process the other side will be just as affected. The equation always requires balancing.
Never forget that any shortcut in the forensic process will carry serious consequences. Speed without care is just recklessness.
Now is the time to develop policies, plan resource allocations, and make sure that the human element is never outsourced.
-
📽️ MSAB hosted panel on AI/LLM usage in #DigitalForensics at Techno Security East 2026.
Panel participants: Adam Firman, Heather Charpentier, & me.
Thank you all who came in and made the event standing room only.Watch the panel here:
https://www.youtube.com/watch?v=5kaVPCXROdw -
📽️ MSAB hosted panel on AI/LLM usage in #DigitalForensics at Techno Security East 2026.
Panel participants: Adam Firman, Heather Charpentier, & me.
Thank you all who came in and made the event standing room only.Watch the panel here:
https://www.youtube.com/watch?v=5kaVPCXROdw -
New blog at LEAPPs.org!
💫 Artifact deep dives: what an artifact contains, where it lives, and what it reveals
💫 Tool updates: context behind major feature lands in iLEAPP, ALEAPP, RLEAPP, VLEAPP, and LAVA
💫 How-to guides: parsing, filtering, and interpreting tool output
💫 Community write-ups: researchers sharing findings and workflows
https://www.leapps.org/blog
#DigitalForensics #MobileForensics #DFIR #LEAPPs -
New blog at LEAPPs.org!
💫 Artifact deep dives: what an artifact contains, where it lives, and what it reveals
💫 Tool updates: context behind major feature lands in iLEAPP, ALEAPP, RLEAPP, VLEAPP, and LAVA
💫 How-to guides: parsing, filtering, and interpreting tool output
💫 Community write-ups: researchers sharing findings and workflows
https://www.leapps.org/blog
#DigitalForensics #MobileForensics #DFIR #LEAPPs -
🎙️ Digital Forensics Now sits down with Heather Barnhart — DFIR Curriculum Lead at SANS, 20+ years in the field, high-profile cases.
She and her team built a framework for when and how to use AI in DFIR. Worth reading.
Watch: https://youtu.be/bTHIw1ob4i4
Framework: https://www.linkedin.com/posts/heather-barnhart-cellebrite_ai-dfir-digitalforensics-ugcPost-7463670252950847488-b7s- -
🎙️ Digital Forensics Now sits down with Heather Barnhart — DFIR Curriculum Lead at SANS, 20+ years in the field, high-profile cases.
She and her team built a framework for when and how to use AI in DFIR. Worth reading.
Watch: https://youtu.be/bTHIw1ob4i4
Framework: https://www.linkedin.com/posts/heather-barnhart-cellebrite_ai-dfir-digitalforensics-ugcPost-7463670252950847488-b7s- -
LAVA v0.13.0 is out 🔥
New in this release:
📄 PDF export for chat conversations
🌍 🇩🇪 🇫🇷 🇪🇸 🇵🇹 new language translations
🖼️ JXL image rendering
⚡ Artifact menu performance improvementsBig thanks to the contributors!
👉 https://github.com/leapps-org/LAVA-releases/releases/tag/v0.13.0
-
LAVA v0.13.0 is out 🔥
New in this release:
📄 PDF export for chat conversations
🌍 🇩🇪 🇫🇷 🇪🇸 🇵🇹 new language translations
🖼️ JXL image rendering
⚡ Artifact menu performance improvementsBig thanks to the contributors!
👉 https://github.com/leapps-org/LAVA-releases/releases/tag/v0.13.0
-
LEAPPs.org just shipped some updates worth knowing about.
Biggest one: a live Artifact Browser at LEAPPs.org/artifacts — search and filter every artifact supported across iLEAPP, ALEAPP, RLEAPP, and VLEAPP in one place. Pulls straight from the source code.
Also: skeleton loading states, theme-aware charts, nav cleanup, and a handful of bug fixes.
-
LEAPPs.org just shipped some updates worth knowing about.
Biggest one: a live Artifact Browser at LEAPPs.org/artifacts — search and filter every artifact supported across iLEAPP, ALEAPP, RLEAPP, and VLEAPP in one place. Pulls straight from the source code.
Also: skeleton loading states, theme-aware charts, nav cleanup, and a handful of bug fixes.
-
Want to chat with other LEAPPs & LAVA users? Interact with the developers and maintainers? If so get into our LEAPPs Discord server! Check out the invite link at https://www.leapps.org/resources
-
Want to chat with other LEAPPs & LAVA users? Interact with the developers and maintainers? If so get into our LEAPPs Discord server! Check out the invite link at https://www.leapps.org/resources
-
Want to test out LAVA with some preprocessed data? Go to leapps.org/resources and check out out LAVA Sample Projects repository.
The goal is to allow users to:
ℹ️ Explore datasets in LAVA without needing to download and parse images themselves
ℹ️ Test LAVA features
ℹ️ Learn artifact structures
ℹ️ Validate workflows
ℹ️ Demonstrate LEAPPs outputs in training or presentations -
Want to test out LAVA with some preprocessed data? Go to leapps.org/resources and check out out LAVA Sample Projects repository.
The goal is to allow users to:
ℹ️ Explore datasets in LAVA without needing to download and parse images themselves
ℹ️ Test LAVA features
ℹ️ Learn artifact structures
ℹ️ Validate workflows
ℹ️ Demonstrate LEAPPs outputs in training or presentations -
* A non-expert using a traditional forensics tool produces output that looks like tool output.
* A non-expert using an LLM produces output that reads like expert analysis."The danger is that AI produces such vast vats of plausible slop that they outpace our capacity to check."
-Tim Harford -
* A non-expert using a traditional forensics tool produces output that looks like tool output.
* A non-expert using an LLM produces output that reads like expert analysis."The danger is that AI produces such vast vats of plausible slop that they outpace our capacity to check."
-Tim Harford -
💬 Build LEAPP artifacts that are compatible with LAVA's conversation data view ( which is a fancy way of saying speech bubbles.)
😌 It is super easy. Just watch this short video: https://www.youtube.com/watch?v=yuNK8aznh6U -
💬 Build LEAPP artifacts that are compatible with LAVA's conversation data view ( which is a fancy way of saying speech bubbles.)
😌 It is super easy. Just watch this short video: https://www.youtube.com/watch?v=yuNK8aznh6U -
Me when someone sends me a pull request that is nothing more than vibe coded spaghetti 🍝
-
Me when someone sends me a pull request that is nothing more than vibe coded spaghetti 🍝
-
🤖 New LAVA compliant ALEAPP artifact for DeepSeek AI in Android
🙏 Thanks to Ricardo Santos for contributing this awesome artifact.
👩🏽💻 Get chat messages, chat info, and user info.
✅ Check out Ricardo's social media presence here👇
LinkedIn: https://www.linkedin.com/in/ricardo-santos-048813234/
Github: https://github.com/RicardoBeny
⤵️ Get the LEAPPs and LAVA here: https://www.leapps.org/releases#DigitalForensics #MobileForensics #DeepSeek #Android #AI #LLM #DFIR
-
🤖 New LAVA compliant ALEAPP artifact for DeepSeek AI in Android
🙏 Thanks to Ricardo Santos for contributing this awesome artifact.
👩🏽💻 Get chat messages, chat info, and user info.
✅ Check out Ricardo's social media presence here👇
LinkedIn: https://www.linkedin.com/in/ricardo-santos-048813234/
Github: https://github.com/RicardoBeny
⤵️ Get the LEAPPs and LAVA here: https://www.leapps.org/releases#DigitalForensics #MobileForensics #DeepSeek #Android #AI #LLM #DFIR
-
INTRODUCING DIGITAL EVIDENCE CAN'T BE THE EXCEPTION!!!
How many cases will end up in basic pleas because important evidence was missed?
How can meaning be discerned when the process used to get there is hidden behind this black box technology?It is a salient fact that LLMs aren't optional now. They're already embedded in too many systems, workflows, and products to avoid. The question is under what conditions and with what controls.
-
Want to make #LEAPP artifacts that take advantage of the conversation view functionality? Easy! Watch this short video and learn how: https://youtu.be/yuNK8aznh6U
Currently conversation view only supported on iLEAPP but coming to the rest of the LEAPPs shortly.
-
Lots of movement happening in the #LEAPPs project.
🌋 #LAVA (LEAPPs Artifact Viewer App) has been released.
📱 New releases for all the LEAPPs.
🕸️ New webpage with all listed releases by tool. No need to jump around GitHub repositories to find the latest executables.
📧 Mail list available so you can be the first to know about all the new stuff that is coming. We won't spam you.
🖋️ Sign up for the mailing list here: https://www.leapps.org/#mailing