📱 Telegram: 15 new artifacts across iLEAPP and ALEAPP, plus a cross-platform system events reference. ⚠️ No settings key does not mean "off." It means the app default applied. Printing "off" invents evidence. leapps.org/blog-post?post=2026-08-04-telegram-ios-android-coverage #DFIR

📱 Eight years after my Android UsageStats posts, the XML became protobuf, 4 event types became 32, and ALEAPP now parses all of it. ⚠️ ACTIVITY_RESUMED is not "the user tapped the app." It is a lifecycle state. leapps.org/blog-post?post=2026-08-03-android-usagestats-recent-tasks #DFIR

Every Step You Take, Eight Years Later: Android UsageStats and Recent Tasks — LEAPPs Blog

Android's pattern-of-life evidence grew from readable XML into tokenized protobufs carrying app lifecycle, lock state, notifications, services, task roots, and more. We went back to the source, update...

leapps.org

Every Apple Unified Log predicate iLEAPP searches for, artifact by artifact. 34 artifacts, 230 predicates, each sourced and validated against real iOS extractions. Free, PDF included. #DFIR leapps.org/blog-post?po...

Apple Unified Log Predicates in iLEAPP: The Reference — LEAPPs Blog

Every Unified Log message predicate iLEAPP searches for, artifact by artifact, with the processes involved, the iOS versions each pattern was observed on, the sources that documented them, and the cav...

leapps.org

Good analogy.

Dare Obasanjo@carnage4life.bsky.social · 5d ago

Someone saying I didn’t actually build a vibe coded app because “you simply pushed a button” is like telling me I didn’t sew my shirt and just clicked [Buy] on Amazon. I’m sure it’s an insult in some circles but to me this is exactly why technology exists.

Apple Unified Logs may reveal locks, app launches, connectivity changes, screenshots, navigation, and more. Updated: acquisition, iLEAPP processing, 132 message predicates, and LAVA/SQLite analysis. leapps.org/blog-post?po... #DFIR #iOSForensics

Extracting, Processing, and Querying Apple Unified Logs from an iOS Device — LEAPPs Blog

Apple Unified Logs can show locks, app launches, connectivity, navigation, and more. Here is the updated workflow for acquiring them, processing them with iLEAPP, and working the results in LAVA.

leapps.org

Some of you are still posting AI-generated images, and it’s always tremendously disappointing.

Mattia Epifani mapped Apple Biome from iOS 14 to iOS 26 and documented 84 streams worth of forensic value. He sent the streams over as he found them. iLEAPP went from 45 Biome artifacts to 101 in two days. Blog: blog.digital-forensics.it/2026/07/84-s... iLEAPP: leapps.org/releases#sec... #DFIR

🚀 Everybody gets a release! iLEAPP, ALEAPP, RLEAPP, VLEAPP at v2026.2.0. LAVA at v0.14.0. Biome artifacts, iOS 26 Photos, Samsung clipboard WAL recovery, Snapchat returns overhaul, and row tagging in LAVA. leapps.org/blog-post?post=2026-07-25-everybody-gets-a-release #DFIR

Digital Forensics Now ahora habla español. 🎙️ Same show, same voices, ahora en tu idioma. AI voice cloning, open source models, running locally, and every translation verified. Stochastic tools, deterministic output, human verification. That's the recipe. digitalforensicsnowespanol.buzzsprout.com

Digital Forensics Now - Español

Es Digital Forensics Now pero traducido al español gracias a la inteligencia artificial.

digitalforensicsnowespanol.buzzsprout.com

🌋 LAVA 0.14.0 is here. Tag rows of interest in any artifact table, add examiner notes, then export just those rows as an HTML report or a full subset LAVA project with provenance built in. Your evidence db is never written to. leapps.org/releases#section-lava #DFIR

New in iLEAPP: Biome - Device TimeZone, contributed by Cynthia van Dorp. iOS 17+ keeps a timezone change log in the Device.TimeZone biome, and every change timestamped. On one test ima ge it mapped the device moving between New York, Chicago, and Honolulu time. Travel evidence hiding in a biome#DFIR

New in ALEAPP: full Mister Skinnylegs integration by Alex Caithness and CCL. 28 new browser artifacts for Android Chromium browsers and webviews, from history and searches to crypto apps, Discord, and AI chats. And it auto-picks up every Skinnylegs plugin. Free and open source. #DFIR

New on the LEAPPs blog. ⚙️ astc_decomp_faster now builds on Python 3.13 and 3.14, every platform, including Apple Silicon. That unblocks the LEAPPs on the latest Python A great deep-dive from Bruno Constanzo on ASTC, Cython, and bugs. #DFIR leapps.org/blog-post?post=2026-07-22-astc-cython-and-bugs

ASTC, Cython, and bugs! — LEAPPs Blog

What do texture decompression, C-extensions for python, and LEAPPs have in common? Read to find out!

leapps.org

New LEAPPs feature highlight! ✨ Run a parser and lose track of the output folder? LAVA now shows your recent iLEAPP, ALEAPP, RLEAPP, and VLEAPP runs right on the welcome screen. Opt-in by design. Nice work by the awesome James Habben. leapps.org/blog-post?post=feature-leapps-recent-run-history

Feature Highlight: Recent Run History in LAVA — LEAPPs Blog

A quick look at the new opt-in LEAPPs recent run history feature and how LAVA can use it to put recent parser outputs right on the welcome screen.

leapps.org

New iLEAPP parser: the United Airlines iOS app! ✈️ Trips, boarding passes, saved travelers, booking searches, inflight watch history, even iMessage recipients from a plugin cache. 12 artifacts. Great write-up from the awesome James Habben. #DFIR leapps.org/blog-post?post=united-ios-app-artifacts

A Trip Through the United iOS App — LEAPPs Blog

A look at United Airlines iOS app research in iLEAPP, including where the data lived, which rabbit holes mattered, and why nearby app/plugin data can change the shape of the parser.

leapps.org

Photos.sqlite in LAVA! 📸 The full Photos.sqlite parser family in iLEAPP, 42 artifacts, now in LAVA. Assets, locations, GenAI images, faces, shared albums, iOS 14-26. Data heavy reports crash HTML output. LAVA does not. Massive work by the awesome Scott Koenig. leapps.org/releases#section-ileapp

Releases — LEAPPs

Download the latest releases of iLEAPP, ALEAPP, RLEAPP, VLEAPP, and LAVA — free open-source digital forensics tools.

leapps.org

Busy stretch on the LEAPPs blog, a lot of it about AI in forensics: 🪔 Be Careful What You Wish For 🖼️ Spotting AI Generated Images in iLEAPP and ALEAPP 🧬 The Rules Keep Changing All free and open source. leapps.org/blog

Blog — LEAPPs

Forensics deep dives, tool updates, artifact write-ups, and community contributions from the LEAPPs project.

leapps.org

We are implementing AI in digital forensics wrong A technology that works like a genie: make a wish, the genie provides. What is not to like? Plenty. New post on wishes, monkey's paws and the one thing the genie can never grant you leapps.org/blog-post?post=2026-07-12-be-careful-what-you-wish-for

Be Careful What You Wish For — LEAPPs Blog

The genie can grant almost anything. It cannot grant you judgment. And judgment is the one thing you need in order to control it.

leapps.org

if the UI and UX suck or features people want to use aren’t there I promise you it’s not as good an alternative as you think most users just want to get things done on software that works well, and yelling at them about how they’re wrong to want what they want doesn’t actually help them or you

🚨 RELEASE THE LEAPPS! 🚨 New parsers, better timelines, AI-content flags, cleaner reports. All free, all open source. 🔗 Get them: leapps.org/releases It's alive!!! #DFIR #MobileForensics #MobileForensics

New in iLEAPP and ALEAPP: flag AI generated images! 🤖 The new C2PA Content Provenance artifact reads AI provenance two ways: 🧬 C2PA Content Credentials 🏷️ IPTC Digital Source Type (XMP) 🐍 Pure Python Merged now, run from source today. 🔗 leapps.org/blog-post?po... #DFIR #FLOSS #DigitalForensics

Spotting AI Generated Images in iLEAPP and ALEAPP — LEAPPs Blog

iLEAPP and ALEAPP can now flag AI generated images by reading content provenance two ways, C2PA Content Credentials manifests and the IPTC Digital Source Type in XMP. Pure Python, no new…

leapps.org

💫 New episode of the Digital Forensics Now Podcast is out! 🛠️ It is all about tools and automation. 🫥 We also discuss testing and transparency. 📱 Announcement of the latest iLEAPP & ALEAPP releases. 🌋 All LEAPP artifacts are fully LAVA compliant. 🔗 Check it out! www.youtube.com/c/AlexisBrig...

What? Brigs using an LLM? Yes. I had Claude generate a complete iLEAPP artifact for the new iOS Biome SQLite databases. 14 artifacts, 3,668 rows, clean first pass. The LLM wrote the code. The examiner owned the verification. leapps.org/blog-post?post=2026-07-11-the-rules-keep-changing

The Rules Keep Changing — LEAPPs Blog

The first fully LLM-generated set of artifacts lands in iLEAPP: fourteen Biome parsers built from public community research and test data, 3,668 rows of previously unparsed data on the first clean pas...

leapps.org

🔎 New on the LEAPPs Artifact Browser: click "samples" on any parser to see the test images it was validated against, with row counts. Knowing what a tool was tested against is the work, not a nice to have. leapps.org/artifacts #DFIR

Artifacts — LEAPPs

Browse all artifacts supported by iLEAPP, ALEAPP, RLEAPP, and VLEAPP.

leapps.org

🚀 iLEAPP + ALEAPP v2026.1.0 are out! New calendar versioning, the LAVA migration essentially complete, Tabler icons, and fresh parsers: Oura Ring, Zalo, Home Depot, HONOR, Samsung Secure Folder, plus new conversation views. 🔗 leapps.org/releases #DFIR #MobileForensics

Releases — LEAPPs

Download the latest releases of iLEAPP, ALEAPP, RLEAPP, VLEAPP, and LAVA — free open-source digital forensics tools.

leapps.org

Which apps are the LEAPPs NOT parsing? Batch LEAPP's new --coverage mode measures it against real test images and gives you the gaps ranked by evidence. Snapchat: unparsed in 5 of 5 iPhones, 29k files unread. Full write-up: leapps.org/blog-post?po... #DFIR #DigitalForensics #FLOSS #MobileForensics

The Apps We Are Not Parsing (Yet) — LEAPPs Blog

Batch LEAPP now answers a question I have wanted answered for years. Out of all the apps installed on our test devices, which ones do the LEAPPs actually parse, and which ones are we missing? One flag...

leapps.org

New iLEAPP artifact by James Habben: Home Depot iOS App Check out the blog post here: 👉 leapps.org/blog-post?po...

Getting It Done with Home Depot iOS Artifacts — LEAPPs Blog

A look at new iLEAPP parsing for the Home Depot iOS app, including account details, store preferences, searches, viewed products, shopping lists, cached location, and a few useful cache artifacts.

leapps.org

🚨 Introducing Batch LEAPP. Ever had a folder full of extractions and run them through iLEAPP one at a time? Not anymore. #DFIR Batch LEAPP points at a directory, finds every extraction inside, and runs iLEAPP, ALEAPP, RLEAPP, or VLEAPP on each one. 🔗 Read the post: leapps.org/blog-post?po...

Introducing Batch LEAPP — LEAPPs Blog

Batch LEAPP runs any LEAPP tool across an entire folder of extractions and builds one report index that links every result, with hashing and a manifest for your case file. Here is what it does and how...

leapps.org

🚀 Django Faiola rebuilt the Waze parser for the new iLEAPP framework. 📍 Account details, GPS tracks, search history, recent destinations, favorites, shared locations, planned events, TTS navigation. 🔧 Fully integrated into LAVA too. 🔗 Read the blog post: djangofaiola.blogspot.com/2026/06/comp...

Releases — LEAPPs

Download the latest releases of iLEAPP, ALEAPP, RLEAPP, VLEAPP, and LAVA — free open-source digital forensics tools.

leapps.org

🚨 New blog post at LEAPPs.org! 🍺 The LEAPPs and LAVA now install on macOS through Homebrew. ➕ Add the tap and get your digital forensics on. 🙏 Thanks to James Habben for the implementation and post. 👇 Read the blog post here: leapps.org/blog-post?po...

LEAPPs — Digital Forensics Tools

Free digital forensics tools. iLEAPP, ALEAPP, RLEAPP, VLEAPP, and LAVA — parse and visualize artifacts from iOS, Android, Windows, and more.

leapps.org