iLEAPP now reports FEWER installed apps. 3,981 down to 791. That is the fix. The old count included app extensions and container activity that never proved an install. History went up, 9,575 to 11,786. The claim got smaller, the evidence got bigger. leapps.org/blog

iLEAPP and ALEAPP are both at v2026.3.1. Snapchat, Tinder, TikTok, Reddit, Proton Mail, WhatsApp and Chrome payments landed on both sides in the same release. Plus DuckDuckGo absent columns now read empty instead of "No". Absence is not a finding. leapps.org/releases

"Is the point of life merely to stockpile accomplishments? If that is what Silicon Valley believes, no wonder all the billionaires seem so unhappy all the time! They have traded experience for accomplishment, and cheated themselves out of their own lives in the process."

Mark Zuckerberg doesn’t understand how to live

An AI future of sleek, streamlined, and totally empty relationships.

theverge.com

All five LEAPPs just went v2026.3.0. LAVA v0.15.0. Same day. iLEAPP: Apple Unified Logs bundled in every build ALEAPP: Signal with full SQLCipher decryption DLEAPP: Roblox and Telegram Desktop leapps.org/releases

A decent version of most #DFIR software can now be made at home, in a few hours, by someone who does not code. So what makes anyone an expert now? Five qualities, and "has access to #AI" is not one. leapps.org/blog-post?po...

Using AI Effectively in Digital Forensics — LEAPPs Blog

A decent version of most digital forensics software can now be made at home, in a few hours, by a user that does not code. What does that mean for vendors and for us as users, and what actually makes ...

leapps.org

📱 Telegram: 15 new artifacts across iLEAPP and ALEAPP, plus a cross-platform system events reference. ⚠️ No settings key does not mean "off." It means the app default applied. Printing "off" invents evidence. leapps.org/blog-post?post=2026-08-04-telegram-ios-android-coverage #DFIR

📱 Eight years after my Android UsageStats posts, the XML became protobuf, 4 event types became 32, and ALEAPP now parses all of it. ⚠️ ACTIVITY_RESUMED is not "the user tapped the app." It is a lifecycle state. leapps.org/blog-post?post=2026-08-03-android-usagestats-recent-tasks #DFIR

Every Step You Take, Eight Years Later: Android UsageStats and Recent Tasks — LEAPPs Blog

Android's pattern-of-life evidence grew from readable XML into tokenized protobufs carrying app lifecycle, lock state, notifications, services, task roots, and more. We went back to the source, update...

leapps.org

Every Apple Unified Log predicate iLEAPP searches for, artifact by artifact. 34 artifacts, 230 predicates, each sourced and validated against real iOS extractions. Free, PDF included. #DFIR leapps.org/blog-post?po...

Apple Unified Log Predicates in iLEAPP: The Reference — LEAPPs Blog

Every Unified Log message predicate iLEAPP searches for, artifact by artifact, with the processes involved, the iOS versions each pattern was observed on, the sources that documented them, and the cav...

leapps.org

Good analogy.

Dare Obasanjo@carnage4life.bsky.social · last mo.

Someone saying I didn’t actually build a vibe coded app because “you simply pushed a button” is like telling me I didn’t sew my shirt and just clicked [Buy] on Amazon. I’m sure it’s an insult in some circles but to me this is exactly why technology exists.

Apple Unified Logs may reveal locks, app launches, connectivity changes, screenshots, navigation, and more. Updated: acquisition, iLEAPP processing, 132 message predicates, and LAVA/SQLite analysis. leapps.org/blog-post?po... #DFIR #iOSForensics

Extracting, Processing, and Querying Apple Unified Logs from an iOS Device — LEAPPs Blog

Apple Unified Logs can show locks, app launches, connectivity, navigation, and more. Here is the updated workflow for acquiring them, processing them with iLEAPP, and working the results in LAVA.

leapps.org

Some of you are still posting AI-generated images, and it’s always tremendously disappointing.

Mattia Epifani mapped Apple Biome from iOS 14 to iOS 26 and documented 84 streams worth of forensic value. He sent the streams over as he found them. iLEAPP went from 45 Biome artifacts to 101 in two days. Blog: blog.digital-forensics.it/2026/07/84-s... iLEAPP: leapps.org/releases#sec... #DFIR

🚀 Everybody gets a release! iLEAPP, ALEAPP, RLEAPP, VLEAPP at v2026.2.0. LAVA at v0.14.0. Biome artifacts, iOS 26 Photos, Samsung clipboard WAL recovery, Snapchat returns overhaul, and row tagging in LAVA. leapps.org/blog-post?post=2026-07-25-everybody-gets-a-release #DFIR

Digital Forensics Now ahora habla español. 🎙️ Same show, same voices, ahora en tu idioma. AI voice cloning, open source models, running locally, and every translation verified. Stochastic tools, deterministic output, human verification. That's the recipe. digitalforensicsnowespanol.buzzsprout.com

Digital Forensics Now - Español

Es Digital Forensics Now pero traducido al español gracias a la inteligencia artificial.

digitalforensicsnowespanol.buzzsprout.com

🌋 LAVA 0.14.0 is here. Tag rows of interest in any artifact table, add examiner notes, then export just those rows as an HTML report or a full subset LAVA project with provenance built in. Your evidence db is never written to. leapps.org/releases#section-lava #DFIR

New in iLEAPP: Biome - Device TimeZone, contributed by Cynthia van Dorp. iOS 17+ keeps a timezone change log in the Device.TimeZone biome, and every change timestamped. On one test ima ge it mapped the device moving between New York, Chicago, and Honolulu time. Travel evidence hiding in a biome#DFIR

New in ALEAPP: full Mister Skinnylegs integration by Alex Caithness and CCL. 28 new browser artifacts for Android Chromium browsers and webviews, from history and searches to crypto apps, Discord, and AI chats. And it auto-picks up every Skinnylegs plugin. Free and open source. #DFIR

New on the LEAPPs blog. ⚙️ astc_decomp_faster now builds on Python 3.13 and 3.14, every platform, including Apple Silicon. That unblocks the LEAPPs on the latest Python A great deep-dive from Bruno Constanzo on ASTC, Cython, and bugs. #DFIR leapps.org/blog-post?post=2026-07-22-astc-cython-and-bugs

ASTC, Cython, and bugs! — LEAPPs Blog

What do texture decompression, C-extensions for python, and LEAPPs have in common? Read to find out!

leapps.org

New LEAPPs feature highlight! ✨ Run a parser and lose track of the output folder? LAVA now shows your recent iLEAPP, ALEAPP, RLEAPP, and VLEAPP runs right on the welcome screen. Opt-in by design. Nice work by the awesome James Habben. leapps.org/blog-post?post=feature-leapps-recent-run-history

Feature Highlight: Recent Run History in LAVA — LEAPPs Blog

A quick look at the new opt-in LEAPPs recent run history feature and how LAVA can use it to put recent parser outputs right on the welcome screen.

leapps.org

New iLEAPP parser: the United Airlines iOS app! ✈️ Trips, boarding passes, saved travelers, booking searches, inflight watch history, even iMessage recipients from a plugin cache. 12 artifacts. Great write-up from the awesome James Habben. #DFIR leapps.org/blog-post?post=united-ios-app-artifacts

A Trip Through the United iOS App — LEAPPs Blog

A look at United Airlines iOS app research in iLEAPP, including where the data lived, which rabbit holes mattered, and why nearby app/plugin data can change the shape of the parser.

leapps.org

Photos.sqlite in LAVA! 📸 The full Photos.sqlite parser family in iLEAPP, 42 artifacts, now in LAVA. Assets, locations, GenAI images, faces, shared albums, iOS 14-26. Data heavy reports crash HTML output. LAVA does not. Massive work by the awesome Scott Koenig. leapps.org/releases#section-ileapp

Releases — LEAPPs

Download the latest releases of iLEAPP, ALEAPP, RLEAPP, VLEAPP, and LAVA — free open-source digital forensics tools.

leapps.org

Busy stretch on the LEAPPs blog, a lot of it about AI in forensics: 🪔 Be Careful What You Wish For 🖼️ Spotting AI Generated Images in iLEAPP and ALEAPP 🧬 The Rules Keep Changing All free and open source. leapps.org/blog

Blog — LEAPPs

Forensics deep dives, tool updates, artifact write-ups, and community contributions from the LEAPPs project.

leapps.org

We are implementing AI in digital forensics wrong A technology that works like a genie: make a wish, the genie provides. What is not to like? Plenty. New post on wishes, monkey's paws and the one thing the genie can never grant you leapps.org/blog-post?post=2026-07-12-be-careful-what-you-wish-for

Be Careful What You Wish For — LEAPPs Blog

The genie can grant almost anything. It cannot grant you judgment. And judgment is the one thing you need in order to control it.

leapps.org

if the UI and UX suck or features people want to use aren’t there I promise you it’s not as good an alternative as you think most users just want to get things done on software that works well, and yelling at them about how they’re wrong to want what they want doesn’t actually help them or you

🚨 RELEASE THE LEAPPS! 🚨 New parsers, better timelines, AI-content flags, cleaner reports. All free, all open source. 🔗 Get them: leapps.org/releases It's alive!!! #DFIR #MobileForensics #MobileForensics

New in iLEAPP and ALEAPP: flag AI generated images! 🤖 The new C2PA Content Provenance artifact reads AI provenance two ways: 🧬 C2PA Content Credentials 🏷️ IPTC Digital Source Type (XMP) 🐍 Pure Python Merged now, run from source today. 🔗 leapps.org/blog-post?po... #DFIR #FLOSS #DigitalForensics

Spotting AI Generated Images in iLEAPP and ALEAPP — LEAPPs Blog

iLEAPP and ALEAPP can now flag AI generated images by reading content provenance two ways, C2PA Content Credentials manifests and the IPTC Digital Source Type in XMP. Pure Python, no new…

leapps.org

💫 New episode of the Digital Forensics Now Podcast is out! 🛠️ It is all about tools and automation. 🫥 We also discuss testing and transparency. 📱 Announcement of the latest iLEAPP & ALEAPP releases. 🌋 All LEAPP artifacts are fully LAVA compliant. 🔗 Check it out! www.youtube.com/c/AlexisBrig...

What? Brigs using an LLM? Yes. I had Claude generate a complete iLEAPP artifact for the new iOS Biome SQLite databases. 14 artifacts, 3,668 rows, clean first pass. The LLM wrote the code. The examiner owned the verification. leapps.org/blog-post?post=2026-07-11-the-rules-keep-changing

The Rules Keep Changing — LEAPPs Blog

The first fully LLM-generated set of artifacts lands in iLEAPP: fourteen Biome parsers built from public community research and test data, 3,668 rows of previously unparsed data on the first clean pas...

leapps.org

🔎 New on the LEAPPs Artifact Browser: click "samples" on any parser to see the test images it was validated against, with row counts. Knowing what a tool was tested against is the work, not a nice to have. leapps.org/artifacts #DFIR

Artifacts — LEAPPs

Browse all artifacts supported by iLEAPP, ALEAPP, RLEAPP, and VLEAPP.

leapps.org