Kevin 🤖🕵️🍺
@stark4n6.bsky.social
Lethal forensicator, researcher, developer, blogger, curator of many fine t-shirt designs, resident #DFIR beer drinker https://startme.stark4n6.com
. #DEFCON 34 SOUNDTRACK FOR YOUR EARHOLES! The Dark Tangent requested it be released early, shout out to all the producers who donated time and talent! defconcommunications.bandcamp.com #defcon34 #music #hackersummercamp @defcon.bsky.social @defconparrot.bsky.social
DEF CON 34: The Official Soundtrack, by DEF CON Communications
25 track album
defconcommunications.bandcamp.com
📱 Telegram: 15 new artifacts across iLEAPP and ALEAPP, plus a cross-platform system events reference. ⚠️ No settings key does not mean "off." It means the app default applied. Printing "off" invents evidence. leapps.org/blog-post?post=2026-08-04-telegram-ios-android-coverage #DFIR
So stoked for this, from a POC to full fledged parsing support for Apple Unified Logs in less than 5 hours!
Alexis Brignoni🪫@abrignoni.com · last wk.Apple Unified Logs may reveal locks, app launches, connectivity changes, screenshots, navigation, and more. Updated: acquisition, iLEAPP processing, 132 message predicates, and LAVA/SQLite analysis. leapps.org/blog-post?po... #DFIR #iOSForensics
New on the LEAPPs blog. ⚙️ astc_decomp_faster now builds on Python 3.13 and 3.14, every platform, including Apple Silicon. That unblocks the LEAPPs on the latest Python A great deep-dive from Bruno Constanzo on ASTC, Cython, and bugs. #DFIR leapps.org/blog-post?post=2026-07-22-astc-cython-and-bugs
ASTC, Cython, and bugs! — LEAPPs Blog
What do texture decompression, C-extensions for python, and LEAPPs have in common? Read to find out!
leapps.org
New files added to The Evidence Locker: 💀💻 Null404 CTF images 📙🧑🍳 Packt Publishing / Cody Bounds Digital Forensics Cookbook datasets #DFIR theevidencelocker.github.io
The Evidence Locker
theevidencelocker.github.io
A Trip Through the United iOS App #LEAPPs #iLEAPP #DFIR #MobileForensics leapps.org/blog-post?po...
A Trip Through the United iOS App — LEAPPs Blog
A look at United Airlines iOS app research in iLEAPP, including where the data lived, which rabbit holes mattered, and why nearby app/plugin data can change the shape of the parser.
leapps.org
🔎 New on the LEAPPs Artifact Browser: click "samples" on any parser to see the test images it was validated against, with row counts. Knowing what a tool was tested against is the work, not a nice to have. leapps.org/artifacts #DFIR
Artifacts — LEAPPs
Browse all artifacts supported by iLEAPP, ALEAPP, RLEAPP, and VLEAPP.
leapps.org
Which apps are the LEAPPs NOT parsing? Batch LEAPP's new --coverage mode measures it against real test images and gives you the gaps ranked by evidence. Snapchat: unparsed in 5 of 5 iPhones, 29k files unread. Full write-up: leapps.org/blog-post?po... #DFIR #DigitalForensics #FLOSS #MobileForensics
The Apps We Are Not Parsing (Yet) — LEAPPs Blog
Batch LEAPP now answers a question I have wanted answered for years. Out of all the apps installed on our test devices, which ones do the LEAPPs actually parse, and which ones are we missing? One flag...
leapps.org
On July 8, join us for our next episode of #MobileUnpacked, where Christopher Vance will explore the how and why behind different Android acquisition methods, including how to get what you need most from Android targets: https://ow.ly/EWKN50ZjPBe #DFIR
S3:E6 // Aligning on Android acquisitions - Magnet Forensics
How many different ways are there to get Android data? What’s the difference between agent-based extractions and ADB acquisitions?
ow.ly
🚨 Introducing Batch LEAPP. Ever had a folder full of extractions and run them through iLEAPP one at a time? Not anymore. #DFIR Batch LEAPP points at a directory, finds every extraction inside, and runs iLEAPP, ALEAPP, RLEAPP, or VLEAPP on each one. 🔗 Read the post: leapps.org/blog-post?po...
Introducing Batch LEAPP — LEAPPs Blog
Batch LEAPP runs any LEAPP tool across an entire folder of extractions and builds one report index that links every result, with hashing and a manifest for your case file. Here is what it does and how...
leapps.org
Decoding Apple ATX Images in #iLEAPP #DFIR leapps.org/blog-post?po...
Decoding Apple ATX Images in iLEAPP — LEAPPs Blog
Wallpaper research led to a broader Apple image-cache problem: ATX texture files. Here is how iLEAPP now parses and decodes many of them, with a reusable parser that should be easy to port into other ...
leapps.org
🎉 A new 13Cubed episode is up! This time we're exploring the USN Journal on a live system. How can we view it while Windows is actively running, and does the reality match the common explanations? Let's find out! www.youtube.com/watch?v=eSLH... #DFIR #DigitalForensics
How the USN Journal Really Works
YouTube video by 13Cubed
youtube.com
Lots of movement happening in the #LEAPPs project. 🌋 #LAVA (LEAPPs Artifact Viewer App) has been released. 📱 New releases for all the LEAPPs. 🕸️ New webpage with all listed releases by tool. 📧 Mail list available. We won't spam you. 🖋️ Sign up for the mailing list here: www.leapps.org#mailing #DFIR
LEAPPs — Digital Forensics Tools
Free digital forensics tools. iLEAPP, ALEAPP, RLEAPP, VLEAPP, and LAVA — parse and visualize artifacts from iOS, Android, Windows, and more.
leapps.org
Did an Amazon return today to Staples, they appeared to still be using iPhones with a home button, wonder if they still get security updates?!
Can we normalize not posting your work badge on social media? Especially if you're a CISO...
