#mobileforensics

iLEAPP, ALEAPP, RLEAPP, VLEAPP and DLEAPP v2026.4.0 are out! 💽 Raw disk images and E01s read directly 🖥️ GUI stays responsive while processing 📱 iLEAPP: Garmin Connect, Tutanota, MEGA 🤖 ALEAPP: Blink, Avast Cleanup, Kwai, YouCam Perfect 📑 RLEAPP: Synchronoss DV access log workbooks, quarantined CyberTip media 🚗 VLEAPP: E01, HFS+ and APFS volumes 🍎 DLEAPP: macOS iMessage, Safari, Keychain, Slack Desktop https://leapps.org/releases #DFIR #DigitalForensics #FOSS #MobileForensics

📱 New: Telegram support across both LEAPPs, plus a reference nobody had published. Fifteen artifacts. Six for iOS in iLEAPP, nine for Android in ALEAPP, which had no Telegram support at all before this. Thanks Geraldine Blay for the questions that spurred all this research and development. ⚙️ The settings. Auto download stored per network type and per chat category, plus Save to Photos and Save to Gallery. These are what answer whether a photo ever reached the device gallery, which the message record cannot tell you. ⚠️ The warning that matters most: Telegram writes no settings record until the user changes something. No key in the database does not mean "off," it means the app default applied. A tool that prints "off" there is inventing evidence. Ours distinguishes the two states explicitly. 📖 The system events reference. The two clients name the same events differently, and only 27 of roughly 70 pair by name. So: 64 iOS types, 68 Android types, 62 paired, every row linking to the defining line in Telegram's own source, pinned to a commit. Printable PDF included. Also documented: our own gaps. Five capabilities we could not validate against real data, listed in the post, with a request for research images. Blogpost: leapps.org/blog-post?post=2026-08-04-telegram-ios-android-coverage Telegram Events Reference Documentation: leapps.org/blog-post?post=2026-08-04-telegram-system-events-reference #DFIR #DigitalForensics #MobileForensics #LEAPPs #ILEAPP #ALEAPP

🚀 iLEAPP v2026.2.1 is out! The Biome rabbit hole keeps going deeper. This release adds 60+ new Biome streams: 🔋 Device power and lock state 📍 Location visits and app location activity 📸 Camera AutoFocus ROI ⚡ Energy mode and boot sessions 🚨 Emergency voice calls 😀 Emoji engagement 🧠 A full Apple Intelligence family, including Safety Overrides Several of those came out of research by the awesome Mattia Epifani. Thank you Mattia! Also in this release: 💬 Signal for iOS: full message and contact parsing, conversation view with attachments, and detection of Signal's timestamped GRDB directories 🔑 Expanded keychain handling: examiner-supplied keychains, a pure Python SQLCipher reader, UFED encrypted keychain dumps, and reuse of a keychain already carried by the extraction 🔔 Notifications overhaul: attachments checked in as media, embedded payload images recovered, payload fields split into their own columns, and notifications no longer reported three times over Plus fixes for addressBook column pruning, a MemoryError during HTML report generation, several Timeline issues, and an SMS rendering crash. Welcome to four first-time contributors: CynthiavDorp, JSap0914, Sanjays2402, and sandrzejewskipl! 🔗 Get iLEAPP: https://www.leapps.org/releases#section-ileapp #DFIR #MobileForensics #DigitalForensics #iOS #FLOSS #iLEAPP

Mattia Epifani published "84 Streams Later", tracking Apple Biome from iOS 14 through iOS 26 and what it means for examiners. Community work at its best: he found the streams and shared samples, we wrote and validated the parsers. iLEAPP went from 45 Biome artifacts to 101 in two days. Where we could check a field against another source on the same device, we did. Call direction against CallHistory, message direction against sms.db, lock state against the DKEvent streams. Where we could not confirm a value, the column says raw and the notes say why. Run from python code to benefit today. Parsers will be added to the next tool release soon Free and open source, as always. Blog: https://blog.digital-forensics.it/2026/07/84-streams-later-exploring-evolution-of.html iLEAPP: https://leapps.org/releases#section-ileapp #DFIR #MobileForensics #iOSForensics

New iLEAPP artifact: Biome - Device TimeZone, contributed by Cynthia van Dorp. Starting around iOS 17, the Device.TimeZone biome stream keeps a record of every timezone the device switches into, each entry with a SEGB timestamp. That means a built-in travel timeline: on one of our test images the output showed the device going New York, then Chicago, then Honolulu, then back, all with exact times. Tested against 8 iOS 17 and 18 images from our corpus before merging. Free and open source, as always. #DFIR #iosforensics #mobileforensics

Happy to share that ALEAPP now integrates Mister Skinnylegs, the browser artifact framework from Alex Caithness and CCL Solutions Group. This adds 28 artifacts targeting Chromium-based browsers and webviews on Android: browsing history, Google/Bing/DuckDuckGo searches, local and session storage, and app-specific data from Binance, Coinbase, Discord, ChatGPT, DeepSeek, Dropbox, Google Drive, Reddit and more. Best part: the artifacts are generated at runtime, so ALEAPP picks up whatever Skinnylegs plugins ship with the version you have installed. Free and open source. #DFIR #mobileforensics #Android

New iLEAPP parser: the United Airlines iOS app! ✈️ New blog post from the awesome James Habben walking through the research: where the data lived, which rabbit holes were worth chasing, and which ones he left alone. 12 new artifacts in iLEAPP: 👤 Account profile 🧳 Saved travelers and trip passengers 🎫 Trips, boarding passes, and PNR documents 🔎 Booking and flight status searches 📋 Boarding status log 🎬 Inflight entertainment watch history ⌚ Watch complications 💬 iMessage recipients from the app's plugin cache The traveler/passenger split, the trip JSON mining, and that late-discovered iMessage plugin cache are the fun ones. Read the write-up, it shows the actual thinking, not just the results. Thank you James! 📖 Read it: https://leapps.org/blog-post?post=united-ios-app-artifacts 🔗 Get iLEAPP: https://www.leapps.org/releases#section-ileapp #DFIR #MobileForensics #DigitalForensics #iOS #FLOSS #iLEAPP

New blog post: Be Careful What You Wish For. We are implementing AI in digital forensics wrong. Here is a new technology that works like a genie. You make a wish, the genie provides. Need a timeline? Ask the genie. A data source you don't understand? Ask the genie, it comes back parsed. What is not to like? Plenty, it turns out. For the last few weeks I have been using Claude extensively on the LEAPPs codebase, reviewing every single PR. That work taught me exactly what the genie can do, what it cannot, and what happens the moment you forget the difference. So I wrote it down. It is about wishes, monkey's paws, and the one thing the genie can never grant you. 📖 Read it: https://leapps.org/blog-post?post=2026-07-12-be-careful-what-you-wish-for #DFIR #MobileForensics #DigitalForensics #AI #FLOSS