iLEAPP v2026.4.5

• Python 3.11 or newer is now required to run from source. Python 3.15 is listed as supported, with Windows wheels for it and for ARM64.
• Windows downloads are now one portable file per architecture, with no installer.
• Staged files: --hash, or the window's new checkbox, records a SHA-256 for staged files, and the times their container recorded: zip NTFS and extended timestamp fields, tar headers (including GNU and PAX access and change times and the libarchive creation time), L01 and AD1 entries, FAT and exFAT entries (as stored, with no zone applied), and the ext, APFS and HFS+ times qnxprobe 1.76 reads.
• Zip times: on four-value extended timestamp blocks (as in GrayKey style files_full.zip) the creation time comes from the fourth value, and Cellebrite CLBX zips take their times from metadata.msgpack, since in the CLBX zips tested every extended timestamp slot holds the access time. This adds msgpack as a dependency. Background: the blog post.
• Reading acquisitions with -t raw: qnxprobe goes from 1.58 to 1.76 and ewfprobe to 0.15.0. LVM2 logical volumes (including split, striped and RAID1 ones), LUKS containers opened with their passphrase, RAID member images read together, and FAT12 and FAT16 are read. Free space, a flash filesystem's deleted files and NTFS directory indexes are offered to artifacts that ask for them. Each file read through missing acquisition data is named.
• Encrypted iTunes backups: files are staged at their stored length, not the manifest's Size, and the decrypted Manifest.db is staged without its padding block.
• Tar links are read as the member they point to, and corrupt zip members are skipped instead of stopping the run. A WAL-mode SQLite database staged without its -wal is opened read-only with immutable=1.
• Unified logs and sysdiagnose: logarchive is read from a sysdiagnose, with new artifacts for unlock, buttons, orientation, gestures, USB host, wake source, AirDrop, calls, weather, family hotspot, charging state, app snapshots, container entries and data usage. From @danjethh: URL and link opens, camera and microphone capture sessions, TCC authorization cache and location manager state, Screen Time (ManagedSettings), BatteryUI per-app runtime, and Container Manager State for iOS 27. Unified Log filtering is faster and reports progress.
• Life360: 32 new artifacts from @CyberMike81, including crash-detection diagnostics and recovered history. Also from @CyberMike81, generic Mixpanel and Crashlytics artifacts.
• New: Apple Watch photo collections, registry history, Mail registry and Weather Cities; Photos Graph Moment Locations, routined visits and vehicle events, and Cache Locations course, altitude and accuracy from @charpy4n6; KeepSafe photo vault; Reddit post and subreddit history; Anonymous Chat from @darren33; Emoji Recents, Usage and Preferences from @ayobamiseun; an account-wide encryption key hash artifact from @Rugikex; offline DJI TXT flight records from @Blackwater1224; Discord - Servers; Battery Center; Alarms sleep alarms; Apple Music search, Media Experience, Media Remote, Photos Recent Searches, Hashtag Images and supplementary WebKit cache parsers.
• Snapchat messages gain Local Media ID and Created On Device from @segumarc, and Bumble works with LAVA's conversation view from @frahmco.
• Fixes: Telegram messages no longer stop on a short media ID (@mvanhorn) and are kept when a media entry cannot be read, the Claude app's storage is found after version 1.261005.20 and ChatGPT temporary media come only from a marked ChatGPT container (@ayobamiseun), GroupMe reads every GroupMe.sqlite, iTunesMetadata dates are read as UTC, the iOS version readers run first, and Media Cache rebuilds cached video and audio.
• An accuracy review of the artifact modules: descriptions, notes and headers were checked against the code and the data, values are reported as stored, unsupported labels are gone, and rows that were being dropped are kept.
• Apple build ID to iOS version table updated by @Johann-PLW. Contributor docs: a helper functions guide.

New Contributors

• @CyberMike81 made their first contribution in #2431
• @ayobamiseun made their first contribution in #2426
• @frahmco made their first contribution in #2317
• @segumarc made their first contribution in #2472
• @danjethh made their first contribution in #2311
• @darren33 made their first contribution in #2166
• @ForensikITGmbH made their first contribution in #2491
• @dajiaohuang made their first contribution in #2525
• @Blackwater1224 made their first contribution in #2536
• @mvanhorn made their first contribution in #2564

Full Changelog: v2026.4.4...v2026.4.5

Which file to download

Every download holds one program, ileapp. Started without arguments, from the
Applications folder or a double-click, it opens the window. Given arguments in a terminal,
it is the command line. On macOS the command line is inside the app:

/Applications/iLEAPP.app/Contents/MacOS/ileapp --help

For tools that run iLEAPP themselves. The options, output and exit codes of ileapp
are those of earlier releases, but there is no ileappGUI any more, since ileapp
without arguments opens the window. On Windows the zip holds the whole program as one
file, ileapp.exe, which can be put wherever the tool expects it; there is no installer.
The executable inside the macOS app needs the folder it came in; on Linux the AppImage is
the whole program.

ileapp.exe on Windows unpacks itself to a temporary folder each time it starts, so it
takes a few seconds to start, and it does not run where a policy (AppLocker, WDAC) forbids
running programs from the temporary folder. There, run iLEAPP from source; the README has
the steps.

First launch

The macOS disk images are signed with a Developer ID and notarised by Apple, so they open
without a warning.

The Windows binaries are not signed yet, so SmartScreen says "Windows protected your PC"
the first time. Choose More info, then Run anyway.

On Linux, make the AppImage executable once (chmod +x iLEAPP-*.AppImage). It needs FUSE
to start; where FUSE is not available, run it with --appimage-extract-and-run.

If you would rather not clear a warning, run from source instead; the README has the steps.

Verify what you downloaded

SHA256SUMS.txt covers every file in this release. On macOS or Linux, from the folder you
downloaded into:

grep <the file you downloaded> SHA256SUMS.txt | shasum -a 256 -c -

Use sha256sum in place of shasum -a 256 on Linux. On Windows, in PowerShell:

(Get-FileHash -Algorithm SHA256 .\<the file you downloaded>).Hash

and compare it with the line in SHA256SUMS.txt, which is lower case.

Linux

The build is made on Ubuntu 22.04, so it needs glibc 2.35 or newer and will not start on
an older distribution.

Code signing policy

The code signing policy covers
Windows signing, team roles and privacy.

iLEAPP v2026.4.4

• Safari: a new Safari Browser - History Tags artifact, with one row per link between a tag and a history item and a row for each tag no item is linked to. Safari Browser - History gains Tags and Tag Identifiers columns, and both artifacts gain a Profile Name column read from SafariTabs.db.
• knowledgeC: a new Location Activity artifact for the /app/locationActivity stream, with the place name, address and coordinates, and the other coordinate pairs the record holds beside them.
• Sysdiagnose: a new Sysdiagnose - Wifi Status artifact, and TCC app permissions are now read from a sysdiagnose packed inside an extraction. Both from Kevin Pagano.
• Session: contacts are read from databases written by older Session versions, and messages link the attachments Session 2.14.2 names by a hash of their download URL.
• Reading acquisitions with -t raw: qnxprobe is updated to 1.57. On NTFS, a cloud provider's online-only placeholder (OneDrive Files On-Demand) is no longer staged as zeros, a file the Windows Overlay Filter compressed with XPRESS is staged as its content, and an NTFS-compressed file with a compression unit that ends early is staged at its full length. In flash dumps, JFFS2 compressed with OpenWrt's LZMA and UBI/UBIFS with bit errors are read, two JFFS2 partitions side by side are read as two filesystems, and a U-Boot environment or Belkin NVRM store is listed as a volume holding one file.
• The macOS disk image has a new background, with the icons centred on its arrow.

Full Changelog: v2026.4.3...v2026.4.4

Which file to download

Every download holds one program, ileapp. Started without arguments, from the Start
menu, the Applications folder or a double-click, it opens the window. Given arguments in a
terminal, it is the command line. On macOS the command line is inside the app:

/Applications/iLEAPP.app/Contents/MacOS/ileapp --help

For tools that run iLEAPP themselves. The options, output and exit codes of ileapp
are those of earlier releases, but the downloads changed shape: there is no ileappGUI
any more, since ileapp without arguments opens the window. On Windows and macOS,
ileapp needs the folder it came in, so run it from there rather than copying the
executable elsewhere on its own; on Linux the AppImage is the whole program.

First launch

The macOS disk images are signed with a Developer ID and notarised by Apple, so they open
without a warning.

The Windows binaries are not signed yet, so SmartScreen says "Windows protected your PC"
the first time. Choose More info, then Run anyway.

On Linux, make the AppImage executable once (chmod +x iLEAPP-*.AppImage). It needs FUSE
to start; where FUSE is not available, run it with --appimage-extract-and-run.

If you would rather not clear a warning, run from source instead; the README has the steps.

Verify what you downloaded

SHA256SUMS.txt covers every file in this release. On macOS or Linux, from the folder you
downloaded into:

grep <the file you downloaded> SHA256SUMS.txt | shasum -a 256 -c -

Use sha256sum in place of shasum -a 256 on Linux. On Windows, in PowerShell:

(Get-FileHash -Algorithm SHA256 .\<the file you downloaded>).Hash

and compare it with the line in SHA256SUMS.txt, which is lower case.

Linux

The build is made on Ubuntu 22.04, so it needs glibc 2.35 or newer and will not start on
an older distribution.

Code signing policy

The code signing policy covers
Windows signing, team roles and privacy.

iLEAPP v2026.4.3

• New downloads: iLEAPP is now built by one packaging driver on every platform. Windows gets an installer and a portable zip, macOS gets a signed and notarised disk image, and Linux gets an AppImage, for both Intel/AMD and ARM. There is one program, ileapp: started without arguments it opens the window, and given arguments it is the command line. There is no separate ileappGUI any more, and the download names changed. See "Which file to download" below.
• More ways to read acquisitions with -t raw: E01 and Ex01, SMART, AFF and AFD images, Apple disk images (.dmg, .sparseimage, sparse bundles and segmented sets), encrypted Apple disk images, FTK Imager AD-encrypted images, and encrypted APFS volumes, each opened with the password you give. NTFS alternate data streams are now readable, and qnxprobe is updated to 1.51.
• New app support for iOS: Roblox, KakaoTalk, WeChat, Telekom Mail, BOTIM, VK Messenger, Odnoklassniki, SimpleX Chat and Health walking and running distance, plus a new Intelligence Platform family (knowledge graph, expired interactions, behaviors timeline and event locations) and Biome sync merged events. Snapchat Friends became Snapchatter Records and now reads the friends list.
• Newer iOS: Call History columns for iOS 26, older-layout Reminders columns, and the 6xxx builds Apple publishes beside current releases added to the build table. Sysdiagnose Process now builds a process tree from ps.txt.
• Faster and lighter runs: artifacts can stream their rows instead of holding them, and the Unified Log and PowerLog imports now do. Zip archives no longer walk every member to look for repeated names, a compressed tar is decompressed once, and the GUI accepts .tar.xz.
• Reporting accuracy: the LAVA database and media items are recorded by their evidence path rather than the examiner's own folder, Safari history rows are ordered by visit time, ORDER BY ties break on row id, Python text is stored for floats and booleans, test case zips keep each member's recorded times, and archive members named like Windows devices are renamed when staged.
• Fixes: a folder input no longer stages the examiner's files for links that point outside it, a socket or block device is no longer walked as a directory, Zangi reads the new message schema, and Proton Mail body text marks where each link sat.

New Contributors

• @mathisdesaulty made their first contribution in #2197

Full Changelog: v2026.4.2...v2026.4.3

Which file to download

Every download holds one program, ileapp. Started without arguments, from the Start
menu, the Applications folder or a double-click, it opens the window. Given arguments in a
terminal, it is the command line. On macOS the command line is inside the app:

/Applications/iLEAPP.app/Contents/MacOS/ileapp --help

For tools that run iLEAPP themselves. The options, output and exit codes of ileapp
are those of earlier releases, but the downloads changed shape: there is no ileappGUI
any more, since ileapp without arguments opens the window. On Windows and macOS,
ileapp needs the folder it came in, so run it from there rather than copying the
executable elsewhere on its own; on Linux the AppImage is the whole program.

First launch

The macOS disk images are signed with a Developer ID and notarised by Apple, so they open
without a warning.

The Windows binaries are not signed yet, so SmartScreen says "Windows protected your PC"
the first time. Choose More info, then Run anyway.

On Linux, make the AppImage executable once (chmod +x iLEAPP-*.AppImage). It needs FUSE
to start; where FUSE is not available, run it with --appimage-extract-and-run.

If you would rather not clear a warning, run from source instead; the README has the steps.

Verify what you downloaded

SHA256SUMS.txt covers every file in this release. On macOS or Linux, from the folder you
downloaded into:

grep <the file you downloaded> SHA256SUMS.txt | shasum -a 256 -c -

Use sha256sum in place of shasum -a 256 on Linux. On Windows, in PowerShell:

(Get-FileHash -Algorithm SHA256 .\<the file you downloaded>).Hash

and compare it with the line in SHA256SUMS.txt, which is lower case.

Linux

The build is made on Ubuntu 22.04, so it needs glibc 2.35 or newer and will not start on
an older distribution.

iLEAPP v2026.4.2

• New Sysdiagnose parsing support: initial sysdiagnose parsers added, PowerLog databases now read inside packed sysdiagnoses, AppleDouble sidecars filtered out of sysdiagnose readers, and the shutdown log's sysdiagnose matching fixed.
• Messenger and messaging fixes: Facebook app's own Messenger mailbox now read, client message sender resolved through fb_transport_contacts, missing timestamps and attachment file names correctly recorded as absent, WhatsApp forward metadata read with a fixed-field wire reader, and WhatsApp messages no longer abort when ZMETADATA isn't a blob.
• New media/vault handling: Snapchat iOS Memories and chat media added, Calculator Vault videos checked in as proper media (looked up in their own album folder), Photos.sqlite face crops shown as media instead of a raw folder path, and the legacy media_to_html function removed entirely.
• Forensic input and performance improvements: NTFS and APFS images now read in one pass with qnxprobe 1.30, the LAVA database now commits once per artifact instead of once per staged file (improving performance), oversized HTML report tables held back with a summarized view, and zip/tar member names stored more than once now staged as a single file.
• Reporting accuracy: evidence-relative source paths recorded for directory and single-file inputs, duplicate Mobile Installation log lines reported only once, and Keyboard Input Contexts now decode chat type and party from identifiers (scoped to the measured Messenger form).

Full Changelog: v2026.4.1...v2026.4.2

iLEAPP v2026.4.1

• Adopted unifiedlog_iterator v0.7.0: updating the Apple Unified Logs parsing engine to its latest upstream release.
• Add latest iOS, macOS, tvOS, visionOS and watchOS releases.

Full Changelog: v2026.4.0...v2026.4.1

iLEAPP v2026.4.0

• Forensic input expansion: raw disk images and E01 acquisitions now readable directly via a new -t raw flag, with qnxprobe re-vendored to add F2FS filesystem support and fix a NAT copy-selection bug.
• GUI responsiveness fix: artifact crunching now runs on a worker thread so the interface no longer freezes during processing, with follow-up fixes resetting stdout and guarding the close button.
• New app coverage: full support for Garmin Connect (including the Move IQ activity series), Tutanota, and MEGA cloud storage on iOS, plus a new Apple SMS preview attachments (ATX in KTX) artifact and expanded WhatsApp call record parsing.
• Location and reporting accuracy: WiFi network store geotags now linked to networks through their recorded relationships, KML placemarks in two location artifacts named by timestamp, and plain Latitude/Longitude column headers restored for clarity.

Full Changelog: v2026.3.3...v2026.4.0

iLEAPP v2026.3.3

• New app coverage: 25+ new parsers added, including Nest, August/Yale, Google Home, myQ, Samsung Family Hub (smart home/IoT), Coinbase Wallet, Spotify, TextNow, Zoom chat, Brave, Notion, GETTR, Houseparty, CoverMe, Skout, Private Photo Vault, IFTTT, LG ThinQ, New York Times, GPS Tracks and GPX file support, and Foursquare Pilgrim location data.
• New forensic input formats: iOS diagnostic reports (.ips) and a Sysdiagnose Extraction Helper, expanding what raw material iLEAPP can ingest directly.
• MMKV parsing overhaul: a dedicated mmkv_parser vendored and iterated through several revisions (decryption support, correct varint header handling, fixing a false-positive encryption flag), plus a new MMKV - Recovered Records artifact and a reworked Discord account artifact reading its MMKV store directly.
• Data-quality and container-scoping fixes: TikTok IM/Pitaya/WatchHistory artifacts scoped to TikTok-owned containers, Line messenger now reads every store (not just the first) and reports orphaned attachments, Fitbit/IMO HD schema-tolerance fixes for older stores, and sample_data can now be generated directly from a test image via a new --emit flag.

New Contributors

• @vikrosj made their first contribution in #1983

Full Changelog: v2026.3.2...v2026.3.3

iLEAPP v2026.3.2

• New apps: Amazon Shopping, Google Photos, Google Calendar, Google Sheets, Google Docs, Google Maps, Netflix, Pinterest, Firefox, Coinbase, Grindr, Fitbit, and KeepSafe (photo vault, with vault items, albums, account/PIN security), plus new TeleGuard calls, account and drafts artifacts.
• Container-scoping hardening: Pinterest, Tinder, and Google Drive/Sheets artifacts now correctly scoped to their own app container, preventing cross-app data bleed.
• Timestamp and timezone fixes: corrected Unix timestamp conversion for pre-1970/pre-2001 values, timezone-dependent decoding fixed in the mail headers artifact and five additional artifacts, and baseline recording now standardized on TZ=UTC.
• Source-path and reporting accuracy: real device/source paths now reported instead of the examiner's own folder structure, extraction-relative paths enforced library-wide, and a report checker crash on large TSV cells resolved.

New Contributors

• @forest-savage1234 made their first contribution in #2027
• @ChrisJr404 made their first contribution in #1985

Full Changelog: v2026.3.1...v2026.3.2

iLEAPP v2026.3.1

• Broad new app coverage: Snapchat, Tinder, OneDrive, TikTok (Watch History, Account, Published Videos, App Sessions), Reddit (user, subscription data), and Google Drive DriveKit.
• Proton Mail Inbox Messages now includes a conversation view with inline media, and WhatsApp add-on artifacts cover reactions, channel tallies, group events, and membership changes.
• Chrome/Chromium additions: saved credit cards and payments customer data artifacts, plus Chromium databases that fail to open are now skipped instead of aborting the artifact entirely.
• Accuracy and correctness fixes: Onion Browser now correctly identified and parsed from its real app stores, DuckDuckGo absent boolean columns reported as empty rather than "No", GroupMe message deletion state now reported, and a Windows long-path SQLite fix normalizing paths to forward slashes.

Full Changelog: v2026.3.0...v2026.3.1

iLEAPP v2026.3.0

• New Apple Unified Logs support: parser bundled into all builds, 16+ artifacts added from a predicate survey, plus rotated/sysdiagnose PowerLog support with time-offset correction and over a dozen new Power Telemetry/PowerLog artifacts (EPSQL, BGSQL).
• Major messaging expansion: Telegram (accounts, contacts/peers, chats, cached peer details, device contacts, presence, message tags), Wickr (messages, account identity via keychain), Session/Oxen (decrypted messages, contacts, attachments), plus new app parsers for DuckDuckGo, MEGA, Onion Browser, what3words, Dubox/Terabox, Claude, Apple Intelligence Report, and Lidl Plus (SQLCipher + Keychain).
• Continued Biome/SEGB coverage: Networking Edge Selection, DuetExpertCenter notifications, Privacy Accounting streams, Contact Autocomplete Feedback, and multiple case-sensitivity/path-glob fixes preventing duplicated or dropped rows across sibling artifacts.
• Documentation integrity push: unsourced claims removed across dozens of artifacts, sample_data re-recorded from a full corpus run, corpus keys mapped to public test images, and a new CI tripwire guarding against unsupported claim language.
• Security and stability hardening: HTML report injection fixes (escaped evidence names, removed remote destinations, new CI guard), WAL visibility restored for SQLite artifacts, fixes for concurrent-run history.json corruption, FSEvents/PowerLog temp-file leaks cleaned up, and expanded CI (Python 3.13/3.14 runtime contract, Windows/Linux/ARM64 test builds, import smoke tests).

New Contributors

• @bcbtree made their first contribution in #1889
• @malwr4n6 made their first contribution in #1729

Full Changelog: v2026.2.1...v2026.3.0