Blog
Forensics deep dives, tool updates, artifact write-ups, and community contributions.
DFIR Thoughts: Put AI in the code, not the conclusions
Handing examiners a chatbot that draws conclusions from parsed data is the wrong way to bring AI into digital forensics. Here is why, and what I do instead with a known-data corpus, tested code and CI checks.
Dropbox DBX Decryption, Nine Years Later
An update to the 2017 Zena Forensics post on decrypting Dropbox DBX files. The key moved out of DPAPI and into a file next to the databases. Heather and I built DLEAPP artifacts that read it, plus the sync history, file trees, thumbnails and more.
Nineteen New Unified Log Artifacts for iLEAPP and DLEAPP
Six new unified log artifacts for iOS in iLEAPP and thirteen for macOS in DLEAPP, what each one was measured on, and what none of them can tell you. Also why the iOS queries could not simply be copied over to the Mac.
Meet GLEAPP, Media Triage Built for the Backlog
A modern extraction can hold tens of thousands of images and videos. GLEAPP hashes and de-duplicates them, finds the same face across the case, puts geolocated files on an offline map, and gives you a gallery built for categorizing. Free and open source.
Reading the iPhone Knowledge Graph, and Checking Its Work
Your iPhone quietly builds a knowledge graph about you: who you know, where you go, what you run. iLEAPP now reads it, and the inferred locations line up with a documented activity log on Josh Hickman's public iOS 17 image.
You down with MMKV?
An interview with MMKV, the key-value store inside TikTok, Discord, Coinbase and more than a billion WeChat accounts. It never takes a note down, its neighbor knows when it is locked, and one zero byte means three different things.
Powerlog Timestamps, Offsets, and a Clock That Thinks It's 1971
A powerlog row does not store the time. It stores a stopwatch, and a second table tells you how far off it is. Here is why the offset is 69 seconds on one phone and 54 years on another, why forensic tools disagree, and which columns actually need the correction.
The VLEAPP Revival. Reading the Whole Head Unit.
VLEAPP sat mostly still for twenty-one months because it could only take logical extractions, and vehicle evidence does not arrive that way. This month it came back. Raw head unit images and native Berla iVe exports now go straight in, read through seven filesystem families plus QNX boot images, most of which no mainstream open source tool could touch. Here is what landed, how it was validated, and what we need from you.
The App Is Gone. The Story Isn't.
A current app list answers one question. Installation logs, App Store databases, Biome streams, and deletion records answer several others. We went back to an iOS workflow from 2018, tested it from iOS 12 through iOS 26, fixed what the real data exposed, and found a much better way to tell the story.
iOS App Snapshots, Seven Years Later: The Screen, the Scene, and Three Clocks
iOS still keeps app-switcher snapshots, but the storage moved, scenes arrived, and that mysterious second timestamp finally has a name—not a license to overclaim. We went back to the files, joined the picture to its manifest, and tested the result from iOS 12 through iOS 26.
Using AI Effectively in Digital Forensics
A decent version of most digital forensics software can now be made at home, in a few hours, by a user that does not code. What does that mean for vendors and for us as users, and what actually makes someone an expert in the AI context? Five qualities.
Telegram System Events: The Cross-Platform Reference
Every system event Telegram can record in a chat, on both iOS and Android, with what each one means, what the clients call it on each platform, and which ones the LEAPPs parsers decode in detail.
Telegram on Both Sides: New iOS and Android Coverage in iLEAPP and ALEAPP
Telegram now has fifteen artifacts across iLEAPP and ALEAPP, covering accounts, chats, contacts, cached profiles, and the app settings that tell you whether media ever touched the device. Here is what we added, what it proves, and the parts we could not validate.
Every Step You Take, Eight Years Later: Android UsageStats and Recent Tasks
Android's pattern-of-life evidence grew from readable XML into tokenized protobufs carrying app lifecycle, lock state, notifications, services, task roots, and more. We went back to the source, updated ALEAPP, and came away with better data—and better warnings about what it actually proves.
Apple Unified Log Predicates in iLEAPP: The Reference
Every Unified Log message predicate iLEAPP searches for, artifact by artifact, with the processes involved, the iOS versions each pattern was observed on, the sources that documented them, and the caveats that keep you honest.
Extracting, Processing, and Querying Apple Unified Logs from an iOS Device
Apple Unified Logs can show locks, app launches, connectivity, navigation, and more. iLEAPP now parses them natively on Windows, Linux, and macOS. No Mac and no JSON conversion required. Here is the updated workflow.
Introducing DLEAPP
The seventh LEAPP is here. DLEAPP parses desktop application artifacts — Discord, Signal, WhatsApp, and Wire so far — and gives a home to any artifact that does not fit the other LEAPPs. Packaged for Windows, macOS, and Linux.
Everybody Gets a Release!
iLEAPP, ALEAPP, RLEAPP, and VLEAPP are all at v2026.2.0, and LAVA is at v0.14.0. Biome artifacts, iOS 26 photos, AI image provenance, recovered clipboards, a Snapchat overhaul, row tagging in LAVA, and a lot more.
Digital Forensics Now Ahora Habla Español
The Digital Forensics Now podcast now has a Spanish edition, in our own voices, built with open source AI models running locally and verified line by line by a native speaker. Para la comunidad DFIR de habla hispana.
ASTC, Cython, and bugs!
What do texture decompression, C-extensions for python, and LEAPPs have in common? Read to find out!
Feature Highlight: Recent Run History in LAVA
A quick look at the new opt-in LEAPPs recent run history feature and how LAVA can use it to put recent parser outputs right on the welcome screen.
A Trip Through the United iOS App
A look at United Airlines iOS app research in iLEAPP, including where the data lived, which rabbit holes mattered, and why nearby app/plugin data can change the shape of the parser.
Be Careful What You Wish For
The genie can grant almost anything. It cannot grant you judgment. And judgment is the one thing you need in order to control it.
Spotting AI Generated Images in iLEAPP and ALEAPP
iLEAPP and ALEAPP can now flag AI generated images by reading content provenance two ways, C2PA Content Credentials manifests and the IPTC Digital Source Type in XMP. Pure Python, no new dependencies, and usable today straight from the source.
The Rules Keep Changing
The first fully LLM-generated set of artifacts lands in iLEAPP: fourteen Biome parsers built from public community research and test data, 3,668 rows of previously unparsed data on the first clean pass. If coding is now accessible to everyone, what does that mean for tooling in digital forensics?
The Apps We Are Not Parsing (Yet)
Batch LEAPP now answers a question I have wanted answered for years. Out of all the apps installed on our test devices, which ones do the LEAPPs actually parse, and which ones are we missing? One flag, one database, and a data-driven module-writing roadmap.
SELECT * FROM life360 WHERE alibi = FALSE;
A forensic analysis of the Life360 app on Android — account identifiers, Circle members, saved Places and alerts, pet trackers, drives and driving events, location history, waypoints, and battery levels, all now supported in ALEAPP.
Getting It Done with Home Depot iOS Artifacts
A look at new iLEAPP parsing for the Home Depot iOS app, including account details, store preferences, searches, viewed products, shopping lists, cached location, and a few useful cache artifacts.
Introducing Batch LEAPP
Batch LEAPP runs any LEAPP tool across an entire folder of extractions and builds one report index that links every result, with hashing and a manifest for your case file. Here is what it does and how to get it.
Installing LEAPPs and LAVA on macOS with Homebrew
Mac users can install the LEAPPs, GLEAPP and LAVA with a few Homebrew commands from the LEAPPs tap.
Decoding Apple ATX Images in iLEAPP
Wallpaper research led to a broader Apple image-cache problem: ATX texture files. Here is how iLEAPP now parses and decodes many of them, with a reusable parser that should be easy to port into other tools.
Recovering Pre-iOS 16 Wallpaper from SpringBoard
A quick research note on extracting older iOS wallpaper files from SpringBoard, including legacy cpbitmap conversion and JPG thumbnail handling in iLEAPP.
How to Write an iLEAPP Module
The LEAPPs ecosystem runs on contributions. A module is a single Python file, and this guide walks through everything: module structure, SQLite and plist parsing, timestamps, media, LAVA conversation view, the checks pull requests run, and submitting one.
LEAPPing with LAVA
LAVA is another way to view reports created out of iLEAPP, ALEAPP, RLEAPP, and VLEAPP. Here is a look at the new features that make it stand out from the HTML reporting it is set to replace.
Website Update - Search, Better Docs, and More
The LEAPPs website got a big update. Here is a rundown of everything that changed, from site-wide search to improved docs and a more consistent footer across every page.
Introducing the LEAPPs Blog
The LEAPPs project now has a blog — a place for artifact deep dives, tool updates, and community write-ups. Here's how it works and how you can contribute.