ALEAPP / iLEAPP – Open-Source Mobile Artifact Parsers
Parse Android & iOS artifacts, generate interactive HTML reports, and accelerate mobile DFIR.
Why ALEAPP / iLEAPP?
ALEAPP (Android Logs Events And Protobuf Parser) and iLEAPP (iOS Logs, Events, And Plists Parser) are free, open-source DFIR tools widely used to extract and normalize artifacts from mobile device extractions. They support GUI & CLI, run on Windows, macOS, and Linux, and produce interactive HTML reports along with TSV and SQLite outputs for deeper analysis and timelines.
Highlights:
- Hundreds of Android/iOS artifacts: calls, SMS/MMS, contacts, locations, app data, and more.
- Interactive HTML reports for quick triage; TSV/SQLite for pivoting and timeline work.
- Modular design—extend with Python artifact plugins/modules.
- Active community and frequent updates.
Practical Workflow (Step-by-Step)
- Acquire data: Export a logical/FS/TAR/ZIP extraction from the device (via your preferred acquisition tool).
- Run ALEAPP / iLEAPP: Launch the GUI or CLI and point to the extraction folder/TAR/ZIP.
- Select modules: (Optional) filter artifact modules relevant to your case.
- Process & review: Open the generated
index.htmlreport and review artifacts by category. - Deep-dive: Use TSV/SQLite outputs to pivot, join, and timeline events in your analysis tool of choice.
- Validate & report: Correlate across apps/logs and export case-ready findings.
Field Tips from DFIR Practice
- Correlate artifacts: Cross-check app timestamps with system logs (power, network, notifications) to validate user activity.
- Leverage SQLite/TSV: Load exported databases into your analysis stack (e.g., Python/SQL or timeline tools) for richer pivots.
- Extend coverage: When you discover a new app artifact, write a minimal Python parser and drop it in the modules folder.
- Chain-of-custody: Keep acquisition images read-only; export working copies for parsing.
Getting Started (Quick Links)
- ALEAPP GitHub Repository – Download releases, check artifacts, and view documentation.
- iLEAPP GitHub Repository – iOS artifacts support, usage, and updates.
- DFIR Blog Guide – Quick start guide with screenshots.
- ALEAPP Wiki – Artifact details, module contributions, and examples. join to my telegram channel, join to telegram channel .
Use Cases
- Triage at scale: Rapidly parse extractions to prioritize deep analysis.
- App analysis: Recover chats, media, and account data from popular and niche apps.
- Timeline building: Export SQLite/TSV to build cross-app timelines and correlate user activity.
Comments
Post a Comment