LEXIS 1.2.5

LEXIS 1.2.5

LEXIS is a Windows desktop reader for ALEAPP (Android) and iLEAPP (iOS). It is one executable
with both tools inside. Download it, check its hash, and run it: nothing is installed.

Files

File	What it is
LEXIS-1.2.5-win-x64.exe	The reader, with ALEAPP and iLEAPP embedded (Windows 10/11 x64)
LEXIS-1.2.5-win-x64.exe.sha256	SHA-256 of the exe
LEXIS-presentation.pdf	What LEXIS does, its forensic principles, modules and sources
LEXIS-1.2.5-win-x64.zip	All of the above and these release notes, in one download

To check the download:

Get-FileHash .\LEXIS-1.2.5-win-x64.exe -Algorithm SHA256

The hash must be c7ce1c9c5be607baa0c26eaa2869c830eedbe14932ef5e5a4f71d8201c03ae7b.

New in 1.2.5

• Search in file contents and AI results. Besides the report's records, the search reads the text inside the
  extraction's files: PDF pages, Word, Excel, PowerPoint and OpenDocument files, SQLite rows, property lists, text,
  JSON and XML. It also searches the AI results (translations, analyses, descriptions). The text is read once and
  kept beside the case, so later searches do not read the files again. PDFs made only of scanned pages are listed as
  Needs OCR.
• Offline OCR of pictures and scanned PDFs, with Tesseract (carried by LEXIS) or the OCR built into Windows; the
  text goes to the search.
• Search results as a table, one row per record, with filters per column and value facets with counts.
• Media viewer: zoom for pictures, a player for video and audio, a sandboxed PDF viewer.
• Accounts Overview: one row per account of each app or service, with the artifact and column each value came from.
• Sent / received history in the Gallery, also across copies of the same file.
• Camera and Screenshots in the Gallery's origin filter. On Android from the folder and the file name the system
  gives (DCIM/Camera, Screenshots, screen recordings). On iOS from iLEAPP's Photos.sqlite artifacts (taken with the back
  or front camera, screenshot or screen recording), since the camera roll keeps both in the same folder.
• Video analysis with the AI: frames every N % or N seconds, each described by the vision model, and the audio
  transcribed, in one timeline of what is seen and said, with the SHA-256 of each frame sent.
• Documents: one list of the extraction's PDF, Office, OpenDocument, RTF and iWork files, typed from their first bytes.
• Details in tabs: Text Extraction (the file's text, part by part, with its translation) and AI Analysis (every
  analysis of the item and a summary). The examiner can correct or exclude an analysis; the model's text is kept.
• WhatsApp (iOS) own account and Telegram (iOS) chats by account: these need a new run of the report (analyze again if using older LEAPP folder).

What's new since 1.2.0

Messaging apps

• WeChat: every account on the device, not only the signed-in one. This includes accounts encrypted with another IMEI. Voice messages (SILK) can be played, and calls show the text the app shows.
• WhatsApp backups (Android): crypt12/14/15 backups are decrypted with the key found in the extraction. Messages deleted from the active database but still in a backup are recovered and marked.
• WhatsApp Business alongside WhatsApp (Android and iOS). Message types are named, with a new Content column (deleted, view once, poll, contact card, edited). New Contact Cards and View Once Media tables. On iOS, the account's own JID and name.
• Deleted messages recovered by carving: free pages, older page versions and the WAL of the messaging apps' databases (SMS, Messenger, Viber, Telegram, Signal, WhatsApp and more). Recovered records are marked in red.
• Signal (Android): edits, deletions, mentions and stories. Session messages are decrypted when the key is in the extraction. Recovery apps (WAMR, Notisave…) keep captured notifications, and LEXIS now reads them.
• Chats: Private/Group type, account column and picker, split per account, per SIM and per backup. Telegram (iOS) chats are grouped by account.

Case overview

• Case Summary with Overview, Device, SIM cards, Owner & accounts, Users and Report tabs. SIM history merged from every source, with MCC/MNC. Shows whether LEXIS or ALEAPP/iLEAPP made the report.
• Accounts Overview: one row per account of each app or service, merged from all artifacts, with the source of every value (Android and iOS, Apple IDs included).

Search

• Results as a filterable table. Search also covers file contents (PDF, Office, OpenDocument, SQLite, plist, text, JSON, XML) and the AI results.
• Keyword lists from a file, in any language and encoding. Whole-word search works for Chinese, Japanese and Thai.
• Offline OCR: Tesseract is bundled (12 languages), or you can use the OCR built into Windows. Scanned PDFs are supported.

Media and documents

• Media viewer: zoomable pictures, a video and audio player, and a sandboxed PDF viewer.
• Gallery: each file shows every message it was sent or received in. New Camera and Screenshots origin filters: on Android they come from the path, on iOS from Photos.sqlite.
• Documents node listing the extraction's PDF, Office, OpenDocument, RTF and iWork files, typed by content.

AI

• Video analysis: frames are described and the audio is transcribed, giving a timeline. The SHA-256 of every frame sent is recorded.
• whisper.cpp setup from inside LEXIS, with hash verification. Opus, AMR, M4A and MP3 are transcribed without installing ffmpeg.
• Engines per job: Ollama, LM Studio, the Claude CLI and whisper.cpp. You can also run parallel requests.
• AI on right-click wherever data is shown, and Explain on a single record. Details are split into tabs: Text Extraction and AI Analysis. The examiner can correct or exclude an analysis, and nothing is deleted.
• Summaries cite every record and cover media. The MCP server lists the case's artifacts first.

Fixes

• No more false "still running" prompt when an extraction finishes.
• Case Summary error with navigation group tabs.
• SQLite reader: the decoded cell panel stayed empty, and carved rows showed NULL.
• Chat date filter found nothing.
• Gallery › Whole extraction: Sent/Received found nothing, and the AI read only the first of duplicate files.
• SILK voice messages are transcribed from the decoded WAV.
• AI corrections now apply everywhere. Several video-analysis edge cases fixed.
• Security hardening:
  • whisper.cpp downloads are accepted only from the project's own release URL, with a size check.
  • ffmpeg, whisper-cli and the Claude CLI stop after a time limit.
  • Temporary files are cleaned up.
  • OCR has pixel limits.

Some features need the extraction processed again with this version: WhatsApp/Telegram iOS accounts, WeChat voice files.

Full details in CHANGELOG.md (che the repository).

LEXIS - 1.2 LEAPPS Reader

LEXIS 1.2.0 — first public release

Connect the devices, read the story.
LEXIS is a multi-device mobile forensics workstation built on ALEAPP and iLEAPP. It runs as one portable Windows exe that is read-only by design. There is no Python, no install and no setup: download it, check the hash, and open your case.

Check Logics and Architecture here https://g33kf.github.io/LEXIS

Why LEXIS

• One exe, two engines. ALEAPP (Android) and iLEAPP (iOS) are embedded. Open an existing LEAPP report or analyze a fresh extraction: folder, zip, tar, iTunes/Finder backup (encrypted too) or adb backup.
• Multi-device by design. Investigation cases hold every phone of the case side by side, with a joint timeline, a joint map, co-presence (who was where, together) and common contacts across devices.
• Read the data, not the tables.
  • Chats rendered as conversations, exportable to HTML reports.
  • A timeline of every datetime field.
  • A map with zones of interest.
  • A media gallery linked to the messages.
  • Statistics of user activity.
  • One search syntax across every device.
• Down to the bytes. The Extraction Files browser has magic-byte typing and browses nested archives. A SQLite reader carves records from the WAL and free pages, and a plist reader resolves NSKeyedArchiver.
• Indicators. STIX2 and hash sets, root and jailbreak traces, weakened security settings, and crypto addresses and seed phrases checked by their checksum.
• Evidence-grade handover.
  • Tags and notes on anything.
  • Portable cases with the source or tagged files, each checked by SHA-256 and signed with the examiner's ECDSA key, with built-in package verification.
  • A log of every export.
• AI, on your terms. Off by default and local first (Ollama, LM Studio, whisper.cpp). Every answer cites its records. An MCP server lets any MCP client read the open case.

Download

File
LEXIS-1.2.0-win-x64.exe	The application (Windows 10/11 x64)
LEXIS-1.2.0-win-x64.exe.sha256	Checksum
LEXIS-presentation.pdf	Features, forensic principles, modules and sources

To check the download:

Get-FileHash .\LEXIS-1.2.0-win-x64.exe -Algorithm SHA256
# fc4c4dadd14f1527585aa8faf68f41000839ebb564529e555cbe757aa9dd61b2

The exe is not code-signed, so SmartScreen may warn on first launch. Verify the hash, then choose More info → Run anyway.

Credits

Built on ALEAPP and iLEAPP by Alexis Brignoni and contributors (MIT). Every other source and licence is listed in the README.
LEXIS is an independent project, not affiliated with or endorsed by the LEAPP project.

Contact: info@gk-forensics.com · LinkedIn