LEXIS 1.2.5

LEXIS 1.2.5

LEXIS is a Windows desktop reader for ALEAPP (Android) and iLEAPP (iOS). It is one executable
with both tools inside. Download it, check its hash, and run it: nothing is installed.

Files

File	What it is
LEXIS-1.2.5-win-x64.exe	The reader, with ALEAPP and iLEAPP embedded (Windows 10/11 x64)
LEXIS-1.2.5-win-x64.exe.sha256	SHA-256 of the exe
LEXIS-presentation.pdf	What LEXIS does, its forensic principles, modules and sources
LEXIS-1.2.5-win-x64.zip	All of the above and these release notes, in one download

To check the download:

Get-FileHash .\LEXIS-1.2.5-win-x64.exe -Algorithm SHA256

The hash must be c7ce1c9c5be607baa0c26eaa2869c830eedbe14932ef5e5a4f71d8201c03ae7b.

New in 1.2.5

• Search in file contents and AI results. Besides the report's records, the search reads the text inside the
  extraction's files: PDF pages, Word, Excel, PowerPoint and OpenDocument files, SQLite rows, property lists, text,
  JSON and XML. It also searches the AI results (translations, analyses, descriptions). The text is read once and
  kept beside the case, so later searches do not read the files again. PDFs made only of scanned pages are listed as
  Needs OCR.
• Offline OCR of pictures and scanned PDFs, with Tesseract (carried by LEXIS) or the OCR built into Windows; the
  text goes to the search.
• Search results as a table, one row per record, with filters per column and value facets with counts.
• Media viewer: zoom for pictures, a player for video and audio, a sandboxed PDF viewer.
• Accounts Overview: one row per account of each app or service, with the artifact and column each value came from.
• Sent / received history in the Gallery, also across copies of the same file.
• Camera and Screenshots in the Gallery's origin filter. On Android from the folder and the file name the system
  gives (DCIM/Camera, Screenshots, screen recordings). On iOS from iLEAPP's Photos.sqlite artifacts (taken with the back
  or front camera, screenshot or screen recording), since the camera roll keeps both in the same folder.
• Video analysis with the AI: frames every N % or N seconds, each described by the vision model, and the audio
  transcribed, in one timeline of what is seen and said, with the SHA-256 of each frame sent.
• Documents: one list of the extraction's PDF, Office, OpenDocument, RTF and iWork files, typed from their first bytes.
• Details in tabs: Text Extraction (the file's text, part by part, with its translation) and AI Analysis (every
  analysis of the item and a summary). The examiner can correct or exclude an analysis; the model's text is kept.
• WhatsApp (iOS) own account and Telegram (iOS) chats by account: these need a new run of the report (analyze again if using older LEAPP folder).

What's new since 1.2.0

Messaging apps

• WeChat: every account on the device, not only the signed-in one. This includes accounts encrypted with another IMEI. Voice messages (SILK) can be played, and calls show the text the app shows.
• WhatsApp backups (Android): crypt12/14/15 backups are decrypted with the key found in the extraction. Messages deleted from the active database but still in a backup are recovered and marked.
• WhatsApp Business alongside WhatsApp (Android and iOS). Message types are named, with a new Content column (deleted, view once, poll, contact card, edited). New Contact Cards and View Once Media tables. On iOS, the account's own JID and name.
• Deleted messages recovered by carving: free pages, older page versions and the WAL of the messaging apps' databases (SMS, Messenger, Viber, Telegram, Signal, WhatsApp and more). Recovered records are marked in red.
• Signal (Android): edits, deletions, mentions and stories. Session messages are decrypted when the key is in the extraction. Recovery apps (WAMR, Notisave…) keep captured notifications, and LEXIS now reads them.
• Chats: Private/Group type, account column and picker, split per account, per SIM and per backup. Telegram (iOS) chats are grouped by account.

Case overview

• Case Summary with Overview, Device, SIM cards, Owner & accounts, Users and Report tabs. SIM history merged from every source, with MCC/MNC. Shows whether LEXIS or ALEAPP/iLEAPP made the report.
• Accounts Overview: one row per account of each app or service, merged from all artifacts, with the source of every value (Android and iOS, Apple IDs included).

Search

• Results as a filterable table. Search also covers file contents (PDF, Office, OpenDocument, SQLite, plist, text, JSON, XML) and the AI results.
• Keyword lists from a file, in any language and encoding. Whole-word search works for Chinese, Japanese and Thai.
• Offline OCR: Tesseract is bundled (12 languages), or you can use the OCR built into Windows. Scanned PDFs are supported.

Media and documents

• Media viewer: zoomable pictures, a video and audio player, and a sandboxed PDF viewer.
• Gallery: each file shows every message it was sent or received in. New Camera and Screenshots origin filters: on Android they come from the path, on iOS from Photos.sqlite.
• Documents node listing the extraction's PDF, Office, OpenDocument, RTF and iWork files, typed by content.

AI

• Video analysis: frames are described and the audio is transcribed, giving a timeline. The SHA-256 of every frame sent is recorded.
• whisper.cpp setup from inside LEXIS, with hash verification. Opus, AMR, M4A and MP3 are transcribed without installing ffmpeg.
• Engines per job: Ollama, LM Studio, the Claude CLI and whisper.cpp. You can also run parallel requests.
• AI on right-click wherever data is shown, and Explain on a single record. Details are split into tabs: Text Extraction and AI Analysis. The examiner can correct or exclude an analysis, and nothing is deleted.
• Summaries cite every record and cover media. The MCP server lists the case's artifacts first.

Fixes

• No more false "still running" prompt when an extraction finishes.
• Case Summary error with navigation group tabs.
• SQLite reader: the decoded cell panel stayed empty, and carved rows showed NULL.
• Chat date filter found nothing.
• Gallery › Whole extraction: Sent/Received found nothing, and the AI read only the first of duplicate files.
• SILK voice messages are transcribed from the decoded WAV.
• AI corrections now apply everywhere. Several video-analysis edge cases fixed.
• Security hardening:
  • whisper.cpp downloads are accepted only from the project's own release URL, with a size check.
  • ffmpeg, whisper-cli and the Claude CLI stop after a time limit.
  • Temporary files are cleaned up.
  • OCR has pixel limits.

Some features need the extraction processed again with this version: WhatsApp/Telegram iOS accounts, WeChat voice files.

Full details in CHANGELOG.md (che the repository).