v2026.1.0

ALEAPP v2026.1.0

• Massive LAVA migration: 150+ artifacts converted to the @artifact_processor decorator (Firefox, BitTorrent, Chrome/Chromium family, the full Garmin suite, Fitbit, WhatsApp, Facebook Messenger, Snapchat, Skype, Viber, Teams, ChatGPT, Life360, TikTok, offline GPS trackers, and many more), with UTC timestamp normalization and extraction-relative source paths.
• New parsers: HONOR Media Library/Gallery, Samsung Secure Folder HistoryLog, Rema 1000/Scan Selv (Denmark), and a developer-only App Inventory module for parsing-coverage analysis.
• Full refactor of the Waze, MeWe, and Life360 parsers, plus threaded conversation views added to a dozen SMS/chat artifacts (Burner, Google Messages, TikTok, Google Chat, Discord, LinkedIn).
• Visual identity overhaul: adoption of Tabler icons (as webfonts) for HTML reports, migrating legacy icon names to native Tabler names.
• Numerous stability fixes: hardened XML parsing against invalid tokens (4 batches), resolved LAVA duplicate-name collisions, fixed Windows MAX_PATH crashes on long report paths, migrated legacy media artifacts to check_in_media, and added a Windows CI smoke test to validate all module imports.

What's Changed

• Fix in artifact androidauto by @FrancoMorales1 in #707
• Update androidauto.py by @stark4n6 in #708
• update version to 3.7.0-dev.0 by @JamesHabben in #713
• update context class to have data extraction path functions by @JamesHabben in #710
• Add SQLite URI path regression tests by @JamesHabben in #715
• Fixed a bug where # is treated as a URI delimiter. Issue #711 by @JamieSharpe in #712
• feat: Added script to analyse Rema 1000 | Scan Selv from Denmark. by @NicolaiMartini in #714
• Add LAVA launch actions in final GUI by @JamesHabben in #718
• chore: parameterize LAVA media SQL by @JamesHabben in #719
• Convert artifact scripts to artifacts_v2 header format by @abrignoni in #721
• Convert Firefox artifacts to LAVA (@artifact_processor) by @abrignoni in #722
• Convert BitTorrent artifacts to LAVA (@artifact_processor) by @abrignoni in #723
• Convert vault/locker and Cash App artifacts to LAVA (@artifact_processor) by @abrignoni in #724
• Fix pre-existing crashes in three artifacts by @abrignoni in #725
• Convert chat artifacts to LAVA (@artifact_processor) by @abrignoni in #726
• Convert ProtonVPN/ProtonMail to LAVA (multi-report split) by @abrignoni in #727
• Convert TextNow/Skout to LAVA (multi-report split) by @abrignoni in #728
• Convert chromeBookmarks to LAVA with per-browser tables (iLEAPP pattern) by @abrignoni in #729
• Convert chromeOfflinePages/chromeTopSites to LAVA (per-browser tables) by @abrignoni in #730
• Convert chromeCookies/chromeNetworkActionPredictor to LAVA (per-browser tables) by @abrignoni in #731
• Convert chromeLoginData to LAVA (per-browser tables) by @abrignoni in #732
• Convert chromeMediaHistory to LAVA (multi-report x per-browser) by @abrignoni in #733
• Convert HideX, samsungSmartThings, mega, smyfilesStored, PodcastAddict to LAVA by @abrignoni in #734
• Convert keepNotes, rarlabPreferences, googleTasks to LAVA by @abrignoni in #735
• Fix LAVA timestamps for Firefox artifacts (tz-aware UTC) by @abrignoni in #737
• Convert imo and samsungWeatherClock to LAVA (multi-report split) by @abrignoni in #736
• Replace deprecated datetime.utcfromtimestamp in converted artifacts by @abrignoni in #738
• Fix LAVA timestamps for the Chrome family (tz-aware UTC) by @abrignoni in #739
• Fix LAVA timestamps across remaining converted artifacts (tz-aware UTC) by @abrignoni in #740
• Convert DocList, wellbeingaccount, appopSetupWiz to LAVA by @abrignoni in #741
• Convert Skype to LAVA (multi-report split) by @abrignoni in #742
• Convert googleNowPlaying to LAVA by @abrignoni in #743
• Convert 5 Samsung/system text-parser artifacts to LAVA @artifact_processor by @abrignoni in #744
• Convert Chess.com + Chess With Friends artifacts to LAVA @artifact_processor by @abrignoni in #745
• Convert build, packageInfo, roles, runtimePerms to LAVA @artifact_processor by @abrignoni in #746
• Consolidate all Garmin artifacts under a single 'Garmin' category by @abrignoni in #747
• Consolidate Kijiji and Google Maps voice guidance categories by @abrignoni in #748
• Convert settingsSecure, suggestions, pkgPredictions, smanager* to LAVA @artifact_processor by @abrignoni in #749
• Convert scontextLog, usageHistory, burnerSubscription, burnerContacts to LAVA @artifact_processor by @abrignoni in #750
• Convert calllogs, smembersEvents, shareit, atrackerdetect to LAVA @artifact_processor by @abrignoni in #751
• Convert vlcMedia, libretorrent, libretorrentFR, torrentData to LAVA @artifact_processor by @abrignoni in #752
• Convert PikPak family, blueskysearches, errp to LAVA @artifact_processor by @abrignoni in #753
• Convert Installed Apps family (packageGplinks, userDict, installedapps*) to LAVA @artifact_processor by @abrignoni in #754
• Convert setupWizardinfo, pSettings, ulrUserprefs, smembersAppInv to LAVA @artifact_processor by @abrignoni in #755
• Convert browserlocation, waze, Zapya, WordsWithFriends, cachelocation to LAVA @artifact_processor by @abrignoni in #756
• Convert burnerUser, NikeNotifications, MMWUsers, wifiHotspot to LAVA @artifact_processor by @abrignoni in #757
• Convert BadooConnections, deviceHealthServices_AppUsage, gmail to LAVA @artifact_processor by @abrignoni in #758
• Convert burnerMessages, MicrosoftAuthenticator, installedappsVending, PumaUsers to LAVA @artifact_processor by @abrignoni in #759
• Fix RunkeeperUser source-file mutation; convert to LAVA @artifact_processor by @abrignoni in #761
• Convert VerizonRDDWIFI, VerizonRDDAnalytics, swellbeing to LAVA @artifact_processor by @abrignoni in #760
• Convert kijijiLocalUserInfo, googlemaplocation, discreteNative, calllog to LAVA @artifact_processor by @abrignoni in #762
• Convert GarminLog, AdidasGoals, kijijiRecentSearches, battery_usage_v4 to LAVA @artifact_processor by @abrignoni in #763
• Convert vaulty_info, mega_transfers, AdidasUser to LAVA @artifact_processor by @abrignoni in #764
• Convert googleMessages, kijijiConversations, smyfilesOpHistory to LAVA @artifact_processor by @abrignoni in #765
• Convert mewe and walStrings to LAVA @artifact_processor by @abrignoni in #766
• Convert chromeDIPS to LAVA @artifact_processor (multi-browser) by @abrignoni in #767
• Convert chromeAutofill to LAVA @artifact_processor (multi-browser) by @abrignoni in #768
• Fix: restore mewe APP_NAME constant imported by snapchat.py by @abrignoni in #770
• Convert chrome.py to LAVA @artifact_processor (multi-browser) by @abrignoni in #769
• Fix LAVA duplicate-name collisions (unique artifact names) by @abrignoni in #771
• Convert GarminWeight, GarminStressAPI, GarminDailiesAPI to LAVA @artifact_processor by @abrignoni in #772
• Convert GarminSleep, GarminHRAPI, GarminSPo2 to LAVA @artifact_processor by @abrignoni in #773
• Convert GarminDailies, GarminStepsAPI, GarminSleepAPI to LAVA @artifact_processor by @abrignoni in #774
• Convert GarminResponse, GarminJson, GarminGcmJsonActivities to LAVA @artifact_processor by @abrignoni in #775
• Convert GarminActAPI, GarminActivities to LAVA @artifact_processor by @abrignoni in #776
• Convert GarminChart to LAVA @artifact_processor by @abrignoni in #777
• Convert bluetoothConnections, permissions to LAVA @artifact_processor by @abrignoni in #778
• Convert Xender, groupMe to LAVA @artifact_processor by @abrignoni in #779
• Convert tikTok, Oruxmaps to LAVA @artifact_processor by @abrignoni in #780
• Convert smyfilesRecents, wellbeing to LAVA @artifact_processor by @abrignoni in #781
• Consolidate 'Device Info' into 'Device Information' category by @abrignoni in #782
• Convert life360DriverBehavior to LAVA @artifact_processor by @abrignoni in #783
• Fix settingsSecure crash on invalid XML tokens by @abrignoni in #784
• Harden XML parsing against invalid tokens (batch 1/4) by @abrignoni in #785
• Harden XML parsing against invalid tokens (batch 2/4) by @abrignoni in #786
• Harden XML parsing against invalid tokens (batch 3/4) by @abrignoni in #787
• Harden XML parsing against invalid tokens (batch 4/4) by @abrignoni in #789
• Clean pylint debt and harden XML parsing in browser artifacts by @abrignoni in #792
• Convert smyFiles to LAVA @artifact_processor (multi-report) by @abrignoni in #791
• Convert slopes to LAVA @artifact_processor (multi-report) by @abrignoni in #793
• Convert line (LINE messenger) to LAVA @artifact_processor by @abrignoni in #794
• Convert Viber to LAVA @artifact_processor (multi-report) by @abrignoni in #795
• Convert teams (Microsoft Teams) to LAVA @artifact_processor by @abrignoni in #796
• Convert K9Mail to LAVA @artifact_processor by @abrignoni in #797
• Convert tusky (Mastodon client) to LAVA @artifact_processor by @abrignoni in #798
• Convert smsmmsBackup to LAVA @artifact_processor by @abrignoni in #799
• Convert appops to LAVA @artifact_processor by @abrignoni in #800
• Convert mastodon to LAVA @artifact_processor by @abrignoni in #801
• Convert kleinanzeigen.de to LAVA @artifact_processor by @abrignoni in #802
• Convert Twitter, cmh to LAVA @artifact_processor by @abrignoni in #803
• Fill missing creation_date/last_update_date keys in artifact headers by @abrignoni in #804
• Convert emulatedSmeta to LAVA @artifact_processor by @abrignoni in #805
• Convert siminfo to LAVA @artifact_processor by @abrignoni in #806
• Convert usageapps to LAVA @artifact_processor by @abrignoni in #807
• Convert notificationHistory to LAVA @artifact_processor (3-way split) by @abrignoni in #808
• Convert wifiProfiles to LAVA @artifact_processor by @abrignoni in #809
• Convert SamsungHoneyboard to LAVA @artifact_processor by @abrignoni in #810
• Convert offlinePages to LAVA @artifact_processor (+ media migration) by @abrignoni in #811
• Convert vlcThumbs to LAVA @artifact_processor (2-way split + media migration) by @abrignoni in #812
• Convert vlcthumbsADB to LAVA @artifact_processor (2-way split + media migration) by @abrignoni in #813
• Convert torThumbs to LAVA @artifact_processor (+ media migration) by @abrignoni in #814
• Convert galleryTrash to LAVA @artifact_processor (+ media migration) by @abrignoni in #815
• Convert imagemngCache to LAVA @artifact_processor (+ media migration) by @abrignoni in #816
• Convert smyfilesTrash to LAVA @artifact_processor (+ fix non-Windows, media migration) by @abrignoni in #817
• Convert smyfilescache to LAVA @artifact_processor (+ media migration) by @abrignoni in #818
• Convert smyFiles2 to LAVA @artifact_processor (dedup + media migration) by @abrignoni in #819
• Convert playgroundVault to LAVA @artifact_processor (+ media migration) by @abrignoni in #820
• Convert appLockerfishingnet to LAVA @artifact_processor (+ media migration) by @abrignoni in #821
• Convert NQ_Vault to LAVA @artifact_processor (2-way split + media migration) by @abrignoni in #822
• Convert AVG to LAVA @artifact_processor (2-way split + media migration) by @abrignoni in #823
• Convert browserCachechrome to LAVA @artifact_processor (+ media migration) by @abrignoni in #824
• Convert browserCachefirefox to LAVA @artifact_processor (+ media migration) by @abrignoni in #825
• Convert googlemapaudio + googlemapaudioTemp to LAVA @artifact_processor (+ media migration) by @abrignoni in #826
• Fix SQL reserved-word column names breaking LAVA CREATE TABLE (usageapps, K9Mail) by @abrignoni in #827
• Convert hikvision to LAVA @artifact_processor (4-way split + media migration) by @abrignoni in #828
• Convert dmss (Dahua DMSS) to LAVA @artifact_processor (consolidate + media migration) by @abrignoni in #829
• Convert gboard to LAVA @artifact_processor (consolidate + media migration) by @abrignoni in #830
• Convert wifiConfigstore2 to LAVA @artifact_processor (fix UnboundLocalError crash) by @abrignoni in #831
• Convert googlePhotos to LAVA @artifact_processor (consolidate + media migration) by @abrignoni in #832
• Convert chatgpt to LAVA @artifact_processor (9-way split + media migration) by @abrignoni in #833
• Convert teleguard to LAVA @artifact_processor (4-way split + media migration) by @abrignoni in #834
• Convert wireMessenger to LAVA @artifact_processor (+ forensic fix: stop writing to the source DB) by @abrignoni in #835
• Migrate 4 artifacts off legacy media_to_html to check_in_media by @abrignoni in #836
• Add Windows CI smoke test (import all artifact modules) by @abrignoni in #837
• Shorten 'Android Notification History - Snoozed' name (Windows path length) by @abrignoni in #838
• Convert FCMQueuedMessagesDump to LAVA (fixes Windows MAX_PATH report crash) by @abrignoni in #840
• Convert googleCallScreen to LAVA @artifact_processor (+ media migration) by @abrignoni in #841
• Convert appSemloc to LAVA @artifact_processor by @abrignoni in #842
• Convert googleKeepNotes to LAVA @artifact_processor (2-way split) by @abrignoni in #844
• Convert googleCalendar to LAVA @artifact_processor (2-way split) by @abrignoni in #845
• Convert airGuard to LAVA @artifact_processor (2-way split) by @abrignoni in #846
• Convert likee to LAVA @artifact_processor (3 artifacts) by @abrignoni in #847
• Convert googleMapsSearches to LAVA @artifact_processor (+ bug fix) by @abrignoni in #848
• Convert Todoist to LAVA @artifact_processor (3-way split) by @abrignoni in #849
• Convert blueskyposts to LAVA @artifact_processor (+ feed bug fix) by @abrignoni in #850
• Convert blueskymessages to LAVA @artifact_processor (2-way split + bug fix) by @abrignoni in #851
• Convert googleDuo to LAVA @artifact_processor (3-way split + media migration) by @abrignoni in #852
• Convert googleMapsGmm to LAVA @artifact_processor (2-way split) by @abrignoni in #853
• Convert googleInitiatedNav to LAVA @artifact_processor by @abrignoni in #854
• Convert googleLastTrip to LAVA @artifact_processor by @abrignoni in #855
• Convert googleQuickSearchbox + Recent to artifact_processor by @abrignoni in #856
• Convert recentactivity to artifact_processor by @abrignoni in #857
• Fix teleguard Messages media: skip cache dirs, drop unresolved refs (LAVA crash) by @abrignoni in #858
• Harden media-list None handling in FairEmail, SamsungNotes, gmailIMAPEmails by @abrignoni in #859
• Convert burner to artifact_processor (2-way split) by @abrignoni in #860
• Add HONOR Media Library/Gallery parser by @bitpwny in #788
• Drop legacy ArtifactHtmlReport from 7 Chromium artifacts by @abrignoni in #861
• Consolidate FCM Instagram into the Dump decoder; remove duplicate by @abrignoni in #862
• Convert FCMQueuedMessagesTwitter to artifact_processor by @abrignoni in #863
• Convert FCMQueuedMessagesXbox to artifact_processor (3-way split) by @abrignoni in #864
• Fix battery_usage_v9 KeyError on absent protobuf fields; convert to artifact_processor by @abrignoni in #865
• Convert FCMQueuedMessagesTumblr to artifact_processor (4-way split) by @abrignoni in #866
• Convert FCMQueuedMessagesJungrammer to artifact_processor by @abrignoni in #867
• Fix mega_transfers crash on non-database megapreferences file by @abrignoni in #868
• Fix googleVoice messages crash when message body (field 10) is a nested message by @abrignoni in #869
• Convert FCMQueuedMessagesSkype to artifact_processor (2-way split, +Teams) by @abrignoni in #870
• Convert sharedProto; clean up deviceHealthServices_Battery by @abrignoni in #871
• Drop legacy ArtifactHtmlReport from chromeAutofill + chromeMediaHistory by @abrignoni in #872
• Convert lgRCS to artifact_processor by @abrignoni in #873
• Convert Cello (Google Drive metadata) to artifact_processor by @abrignoni in #874
• Convert GarminFacebook to artifact_processor; remove live Facebook API call by @abrignoni in #875
• Convert BadooChat to artifact_processor (2-way split: Users + Messages) by @abrignoni in #876
• Convert firefox to artifact_processor (4-way split) by @abrignoni in #877
• Drop legacy ArtifactHtmlReport from chrome (base Chromium History module) by @abrignoni in #878
• Convert googleChat to artifact_processor (4-way split) by @abrignoni in #879
• Convert smsmms to artifact_processor (SMS + MMS split, media migration) by @abrignoni in #880
• Convert snapchat to artifact_processor (8-way split) by @abrignoni in #881
• Convert bumble to artifact_processor (3-way split) by @abrignoni in #882
• Convert NikeActivities to artifact_processor by @abrignoni in #883
• Convert StravaGPS to artifact_processor; add offline GPS-track image helper by @abrignoni in #884
• Enrich offline GPS route media: captioned image + downloadable route KML by @abrignoni in #885
• Convert GarminPolyline to artifact_processor (offline route media) by @abrignoni in #886
• Convert GarminPolyAPI to artifact_processor (offline route media) by @abrignoni in #887
• Convert NikePolyline to artifact_processor (offline route media) by @abrignoni in #888
• Convert AdidasActivities to artifact_processor (offline route media) by @abrignoni in #889
• Convert fitbit to artifact_processor (22 reports -> 24 LAVA artifacts) by @abrignoni in #890
• Convert RunkeeperActivities to artifact_processor (offline route media) by @abrignoni in #891
• Convert PumaActivities + MMWActivities (offline route media) - clears the GPS cluster by @abrignoni in #892
• Remove unused ArtifactHtmlReport import from chatgpt2 by @abrignoni in #893
• Convert citymapper to offline output (remove online folium maps) by @abrignoni in #894
• Convert NikeAMoments to artifact_processor (structured moments table) by @abrignoni in #895
• Convert OneDrive_Metadata to artifact_processor (proper media check-in) by @abrignoni in #896
• Convert Life360 to artifact_processor (split into 4 artifacts) by @abrignoni in #897
• Convert garmin.py to artifact_processor (split into 6 artifacts) by @abrignoni in #898
• Convert FacebookMessenger to artifact_processor (split into 7 artifacts) by @abrignoni in #899
• Convert WhatsApp to artifact_processor (split into 7 artifacts) by @abrignoni in #900
• Convert usagestats to artifact_processor (consolidated, per-user column) by @abrignoni in #901
• Migrate clipBoard + gmailEmails media_to_html → check_in_media by @abrignoni in #902
• Clean up DuckDuckGo + ProtonDrive lint debt (remove dead media_to_html import) by @abrignoni in #903
• chore: sync search_files to iLEAPP by @JamesHabben in #904
• Fix naive-datetime handling in lava_insert_sqlite_data (UTC normalization) by @abrignoni in #905
• Context-form retrofit (batch 1): downloads, googleCast, walStrings, browserCachechrome by @abrignoni in #906
• Context-form retrofit (batch 2): browserCachefirefox, NQ_Vault, knuddels, likee by @abrignoni in #907
• Context-form retrofit (batch 3): powerOffReset, shutdown_checkpoints, offlinePages, deviceHealthServices_Battery by @abrignoni in #908
• Context-form retrofit (batch 4): googleQuickSearchbox(Recent), vlcthumbsADB, bittorrentDlhist by @abrignoni in #909
• Context-form retrofit (batch 5): SamsungHoneyboard, SamsungTrash, imagemngCache by @abrignoni in #910
• Context-form retrofit (batch 6): dmss (6 functions) by @abrignoni in #911
• Context-form retrofit (batch 7): FilesByGoogle, playgroundVault, appLockerfishingnet, googleFitGMS by @abrignoni in #912
• Context-form retrofit (batch 8): Cello, chatgpt by @abrignoni in #913
• Context-form retrofit (batch 9): DuckDuckGo (9 functions) by @abrignoni in #914
• Context-form retrofit (batch 10, final): OrnetBrowser (10 functions) by @abrignoni in #915
• context: resolve files whose names contain glob metacharacters (e.g. IMG_0347[1].jpg) by @OneSixForensics in #916
• Waze Update by @djangofaiola in #917
• feat: Samsung Secure Folder HistoryLog artifact by @abrignoni in #920
• Life360 Updates by @charpy4n6 in #921
• MeWe by @charpy4n6 in #643
• Fix Life360 Pet Profile artifact icon by @abrignoni in #922
• Add threaded conversation view to Burner - Messages by @abrignoni in #923
• LinkedIn: migrate legacy 'chat' data_view key to 'conversation' by @abrignoni in #924
• Add conversation views to 12 SMS/chat artifacts (Tier 1 + safe Tier 2) by @abrignoni in #925
• Android class 2: derived directions + conversation views for 6 chat artifacts by @abrignoni in #926
• Android class 2 batch 2: directions + views for Google Messages, TikTok, Google Chat, Discord by @abrignoni in #927
• Add Tabler icons by @Johann-PLW in #929
• Update Knuddels parser and repository credentials by @annkirpv in #918
• Migrate artifact icons to native Tabler names by @abrignoni in #930
• Report extraction-relative source paths from artifact_processor by @abrignoni in #931
• Shorten per-row Source File paths to extraction-relative (follow-up to #931) by @abrignoni in #932
• Update report.py - Fix HTML report generation issue with Python3.10-3.11 by @Johann-PLW in #933
• Add recent history tracking by @Johann-PLW in #935
• fix: include CLI processing for recent history by @JamesHabben in #937
• Add developer-only App Inventory module for parsing-coverage analysis by @abrignoni in #938
• Port --custom_artifacts_path from iLEAPP for loader parity by @abrignoni in #939
• Add missing descriptions to 119 artifacts by @abrignoni in #940
• Use Tabler icons as webfonts for HTML report by @Johann-PLW in #941
• Allow custom output folder name by @Johann-PLW in #942
• Populate sample_data from an 8-image Android test corpus (Android 10-16) by @abrignoni in #943

New Contributors

• @FrancoMorales1 made their first contribution in #707
• @NicolaiMartini made their first contribution in #714
• @bitpwny made their first contribution in #788
• @OneSixForensics made their first contribution in #916
• @djangofaiola made their first contribution in #917

Full Changelog: v3.6.0...v2026.1.0