DLEAPP v2026.4.4

DLEAPP v2026.4.4

• Python 3.11 or newer is now required to run from source. Windows wheels ship with the source, so DLEAPP installs there without a compiler.
• Windows downloads are now one portable file per architecture, with no installer.
• Windows event logs: dozens of new event artifacts, among them Sysmon, AppLocker, Hyper-V, BitLocker, Code Integrity, DHCP and DNS clients, Group Policy, Kernel Boot, Microsoft Account, NTFS volume mounts, USN journal and file deletion summaries, Remote Desktop, SMB client and server, Kerberos, NTLM, share and directory access, Winlogon, WinRM, Windows Update and servicing, and driver and service installs. The EVTX reader reads past a stale header on a clean log, renders every record with FastRenderer, keeps arrays, RelatedActivityID and ProcessingErrorData, converts FILETIMEs exactly, and reads strings that do not decode as UTF-16.
• Windows: Active Directory accounts and groups from ntds.dit (with ESE log replay, also used for User Access Logging), User Access Logging, Phone Link (messages, photos, apps, SIM, contacts and calls), Windows Diagnostic Data Viewer (EventTranscript.db), Defender DetectionHistory, Dropbox desktop with dbx decryption, legacy Google Drive (Backup and Sync), TeamViewer, PowerShell transcripts, Windows 11 Notepad tabs, BitLocker key protectors, NTFS $I30 index slack and $LogFile records, SRUM notifications and energy use, USB device instances and HID devices, Amcache device containers and driver packages, MUICache, Open With lists, default app choices, DPAPI master key files, mapped network drives, 7-Zip history, RecentFileCache.bcf, security settings, audit policy, LanmanServer shares, per-user COM registrations, OpenSSH files under ProgramData, and version 31 prefetch.
• macOS: BSM audit trail, Recents, Personalization Portrait, HomeKit Entities, Siri Analytics Events, Container Manager Code Signing, XProtect Behavior Service events, launchd disabled overrides, Wi-Fi logs, App Sandbox requests, unified log artifacts built on the imported log table, .sfl4 shared file lists, kernel APFS volume unlock entries in Screen Unlock, and a record held by several volume views of one file reported once.
• Linux: NetworkManager and netplan profiles, firewalld, fstab, RPM installed packages and DNF5 history, plocate, mlocate and GNU locate databases, Apport crash reports, CUPS print jobs, printers and access log, UPower power history, GTK bookmarks, monitors.xml and EDID, upgrade history, Vim viminfo, and web server access and error logs.
• Cross-platform: WhatsApp Web, VLC recent media and recording settings, Chromium sync devices, synced tabs, sessions and send tab to self, Chromium DIPS bounce tracking and Edge WebAssist history, Photos library (MediaDb) with its pictures, and Battery Center.
• Staged files: --hash, or the window's new checkbox, records a SHA-256 for staged files, and the times their container recorded: zip NTFS and extended timestamp fields, tar headers (including GNU and PAX access and change times and the libarchive creation time), L01 and AD1 entries, FAT and exFAT entries (as stored, with no zone applied), and the ext, APFS and HFS+ times qnxprobe 1.76 reads.
• Zip times: on four-value extended timestamp blocks the creation time comes from the fourth value, and Cellebrite CLBX zips take their times from metadata.msgpack. This adds msgpack as a dependency.
• Reading acquisitions with -t raw: qnxprobe goes from 1.58 to 1.76 and ewfprobe to 0.15.0. LVM2 logical volumes (including split, striped and RAID1 ones), LUKS containers opened with their passphrase, RAID member images read together, and FAT12 and FAT16 are read. Free space, a flash filesystem's deleted files and NTFS directory indexes are offered to artifacts that ask for them. Each file read through missing acquisition data is named.
• Tar links are read as the member they point to, and corrupt zip members are skipped instead of stopping the run. A WAL-mode SQLite database staged without its -wal is opened read-only with immutable=1.
• Fixes: Firefox favicons from before schema 78, Chromium Favicons without last_requested, Simple Cache bodies read by the entry layout, Firefox IndexedDB typed arrays and DataViews, UTF-16LE Report.wer files without a byte order mark, the Keychain Creator attribute and deleted record numbers, and Spotlight and FSEvents identifiers above the SQLite integer range reported as text.
• Contributor docs: a helper functions guide and an updated module guide.

New Contributors

• @charpy4n6 made their first contribution in #644

Full Changelog: v2026.4.3...v2026.4.4

---

Which file to download

Platform	File
Windows 10 or 11, 64-bit Intel or AMD	-windows-x64-portable.zip
Windows 11 on ARM	-windows-arm64-portable.zip
macOS, Apple silicon	-macos-arm64.dmg
macOS, Intel	-macos-x64.dmg
Linux, 64-bit Intel or AMD	-linux-x64.AppImage
Linux on ARM	-linux-arm64.AppImage

Every download holds one program, dleapp. Started without arguments, from the
Applications folder or a double-click, it opens the window. Given arguments in a terminal,
it is the command line. On macOS the command line is inside the app:

/Applications/DLEAPP.app/Contents/MacOS/dleapp --help

For tools that run DLEAPP themselves. The options, output and exit codes of dleapp
are those of earlier releases, but there is no dleappGUI any more, since dleapp
without arguments opens the window. On Windows the zip holds the whole program as one
file, dleapp.exe, which can be put wherever the tool expects it; there is no installer.
The executable inside the macOS app needs the folder it came in; on Linux the AppImage is
the whole program.

dleapp.exe on Windows unpacks itself to a temporary folder each time it starts, so it
takes a few seconds to start, and it does not run where a policy (AppLocker, WDAC) forbids
running programs from the temporary folder. There, run DLEAPP from source; the README has
the steps.

First launch

The macOS disk images are signed with a Developer ID and notarised by Apple, so they open
without a warning.

The Windows binaries are not signed yet, so SmartScreen says "Windows protected your PC"
the first time. Choose More info, then Run anyway.

On Linux, make the AppImage executable once (chmod +x DLEAPP-*.AppImage). It needs FUSE
to start; where FUSE is not available, run it with --appimage-extract-and-run.

If you would rather not clear a warning, run from source instead; the README has the steps.

Verify what you downloaded

SHA256SUMS.txt covers every file in this release. On macOS or Linux, from the folder you
downloaded into:

grep <the file you downloaded> SHA256SUMS.txt | shasum -a 256 -c -

Use sha256sum in place of shasum -a 256 on Linux. On Windows, in PowerShell:

(Get-FileHash -Algorithm SHA256 .\<the file you downloaded>).Hash

and compare it with the line in SHA256SUMS.txt, which is lower case.

Linux

The build is made on Ubuntu 22.04, so it needs glibc 2.35 or newer and will not start on
an older distribution.

Code signing policy

The code signing policy covers
Windows signing, team roles and privacy.