DLEAPP v2026.4.5

DLEAPP v2026.4.5

• Windows DPAPI, through a vendored copy of dpapiprobe v0.5.1: Wi-Fi Keys (offline WLAN key recovery), LSA Secrets, System Credential Manager, ARSO Credentials, User Vault Web Credentials (with the new --windows-user-password input), and Chromium saved passwords and cookies. Chromium v20 app-bound values are detected and the notes say why they are not decrypted offline.
• New Windows artifacts: WMI Repository subscriptions (filters, consumers, bindings) through cimreader 0.1.0, AnyDesk connections, file transfers and traces, Forwarded Events, Device Migration, CBS and DISM logs (with CBS SFP and store scans and LZX CbsPersist cabs), Windows Update Orchestrator update history, code editor extension inventory, Recycle Bin Folder Contents, Recycle Bin INFO2 for RECYCLER, Amcache Windows 8 format and the Inventory*.db databases beside the hive, Kernel-Power 105 power source changes, and TeleGuard messages, contacts and media (thanks @Forensik-IT-GmbH).
• Windows fixes and additions: USN Journal parent paths as they were when each record was written, older-format registry transaction logs replayed, prefetch versions 17, 23 and 26, the RecentFileCache.bcf checksum checked, jump list icon locations and damaged text-mode shortcuts, network location shell items and UTF-16 share names in Shellbags and LNK, Winlogon Notify packages in Registry Autostart Points, the ActivitiesCache ActivityOperation table, and System Info on images where CurrentBuild is not a number.
• ESE reader: reserved-tag pages are read, a table walk stops at a page owned by another object, and tables are walked from the root page. SRUM adds the SDP provider tables and transaction log replay.
• Windows XP: XP Recent is read, and share-only shortcut targets keep the share.
• Chromium: Local Storage sites and service worker registrations, ETag and Last-Modified in Downloads, and match type, transition and keyword in Omnibox Shortcuts. Firefox profiles under .config/mozilla/firefox are read on Linux.
• New macOS artifacts: AuthKit (com.apple.akd), Trusted Peers (ported from iLEAPP), Intelligence Platform knowledge graph entities and events, WebKit tracking-prevention statistics, Safari Favicons, Keyboard Text Replacements, and Bluetooth Paired and Other LE devices. QuickLook thumbnails render from the bitmapFormat schema and show the recorded file extension. HomeKit also reads core.sqlite, iCloud Drive item versions name their device, and FSEvents pages under private/var/db/fseventsd are read.
• Signal Desktop: Linux keys wrapped with the keyring secret are unwrapped, and the artifacts say what Windows needs.
• SQLite WAL: a shared reader for the committed state of a database and its -wal, including the previous WAL generation and an uncommitted tail, now vendored from sqlite-wal v0.1.0. is_sqlite_sidecar and sqlite_databases join ilapfuncs.
• Reading acquisitions with -t raw: NTFS, ReFS, exFAT and FAT names now match whatever their case on macOS and Linux, as they already did on Windows, and a file two patterns of one artifact match is handed to it once. The raw input guide says which patterns miss on a bare partition image.
• Profiles: the example profile is fixed, and a profile that names a missing artifact now says so. Every HTML artifact has an icon the report can show, and reports keep a module's own HTML rows when the artifact has a media column.
• The Brotli 1.2.0 Windows wheels are dropped. validate_sample_data.py --emit reads disk images.

New Contributors

• @ForensikITGmbH made their first contribution in #676

Full Changelog: v2026.4.4...v2026.4.5

---

Which file to download

Platform	File
Windows 10 or 11, 64-bit Intel or AMD	-windows-x64-portable.zip
Windows 11 on ARM	-windows-arm64-portable.zip
macOS, Apple silicon	-macos-arm64.dmg
macOS, Intel	-macos-x64.dmg
Linux, 64-bit Intel or AMD	-linux-x64.AppImage
Linux on ARM	-linux-arm64.AppImage

Every download holds one program, dleapp. Started without arguments, from the
Applications folder or a double-click, it opens the window. Given arguments in a terminal,
it is the command line. On macOS the command line is inside the app:

/Applications/DLEAPP.app/Contents/MacOS/dleapp --help

For tools that run DLEAPP themselves. The options, output and exit codes of dleapp
are those of earlier releases, but there is no dleappGUI any more, since dleapp
without arguments opens the window. On Windows the zip holds the whole program as one
file, dleapp.exe, which can be put wherever the tool expects it; there is no installer.
The executable inside the macOS app needs the folder it came in; on Linux the AppImage is
the whole program.

dleapp.exe on Windows unpacks itself to a temporary folder each time it starts, so it
takes a few seconds to start, and it does not run where a policy (AppLocker, WDAC) forbids
running programs from the temporary folder. There, run DLEAPP from source; the README has
the steps.

First launch

The macOS disk images are signed with a Developer ID and notarised by Apple, so they open
without a warning.

The Windows binaries are not signed yet, so SmartScreen says "Windows protected your PC"
the first time. Choose More info, then Run anyway.

On Linux, make the AppImage executable once (chmod +x DLEAPP-*.AppImage). It needs FUSE
to start; where FUSE is not available, run it with --appimage-extract-and-run.

If you would rather not clear a warning, run from source instead; the README has the steps.

Verify what you downloaded

SHA256SUMS.txt covers every file in this release. On macOS or Linux, from the folder you
downloaded into:

grep <the file you downloaded> SHA256SUMS.txt | shasum -a 256 -c -

Use sha256sum in place of shasum -a 256 on Linux. On Windows, in PowerShell:

(Get-FileHash -Algorithm SHA256 .\<the file you downloaded>).Hash

and compare it with the line in SHA256SUMS.txt, which is lower case.

Linux

The build is made on Ubuntu 22.04, so it needs glibc 2.35 or newer and will not start on
an older distribution.

Code signing policy

The code signing policy covers
Windows signing, team roles and privacy.