ALEAPP v2026.4.2

ALEAPP v2026.4.2

• New downloads: ALEAPP is now built by one packaging driver on every platform. Windows gets an installer and a portable zip, macOS gets a signed and notarised disk image, and Linux gets an AppImage, for both Intel/AMD and ARM. There is one program, aleapp: started without arguments it opens the window, and given arguments it is the command line. There is no separate aleappGUI any more, and the download names changed. See "Which file to download" below.
• More ways to read acquisitions with -t raw: E01 and Ex01, SMART, AFF and AFD images, Apple disk images (.dmg, .sparseimage, sparse bundles and segmented sets), encrypted Apple disk images, FTK Imager AD-encrypted images, and encrypted APFS volumes, each opened with the password you give. NTFS alternate data streams are now readable, and qnxprobe is updated to 1.55.
• New and expanded Android apps: Nova AI Chatbot, Samsung Gallery Hidden Album, and Calculator Lock with a new Calculator History artifact and every Android user's note contacts. WhatsApp now reports channels and channel messages in their own artifacts, resolves LID jids for 1:1 chats, groups and call logs, and adds status text, wa_name and group pictures to Contacts and Group Details. Snapchat Android reports only the users the account added.
• Media from streaming caches: ExoPlayer media is rejoined and shown on the Reddit, Twitter and Instagram cache rows, including HLS streams.
• Faster and lighter runs: artifacts can stream their rows instead of holding them. Zip archives no longer walk every member to look for repeated names, a compressed tar is decompressed once, and the GUI accepts .tar.xz.
• Reporting accuracy: the LAVA database and media items are recorded by their evidence path rather than the examiner's own folder, ORDER BY ties break on row id, Python text is stored for floats and booleans, test case zips keep each member's recorded times, archive members named like Windows devices are renamed when staged, and Gmail body text marks where each link sat.
• Fixes: a command-line run is recorded in history after the LAVA file is written, a folder input no longer stages the examiner's files for links that point outside it, and a socket or block device is no longer walked as a directory.

New Contributors

• @AndroidIosForensik made their first contribution in #1453

Full Changelog: v2026.4.1...v2026.4.2

---

Which file to download

Platform	File
Windows 10 or 11, 64-bit Intel or AMD	-windows-x64-setup.exe (installer), or -windows-x64-portable.zip to run without installing
Windows 11 on ARM	-windows-arm64-setup.exe, or -windows-arm64-portable.zip
macOS, Apple silicon	-macos-arm64.dmg
macOS, Intel	-macos-x64.dmg
Linux, 64-bit Intel or AMD	-linux-x64.AppImage
Linux on ARM	-linux-arm64.AppImage

Every download holds one program, aleapp. Started without arguments, from the Start
menu, the Applications folder or a double-click, it opens the window. Given arguments in a
terminal, it is the command line. On macOS the command line is inside the app:

/Applications/ALEAPP.app/Contents/MacOS/aleapp --help

For tools that run ALEAPP themselves. The options, output and exit codes of aleapp
are those of earlier releases, but the downloads changed shape: there is no aleappGUI
any more, since aleapp without arguments opens the window. On Windows and macOS,
aleapp needs the folder it came in, so run it from there rather than copying the
executable elsewhere on its own; on Linux the AppImage is the whole program.

First launch

The macOS disk images are signed with a Developer ID and notarised by Apple, so they open
without a warning.

The Windows binaries are not signed yet, so SmartScreen says "Windows protected your PC"
the first time. Choose More info, then Run anyway.

On Linux, make the AppImage executable once (chmod +x ALEAPP-*.AppImage). It needs FUSE
to start; where FUSE is not available, run it with --appimage-extract-and-run.

If you would rather not clear a warning, run from source instead; the README has the steps.

Verify what you downloaded

SHA256SUMS.txt covers every file in this release. On macOS or Linux, from the folder you
downloaded into:

grep <the file you downloaded> SHA256SUMS.txt | shasum -a 256 -c -

Use sha256sum in place of shasum -a 256 on Linux. On Windows, in PowerShell:

(Get-FileHash -Algorithm SHA256 .\<the file you downloaded>).Hash

and compare it with the line in SHA256SUMS.txt, which is lower case.

Linux

The build is made on Ubuntu 22.04, so it needs glibc 2.35 or newer and will not start on
an older distribution.