v2026.1.0

iLEAPP v2026.1.0

• Massive LAVA migration: dozens of artifacts converted to the @artifact_processor decorator (kik cluster, mobileBackup/Install, notifications, geod, Safari cluster, slack, chatgpt, life360, mailprotect, photos, and many more), standardizing UTC timestamps, relative source paths, and creation/update metadata across the codebase.
• New parsers: Zalo Chat and Users, Discord cache, Home Depot app, Oura Ring, App Web Usage (Biome), Biome NotificationUsage, springboard wallpaper, Apple ATX image files, App Inventory module for parsing-coverage analysis.
• Full refactor of Swarm (Foursquare) and Waze iOS parsers, with conversation views added to WhatsApp, Viber, Kik, Slack, Life360, TikTok, Discord, Teleguard, Reddit, and more.
• Visual identity overhaul: migration to Tabler icons (webfont-based), CSS/dark theme updates, and HTML report icon consistency fixes.
• Numerous stability fixes: timestamp handling (pre-1970, naive datetime/UTC normalization), SQL reserved-word/duplicate column crashes, glob-metacharacter filename resolution, PyInstaller hidden imports, and cross-platform GUI monitor/focus handling improvements.

What's Changed

• Fix bug in batteryBDC by @JamesHabben in #1495
• update version to 2.6.0-dev.0 and create versioning doc by @JamesHabben in #1501
• fix: correct Foursquare Swarm data mapping and accuracy thresholds by @djangofaiola in #1502
• fix bug in integration test harness that errored on new module by @JamesHabben in #1506
• update context class to have data extraction path functions by @JamesHabben in #1507
• Swarm: Small Enhancements and Bug Fixes by @djangofaiola in #1510
• Parses App Web Usage entries from Biome by @Schramp in #1504
• feature: add command line option to point to additional artifact modu… by @JamesHabben in #1484
• Zalo Chat and Users Parser by @prosch88 in #1511
• Maite modules batch 5 by @Maite2003 in #1315
• handle times before unix epoch by @snoop168 in #1118
• update pre-1970 handling to include timezone by @JamesHabben in #1513
• Maite modules batch 8 by @Maite2003 in #1323
• Update Schramp contributer info by @Schramp in #1514
• Maite modules batch 9 by @Maite2003 in #1327
• Batch #1 changes to v2 by @FranciscoVeronING in #1341
• update test harness and module update doc by @JamesHabben in #1518
• Update os_builds.json by @Johann-PLW in #1520
• remove duplicate column header causing error by @JamesHabben in #1498
• fix: sms module not properly checking in media by @JamesHabben in #1517
• AAPL file sometimes uses ASTC instead of astc tag by @Schramp in #1515
• update cloudkitSharing to lava output and fix parsing errors by @JamesHabben in #1500
• Refactor platform metadata lookups in Context for cross LEAPP by @JamesHabben in #1512
• update webkit with salt value, and other refactoring by @JamesHabben in #1516
• update cloudkitCache module to fix search pattern and lava output by @JamesHabben in #1508
• new discord_cache artifact module by @JamesHabben in #1505
• Fixed a bug where # is treated as a URI delimiter. See PR abrignoni/A… by @JamieSharpe in #1521
• Batch #2 changes to v2 by @FranciscoVeronING in #1344
• update uberPlaces to lava output and parse additional fields by @JamesHabben in #1522
• Update iOSCacheLocations.py by @abrignoni in #1525
• Update apple_build_id_to_os_version.json by @Johann-PLW in #1527
• Add LAVA launch actions to final gui window by @JamesHabben in #1528
• Parse sms's attributedBody using pytypedstream by @davidyuk in #1523
• chore: parameterize LAVA media SQL by @JamesHabben in #1529
• Batch #3 changes to v2 by @FranciscoVeronING in #1354
• update LinkedIn module to conversation by @JamesHabben in #1531
• fix: detach leapp process after launching lava by @JamesHabben in #1533
• Batch #4 changes to v2 by @FranciscoVeronING in #1355
• notes: add small guards to avoid OSError when processing attachments by @nilamwinarti13 in #1358
• Fix: FitnessWorkoutsLocationsData plugin 'no such table' by @KemalRajasa in #1363
• implement: maps sync schema if 'column not found' by @KemalRajasa in #1364
• Implement: safe query for column mismatch in photosDbexif by @KemalRajasa in #1365
• Batch #5 changes to v2 by @FranciscoVeronING in #1356
• fix: Initialize alllines variable in deviceActivator function by @hamasfaa in #1375
• fix: make exception broader so it can catch DatabaseError also by @zelvann in #1378
• Fix crashes in TikTok artifacts (SQL syntax error & missing tables) and logic bug by @LittleRedRidingHood73 in #1379
• Fix IndexError in health_workouts by restructuring database record handling by @hamasfaa in #1381
• fix: fix KeyError in wifiIdentifiers and using get() for optional fields by @hamasfaa in #1383
• fix: Fix base64 decoding errors and improve error handling by @hamasfaa in #1385
• fix(mailprotect): remove redundant db.close() causing "Cannot operate on a closed database by @Tokenzrey in #1387
• Fix TypeError in systemVersionPlist.py: handle None value for sysdiagnose_archive by @Wadagraprana in #1392
• fix: add more exception catches for timestamp conversions by @JamesHabben in #1535
• fix(photosDbexif): Implement dynamic detection of asset tables in photosDbexif.py by @Tokenzrey in #1399
• Fix: Handle plist error in duetLocations by @amadheatrizza in #1406
• modernize geodMapTiles and convert heic tiles to jpg by @JamesHabben in #1536
• docs: update artifact info to include 'sample_data' key by @JamesHabben in #1542
• instagram-threads-update by @Sukochev in #1469
• Label processed file log entries as artifacts by @Mirochill in #1492
• Fix biomeappinstall keyerror7 by @Gear-I in #1548
• Add Dielle De Noon to contributor list by @Gear-I in #1549
• discordChat: fix bug that caused multiplied duplicate records by @JamesHabben in #1503
• Small fix for app snapshots by @maala-nfi in #1538
• instagramThreads: little more polish on the code by @JamesHabben in #1544
• tikTok: modernize and improve schema guards by @JamesHabben in #1545
• trustedPeers: add additional peer information by @JamesHabben in #1541
• teams: update module by @JamesHabben in #1532
• Convert medicalID to artifact_processor (LAVA) by @abrignoni in #1552
• Convert kik Users-in-Groups + Local Account to artifact_processor (LAVA) by @abrignoni in #1553
• Fix: add typedstream to PyInstaller hiddenimports by @Rugikex in #1534
• Fix rctasyncstorage manifest 1340 by @Gear-I in #1550
• atxDatastore: check for missing files and query error catch by @JamesHabben in #1539
• parseCDCache: modernize and adjust score column handling by @JamesHabben in #1540
• Add a module for parsing widgets by @maala-nfi in #1537
• update ileappGUI to better handle monitor space on macOS by @JamesHabben in #1509
• Full refactor and complete re-engineering of the iOS Waze parser by @djangofaiola in #1551
• Convert kikGroupadmins to artifact_processor (LAVA), harden protobuf decode by @abrignoni in #1554
• Convert kikPendingUploads to artifact_processor (LAVA) + proper media check-in by @abrignoni in #1555
• Convert kikBplistmeta to artifact_processor (LAVA) + embedded media check-in by @abrignoni in #1556
• Convert kikMessages to artifact_processor (LAVA): split Messages + Users, media check-in by @abrignoni in #1557
• Add keychain artifact module by @kobo220 in #1543
• Convert mobileBackup + mobileContainerManager to artifact_processor (LAVA) by @abrignoni in #1559
• Finish mobileBackupplist conversion to artifact_processor (LAVA) by @abrignoni in #1560
• Retire mobileBackup (superseded by mobileBackupplist) + relative source path by @abrignoni in #1561
• Convert mobileActivationLogs to artifact_processor (LAVA, context form) by @abrignoni in #1562
• Convert mobileInstallb to artifact_processor (LAVA, context form) by @abrignoni in #1563
• add optional recent history tracking by @JamesHabben in #1524
• Fix mobileBackupplist LAVA crash: 'Values' column is a SQL reserved word by @abrignoni in #1565
• Convert mobileInstall to artifact_processor (LAVA, context form); 729 lines -> 4 functions by @abrignoni in #1564
• Convert notificationsDuet + notificationsXII to artifact_processor (LAVA, context form) by @abrignoni in #1566
• fix: macos secondary monitor launch location by @JamesHabben in #1568
• Rewrite notificationsXI as a structured LAVA artifact (context form) by @abrignoni in #1567
• fix: better focus handling for settings modal windows by @JamesHabben in #1570
• Convert geodApplications + geodPDPlaceCache to artifact_processor (LAVA, context form) by @abrignoni in #1569
• fix search_files: base class raise and duplicate directory add in dir… by @JamesHabben in #1573
• Convert findMy + duetLocations to LAVA @artifact_processor by @abrignoni in #1571
• Convert mapsSync to LAVA @artifact_processor by @abrignoni in #1572
• Convert FitnessWorkoutsLocationData to LAVA @artifact_processor by @abrignoni in #1574
• Convert tileApp + tileAppDb to LAVA @artifact_processor by @abrignoni in #1575
• Convert metamask to LAVA @artifact_processor (4-report split + fixes) by @abrignoni in #1576
• Convert kijijiConversations to LAVA @artifact_processor by @abrignoni in #1577
• Convert secretCalculator to LAVA @artifact_processor (media migration) by @abrignoni in #1578
• Convert bumble + googleDuo + imoHD_Chat to LAVA @artifact_processor by @abrignoni in #1579
• Convert teleguard to LAVA @artifact_processor (4-report split + media) by @abrignoni in #1580
• Convert the Safari Browser cluster (6 artifacts) to LAVA @artifact_processor by @abrignoni in #1581
• Fix naive-datetime handling in lava_insert_sqlite_data (UTC normalization) by @abrignoni in #1582
• Harden the 3 naive-datetime artifacts to emit aware UTC (defense in depth) by @abrignoni in #1583
• Convert slack to LAVA @artifact_processor (8-function split) by @abrignoni in #1584
• Convert protonMail to LAVA @artifact_processor by @abrignoni in #1585
• Convert the iCloud cluster (iCloudWifi + icloudMeta + icloudSharedalbums) by @abrignoni in #1586
• Convert simInfo + recentApphistory + queryPredictions to LAVA by @abrignoni in #1587
• Use creation_date/last_update_date metadata on converted LAVA artifacts by @abrignoni in #1588
• Convert 5 artifacts to LAVA (@artifact_processor): offlinePages, fsCachedData, quickLook, reminders, textinputTyping by @abrignoni in #1589
• Convert locServicesconfig, interactionCcontacts, teamsSegment to LAVA (10 artifacts) by @abrignoni in #1590
• Convert ooklaSpeedtestData, hikvision, notes to LAVA by @abrignoni in #1591
• Convert SiriRemembers to LAVA (Messages / Calls / Media) by @abrignoni in #1592
• Convert iconsScreen to LAVA: tabular home-screen layout + rendered PNG visual by @abrignoni in #1593
• Finalize 4 hybrid artifacts to LAVA @artifact_processor (line, pingertextfree, payByPhone, facebookMessenger) by @abrignoni in #1594
• Finalize burner to LAVA @artifact_processor (accounts/messages/contacts/numbers) by @abrignoni in #1595
• Convert chatgpt to LAVA @artifact_processor (6 artifacts) by @abrignoni in #1596
• chrome: UTC timestamps + creation_date/last_update_date metadata by @abrignoni in #1597
• Convert Oops, sysShutdown, mediaLibrary to LAVA (function-key -> @artifact_processor) by @abrignoni in #1598
• Convert life360 to LAVA @artifact_processor (4 artifacts: Locations/Battery/Chat/Members) by @abrignoni in #1599
• Convert mailprotect (Apple Email) to LAVA @artifact_processor (iOS 13+) by @abrignoni in #1600
• chore: cleanup from sync work by @JamesHabben in #1601
• Convert icloudPhotoMeta to LAVA @artifact_processor by @abrignoni in #1602
• Migrate deprecated version/date metadata in 7 artifacts by @abrignoni in #1603
• Convert photosDbexif (Photos.sqlite EXIF Analysis) to LAVA @artifact_processor by @abrignoni in #1604
• Convert photosMetadata to LAVA @artifact_processor (version-adaptive) by @abrignoni in #1605
• bluetoothOther: clean Source File path via context.get_relative_path by @abrignoni in #1606
• Use context.get_relative_path for Source File/Path columns (28 artifacts) by @abrignoni in #1607
• Convert dhcphp/dhcpl to context form + relative Source File + UTC by @abrignoni in #1608
• whatsApp: fix AttributeError crash on messages without forward metadata by @abrignoni in #1609
• Fix LAVA CREATE TABLE crashes from duplicate/reserved column names (cashApp, tikTok) by @abrignoni in #1612
• add new artifact for springboard wallpaper by @JamesHabben in #1610
• appItunesmeta: fix crash on string purchase/release/install dates by @abrignoni in #1613
• Guard date-converter calls in 9 artifacts against string/empty dates by @abrignoni in #1614
• appleMapsTrips: handle -wal/sidecar + wrong-schema DBs without crashing; relative Source File by @abrignoni in #1615
• cacheRoutesGmap: handle non-archive plists + UTC timestamp by @abrignoni in #1616
• mobileBackupplist: fix 'datetime is not JSON serializable' crash by @abrignoni in #1617
• locServicesconfig: make raw plist values LAVA-serializable (proactive) by @abrignoni in #1618
• burner: column check and search patterns by @JamesHabben in #1611
• telegramMessages: add Chat, Chat ID, and Thread ID columns by @abrignoni in #1623
• context: resolve files whose names contain glob metacharacters (e.g. IMG_0347[1].jpg) by @OneSixForensics in #1620
• feat: telegram: add convo view and lint cleanup by @JamesHabben in #1625
• feat: new parser and artifact for apple atx image files by @JamesHabben in #1619
• Enable KML output for coordinate-bearing artifacts by @abrignoni in #1624
• cacheRoutesGmap: read raw plist to avoid nska_deserialize 'unhashable' warnings by @abrignoni in #1626
• update to dual decode and grid evaluation by @JamesHabben in #1628
• Fix regex patterns for GPS quality logging by @djangofaiola in #1629
• facebookMessenger-update by @Sukochev in #1621
• feat: new module for home depot app artifacts by @JamesHabben in #1630
• biomeAppWebUsage: use Context form by @abrignoni in #1633
• Add: Oura Ring artifact parser by @Slay3r00 in #1634
• Update search_files.py - Double check for iTunes Backup encryption by @Johann-PLW in #1636
• chore: update readme content by @JamesHabben in #1635
• Tabler icons implementation - CSS update for LEAPPs visual identity by @Johann-PLW in #1639
• Migrate artifact icons to native Tabler names by @abrignoni in #1640
• HTML report: match runtime report names to artifact icons by @abrignoni in #1641
• Modernize burnerCache: context form, remove dead global chain, fix latent crash by @abrignoni in #1643
• Migrate last legacy 'chat' data_views to 'conversation' by @abrignoni in #1644
• Add conversation views to 7 chat artifacts (Tier 1 + WhatsApp, Viber, Kik) by @abrignoni in #1645
• Class 2: derived directions + conversation views for Slack, Life360, TikTok by @abrignoni in #1647
• Class 2 batch 2: derived directions + conversation views for Discord, Teleguard, Reddit by @abrignoni in #1648
• Update CSS styles for LEAPPs visual identity by @Johann-PLW in #1650
• Update apple_build_id_to_os_version.json by @Johann-PLW in #1651
• Add iLEAPP color for Dark Theme Switch by @Johann-PLW in #1652
• Update active artifact style in left bar by @Johann-PLW in #1653
• Update documentation for Tabler icons by @Johann-PLW in #1654
• chore: update docs about search patterns by @JamesHabben in #1642
• Report extraction-relative source paths from artifact_processor by @abrignoni in #1656
• Shorten per-row Source File paths (follow-up to #1656) + dmss data_list fix by @abrignoni in #1657
• Update report.py - Fix HTML report generation issue with Python3.10-3.11 by @Johann-PLW in #1659
• fix(chrome): remove duplicate column value browser name by @JamesHabben in #1662
• fix(cloudkitSharing): guard against edge cases in plist data by @JamesHabben in #1663
• Update .spec files for ileappGUI by @Johann-PLW in #1665
• Update apple_build_id_to_os_version.json by @Johann-PLW in #1666
• Add Biome NotifcationUsage artifact by @thysvanmeurs in #1632
• Fix bereal artifact by @Gear-I in #1638
• Fix BeReal artifact_icons to valid Tabler names by @abrignoni in #1667
• fix(applicationStateDB): remove string concat operators by @JamesHabben in #1671
• fix(mobileInstall): change to string literals in artifact header by @JamesHabben in #1670
• fix: change itunes extractions to log relative path by @JamesHabben in #1672
• Fix datetime.UTC import breaking Python 3.10 by @abrignoni in #1677
• fix(googleChat): context, media and linter cleanup by @JamesHabben in #1669
• fix: move history module to correct folder by @JamesHabben in #1679
• feat: allow custom output folder name by @JamesHabben in #1631
• Move output.py and platform.py to leapp_functions/app by @Johann-PLW in #1681
• Add App Inventory module for parsing-coverage analysis by @abrignoni in #1680
• Update version_info.py by @stark4n6 in #1684
• Use Tabler icons as Webfonts for HTML report by @Johann-PLW in #1683
• Add missing descriptions to 17 artifacts by @abrignoni in #1685
• Flip Tabler icons coloring by @Johann-PLW in #1686
• Update Tabler icon active color by @Johann-PLW in #1687
• Fix typo'd last_update_date in biomeSync (2029 -> 2025) by @abrignoni in #1688
• Populate sample_data from a 9-image iOS test corpus (iOS 12.4-18.7.8) by @abrignoni in #1689

New Contributors

• @Schramp made their first contribution in #1504
• @JamieSharpe made their first contribution in #1521
• @davidyuk made their first contribution in #1523
• @Wadagraprana made their first contribution in #1392
• @amadheatrizza made their first contribution in #1406
• @Sukochev made their first contribution in #1469
• @Mirochill made their first contribution in #1492
• @Gear-I made their first contribution in #1548
• @maala-nfi made their first contribution in #1538
• @Rugikex made their first contribution in #1534
• @OneSixForensics made their first contribution in #1620
• @Slay3r00 made their first contribution in #1634
• @thysvanmeurs made their first contribution in #1632

Full Changelog: v2.5.0...v2026.1.0