v2026.2.0

iLEAPP v2026.2.0

• New artifacts: Biome databases and Set.db stores, Biome stream artifacts (harvested mail/messages, reads, screen time, keyboard), C2PA Content Provenance (AI provenance, with signer certificate/signing time parsing in phase 2), and a new United Airlines app module.
• Photos.sqlite rework with full iOS 26 support, converted to context form with generator compatibility and updated icons.
• Continued context-form migration: 25+ artifacts converted (mechanical batch), plus messageRetention, googleTranslate, nsVault, findMyItems, gmail, knowledgeC, and chrome.py, all standardized on UTC timestamps.
• Python 3.13 and 3.14 support added, alongside a large sample_data refresh from a 13-archive iOS test corpus spanning iOS 13.3.1 to the latest releases.
• Key fixes: Safari timestamp handling on iOS 26+ epoch (Tabs, History, Websearch, Favicons), Notes returning zero rows on iOS 16+ (account foreign key relocation), case-sensitive Biome path mismatches, missing Tabler-icons resources in reports, and an HTML report security fix escaping evidence in report cells.

What's Changed

• Update version number by @Johann-PLW in #1690
• Fix artifact crashes surfaced by the 9-image iOS coverage run by @abrignoni in #1691
• Update sample_data from the refreshed 13-archive iOS test corpus by @abrignoni in #1692
• Add artifacts for Biome databases and Set.db stores by @abrignoni in #1693
• Fix artifact crashes surfaced by older iOS test images (13.3.1-16.1.1) by @abrignoni in #1694
• Add Biome stream artifacts: harvested mail/messages, reads, screen time, keyboard by @abrignoni in #1695
• Populate sample_data from 6 older iOS test images (13.3.1-16.5) by @abrignoni in #1696
• Populate sample_data for the new Biome artifacts (databases, sets, streams) by @abrignoni in #1697
• Add C2PA Content Provenance (AI provenance) artifact by @abrignoni in #1698
• Fix Safari Tabs (BrowserState) timestamp on iOS 26+ by @abrignoni in #1700
• Guard Safari History/Websearch/Favicons timestamps for iOS 26+ epoch by @abrignoni in #1702
• C2PA phase 2: parse signer certificate and signing time by @abrignoni in #1701
• c2paProvenance: lead the notes with the signature caveat by @abrignoni in #1703
• Update AMDSQliteDB.py by @stark4n6 in #1704
• C2PA: case-insensitive media paths (catch uppercase iOS extensions) by @abrignoni in #1705
• C2PA: add Media State column (group manifest rows per media file) by @abrignoni in #1706
• fix: check for empty data and source files before msg by @JamesHabben in #1707
• fix(photosDbexif): update to catch errors and improve performance by @JamesHabben in #1674
• Convert 25 artifacts to the context function form (mechanical batch) by @abrignoni in #1708
• Convert messageRetention, googleTranslate, nsVault to context form by @abrignoni in #1709
• Convert findMyItems, gmail, knowledgeC to context form (UTC timestamps) by @abrignoni in #1710
• Convert chrome.py to context form; drop obsolete wrap_text by @abrignoni in #1711
• Fix case-sensitive path mismatch in Biome artifacts (biome -> Biome) by @mb4n6 in #1712
• Change ilapfuncs.get_sqlite_db_records() to a generator by @bconstanzo in #1673
• Photos.sqlite rework: iOS 26 support + context form, generator compat, icons (completes #1499) by @abrignoni in #1713
• iOS26 Photos sqlite Support and Parser Description Updates by @ScottKjr3347 in #1499
• Update requirements.txt file to support Python3.13 and 3.14 by @Johann-PLW in #1714
• Support Python 3.13 and 3.14 by @abrignoni in #1675
• fix: search spelling fix from 'seach' by @JamesHabben in #1715
• Fix Notes returning zero rows on iOS 16+ (account FK moved to ZACCOUNT7) by @abrignoni in #1716
• Update apple_build_id_to_os_version.json by @Johann-PLW in #1718
• feat(united_airlines): new module for united airlines app artifacts by @JamesHabben in #1720
• Update united_airlines.py by @stark4n6 in #1722
• Update voiceRecordings.py - Fix issue #1717 by @Johann-PLW in #1724
• Update report.py - Fix issue with missing Tabler-icons ressources by @Johann-PLW in #1725
• Minor improvements and bug fixes by @djangofaiola in #1728
• Security: escape evidence in html_columns report cells by @abrignoni in #1730

New Contributors

• @mb4n6 made their first contribution in #1712

Full Changelog: v2026.1.0...v2026.2.0