Skip to content

v2026.4.2

Choose a tag to compare

View all tags
@Johann-PLW Johann-PLW released this 20 Sep 10:51
· 483 commits to main since this release
v2026.4.2
cd40dfe
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

iLEAPP v2026.4.2

  • New Sysdiagnose parsing support: initial sysdiagnose parsers added, PowerLog databases now read inside packed sysdiagnoses, AppleDouble sidecars filtered out of sysdiagnose readers, and the shutdown log's sysdiagnose matching fixed.
  • Messenger and messaging fixes: Facebook app's own Messenger mailbox now read, client message sender resolved through fb_transport_contacts, missing timestamps and attachment file names correctly recorded as absent, WhatsApp forward metadata read with a fixed-field wire reader, and WhatsApp messages no longer abort when ZMETADATA isn't a blob.
  • New media/vault handling: Snapchat iOS Memories and chat media added, Calculator Vault videos checked in as proper media (looked up in their own album folder), Photos.sqlite face crops shown as media instead of a raw folder path, and the legacy media_to_html function removed entirely.
  • Forensic input and performance improvements: NTFS and APFS images now read in one pass with qnxprobe 1.30, the LAVA database now commits once per artifact instead of once per staged file (improving performance), oversized HTML report tables held back with a summarized view, and zip/tar member names stored more than once now staged as a single file.
  • Reporting accuracy: evidence-relative source paths recorded for directory and single-file inputs, duplicate Mobile Installation log lines reported only once, and Keyboard Input Contexts now decode chat type and party from identifiers (scoped to the measured Messenger form).

Full Changelog: v2026.4.1...v2026.4.2

Assets 14
Loading