iLEAPP v2026.4.3

iLEAPP v2026.4.3

• New downloads: iLEAPP is now built by one packaging driver on every platform. Windows gets an installer and a portable zip, macOS gets a signed and notarised disk image, and Linux gets an AppImage, for both Intel/AMD and ARM. There is one program, ileapp: started without arguments it opens the window, and given arguments it is the command line. There is no separate ileappGUI any more, and the download names changed. See "Which file to download" below.
• More ways to read acquisitions with -t raw: E01 and Ex01, SMART, AFF and AFD images, Apple disk images (.dmg, .sparseimage, sparse bundles and segmented sets), encrypted Apple disk images, FTK Imager AD-encrypted images, and encrypted APFS volumes, each opened with the password you give. NTFS alternate data streams are now readable, and qnxprobe is updated to 1.51.
• New app support for iOS: Roblox, KakaoTalk, WeChat, Telekom Mail, BOTIM, VK Messenger, Odnoklassniki, SimpleX Chat and Health walking and running distance, plus a new Intelligence Platform family (knowledge graph, expired interactions, behaviors timeline and event locations) and Biome sync merged events. Snapchat Friends became Snapchatter Records and now reads the friends list.
• Newer iOS: Call History columns for iOS 26, older-layout Reminders columns, and the 6xxx builds Apple publishes beside current releases added to the build table. Sysdiagnose Process now builds a process tree from ps.txt.
• Faster and lighter runs: artifacts can stream their rows instead of holding them, and the Unified Log and PowerLog imports now do. Zip archives no longer walk every member to look for repeated names, a compressed tar is decompressed once, and the GUI accepts .tar.xz.
• Reporting accuracy: the LAVA database and media items are recorded by their evidence path rather than the examiner's own folder, Safari history rows are ordered by visit time, ORDER BY ties break on row id, Python text is stored for floats and booleans, test case zips keep each member's recorded times, and archive members named like Windows devices are renamed when staged.
• Fixes: a folder input no longer stages the examiner's files for links that point outside it, a socket or block device is no longer walked as a directory, Zangi reads the new message schema, and Proton Mail body text marks where each link sat.

New Contributors

• @mathisdesaulty made their first contribution in #2197

Full Changelog: v2026.4.2...v2026.4.3

---

Which file to download

Platform	File
Windows 10 or 11, 64-bit Intel or AMD	-windows-x64-setup.exe (installer), or -windows-x64-portable.zip to run without installing
Windows 11 on ARM	-windows-arm64-setup.exe, or -windows-arm64-portable.zip
macOS, Apple silicon	-macos-arm64.dmg
macOS, Intel	-macos-x64.dmg
Linux, 64-bit Intel or AMD	-linux-x64.AppImage
Linux on ARM	-linux-arm64.AppImage

Every download holds one program, ileapp. Started without arguments, from the Start
menu, the Applications folder or a double-click, it opens the window. Given arguments in a
terminal, it is the command line. On macOS the command line is inside the app:

/Applications/iLEAPP.app/Contents/MacOS/ileapp --help

For tools that run iLEAPP themselves. The options, output and exit codes of ileapp
are those of earlier releases, but the downloads changed shape: there is no ileappGUI
any more, since ileapp without arguments opens the window. On Windows and macOS,
ileapp needs the folder it came in, so run it from there rather than copying the
executable elsewhere on its own; on Linux the AppImage is the whole program.

First launch

The macOS disk images are signed with a Developer ID and notarised by Apple, so they open
without a warning.

The Windows binaries are not signed yet, so SmartScreen says "Windows protected your PC"
the first time. Choose More info, then Run anyway.

On Linux, make the AppImage executable once (chmod +x iLEAPP-*.AppImage). It needs FUSE
to start; where FUSE is not available, run it with --appimage-extract-and-run.

If you would rather not clear a warning, run from source instead; the README has the steps.

Verify what you downloaded

SHA256SUMS.txt covers every file in this release. On macOS or Linux, from the folder you
downloaded into:

grep <the file you downloaded> SHA256SUMS.txt | shasum -a 256 -c -

Use sha256sum in place of shasum -a 256 on Linux. On Windows, in PowerShell:

(Get-FileHash -Algorithm SHA256 .\<the file you downloaded>).Hash

and compare it with the line in SHA256SUMS.txt, which is lower case.

Linux

The build is made on Ubuntu 22.04, so it needs glibc 2.35 or newer and will not start on
an older distribution.