Skip to content

iLEAPP v2026.4.5

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 24 Oct 17:21
· 59 commits to main since this release
v2026.4.5
39a0c1f
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

iLEAPP v2026.4.5

  • Python 3.11 or newer is now required to run from source. Python 3.15 is listed as supported, with Windows wheels for it and for ARM64.
  • Windows downloads are now one portable file per architecture, with no installer.
  • Staged files: --hash, or the window's new checkbox, records a SHA-256 for staged files, and the times their container recorded: zip NTFS and extended timestamp fields, tar headers (including GNU and PAX access and change times and the libarchive creation time), L01 and AD1 entries, FAT and exFAT entries (as stored, with no zone applied), and the ext, APFS and HFS+ times qnxprobe 1.76 reads.
  • Zip times: on four-value extended timestamp blocks (as in GrayKey style files_full.zip) the creation time comes from the fourth value, and Cellebrite CLBX zips take their times from metadata.msgpack, since in the CLBX zips tested every extended timestamp slot holds the access time. This adds msgpack as a dependency. Background: the blog post.
  • Reading acquisitions with -t raw: qnxprobe goes from 1.58 to 1.76 and ewfprobe to 0.15.0. LVM2 logical volumes (including split, striped and RAID1 ones), LUKS containers opened with their passphrase, RAID member images read together, and FAT12 and FAT16 are read. Free space, a flash filesystem's deleted files and NTFS directory indexes are offered to artifacts that ask for them. Each file read through missing acquisition data is named.
  • Encrypted iTunes backups: files are staged at their stored length, not the manifest's Size, and the decrypted Manifest.db is staged without its padding block.
  • Tar links are read as the member they point to, and corrupt zip members are skipped instead of stopping the run. A WAL-mode SQLite database staged without its -wal is opened read-only with immutable=1.
  • Unified logs and sysdiagnose: logarchive is read from a sysdiagnose, with new artifacts for unlock, buttons, orientation, gestures, USB host, wake source, AirDrop, calls, weather, family hotspot, charging state, app snapshots, container entries and data usage. From @danjethh: URL and link opens, camera and microphone capture sessions, TCC authorization cache and location manager state, Screen Time (ManagedSettings), BatteryUI per-app runtime, and Container Manager State for iOS 27. Unified Log filtering is faster and reports progress.
  • Life360: 32 new artifacts from @CyberMike81, including crash-detection diagnostics and recovered history. Also from @CyberMike81, generic Mixpanel and Crashlytics artifacts.
  • New: Apple Watch photo collections, registry history, Mail registry and Weather Cities; Photos Graph Moment Locations, routined visits and vehicle events, and Cache Locations course, altitude and accuracy from @charpy4n6; KeepSafe photo vault; Reddit post and subreddit history; Anonymous Chat from @darren33; Emoji Recents, Usage and Preferences from @ayobamiseun; an account-wide encryption key hash artifact from @Rugikex; offline DJI TXT flight records from @Blackwater1224; Discord - Servers; Battery Center; Alarms sleep alarms; Apple Music search, Media Experience, Media Remote, Photos Recent Searches, Hashtag Images and supplementary WebKit cache parsers.
  • Snapchat messages gain Local Media ID and Created On Device from @segumarc, and Bumble works with LAVA's conversation view from @frahmco.
  • Fixes: Telegram messages no longer stop on a short media ID (@mvanhorn) and are kept when a media entry cannot be read, the Claude app's storage is found after version 1.261005.20 and ChatGPT temporary media come only from a marked ChatGPT container (@ayobamiseun), GroupMe reads every GroupMe.sqlite, iTunesMetadata dates are read as UTC, the iOS version readers run first, and Media Cache rebuilds cached video and audio.
  • An accuracy review of the artifact modules: descriptions, notes and headers were checked against the code and the data, values are reported as stored, unsupported labels are gone, and rows that were being dropped are kept.
  • Apple build ID to iOS version table updated by @Johann-PLW. Contributor docs: a helper functions guide.

New Contributors

Full Changelog: v2026.4.4...v2026.4.5

Which file to download

Platform File
Windows 10 or 11, 64-bit Intel or AMD -windows-x64-portable.zip
Windows 11 on ARM -windows-arm64-portable.zip
macOS, Apple silicon -macos-arm64.dmg
macOS, Intel -macos-x64.dmg
Linux, 64-bit Intel or AMD -linux-x64.AppImage
Linux on ARM -linux-arm64.AppImage

Every download holds one program, ileapp. Started without arguments, from the
Applications folder or a double-click, it opens the window. Given arguments in a terminal,
it is the command line. On macOS the command line is inside the app:

/Applications/iLEAPP.app/Contents/MacOS/ileapp --help

For tools that run iLEAPP themselves. The options, output and exit codes of ileapp
are those of earlier releases, but there is no ileappGUI any more, since ileapp
without arguments opens the window. On Windows the zip holds the whole program as one
file, ileapp.exe, which can be put wherever the tool expects it; there is no installer.
The executable inside the macOS app needs the folder it came in; on Linux the AppImage is
the whole program.

ileapp.exe on Windows unpacks itself to a temporary folder each time it starts, so it
takes a few seconds to start, and it does not run where a policy (AppLocker, WDAC) forbids
running programs from the temporary folder. There, run iLEAPP from source; the README has
the steps.

First launch

The macOS disk images are signed with a Developer ID and notarised by Apple, so they open
without a warning.

The Windows binaries are not signed yet, so SmartScreen says "Windows protected your PC"
the first time. Choose More info, then Run anyway.

On Linux, make the AppImage executable once (chmod +x iLEAPP-*.AppImage). It needs FUSE
to start; where FUSE is not available, run it with --appimage-extract-and-run.

If you would rather not clear a warning, run from source instead; the README has the steps.

Verify what you downloaded

SHA256SUMS.txt covers every file in this release. On macOS or Linux, from the folder you
downloaded into:

grep <the file you downloaded> SHA256SUMS.txt | shasum -a 256 -c -

Use sha256sum in place of shasum -a 256 on Linux. On Windows, in PowerShell:

(Get-FileHash -Algorithm SHA256 .\<the file you downloaded>).Hash

and compare it with the line in SHA256SUMS.txt, which is lower case.

Linux

The build is made on Ubuntu 22.04, so it needs glibc 2.35 or newer and will not start on
an older distribution.

Code signing policy

The code signing policy covers
Windows signing, team roles and privacy.

Contributors

mvanhorn, segumarc, and 11 other contributors
Assets 9
Loading