iLEAPP v2026.4.6

iLEAPP v2026.4.6

• New artifacts: Chromium Open Tabs and Chrome Sync for iOS Chromium browsers, Playback Session Archives, Life360 Location State Samples, mt.lastLaunch App Dates, CarKit Connection Events, Contacts Me Card Donations (and a Me Card column in Address Book), FaceTime Messages, Line Calls, Lockdown Pair Records, Pending Notifications, Photos Picker Log, Focus mode configurations and assertions, Find My cache, HomeKit Homes, Users and Accessories, Suggestions Store contact details and URLs, Widget Engagements, Meta Apps Time In App, Quick Look Thumbnails, Keyboard Text Replacements, and a Hive box inventory through a vendored hive-parser.
• From @danjethh: Screen Time store artifacts (RMAdminStore), SMS and iMessage reactions, edit history, unsent parts, replies, recently deleted, link previews and app messages, unified log artifacts (Lockdown Mode, passkey record loads, background shortcut actions, VPN connectivity), sysdiagnose associated domains, MC event lists, Network Extension, iCloud Drive (brctl) and process task info, and fixes to Calendar Events, LSC clients.plist and Waze.
• From @ayobamiseun: X notifications fill From Users, X cached users read their follower and following counts from the real fields, X direct-message users report their Updated time, CloudKit records read every field, PotatoChat's versioned tables are looked up correctly, Burner Cache and DMSS stores no longer stop the run, GroupMe coordinates read the same on every SQLite version, logarchive json exports are read whole, PosterBoard wallpaper layers match whatever the case of their extension, converted images are written outside the evidence copy, and plists are read with plistlib.
• SQLite WAL: a shared reader for the committed state of a database and its -wal, including the previous WAL generation and an uncommitted tail, now vendored from sqlite-wal v0.1.0. Snapchat, Google Photos, Google Chat, Life360, Discord and Bluetooth LE report rows that only another WAL state holds. is_sqlite_sidecar replaces the hand-written sidecar filters in eleven modules.
• Chromium browsers: every Chrome and Edge profile folder is read, not only Chrome/Default, Login Data For Account and the Google app's Login Data are read, AccountBookmarks show in Bookmarks, and the browser is named from the app container.
• Sysdiagnose: Wi-Fi plists are read from sysdiagnose archives, and archives saved as <identifier>_sysdiagnose.tar.gz are found. Battery UI reads the device folder and BatteryUI.plist.
• Other fixes: HomeKit also reads homed/core.sqlite, Biome sets read stores kept without a Database folder, FSEvents streams match in every extraction layout, ManagedSettings and sdl_user_settings read the live stores, Maps Sync names each row's entity, Voicemail links audio and transcript by exact name, every ChatGPT conversation layout is read, and TSV exports on Windows write one CRLF per row. C2PA provenance is read through the vendored c2pareader 0.2.0.
• Reading acquisitions with -t raw: NTFS, ReFS, exFAT and FAT names now match whatever their case on macOS and Linux, as they already did on Windows, and a file two patterns of one artifact match is handed to it once. Call History Transactions, Spotlight Index and Twint now match their stores at a bare Data volume root.
• Profiles: the example profile is fixed, and a profile that names a missing artifact now says so. Artifacts have icons and categories the report can show, KML output is declared only where an artifact has coordinate columns, and reports keep a module's own HTML rows when the artifact has a media column.
• Device IDs and the Apple build to OS version list were updated by @Johann-PLW.

Full Changelog: v2026.4.5...v2026.4.6

---

Which file to download

Platform	File
Windows 10 or 11, 64-bit Intel or AMD	-windows-x64-portable.zip
Windows 11 on ARM	-windows-arm64-portable.zip
macOS, Apple silicon	-macos-arm64.dmg
macOS, Intel	-macos-x64.dmg
Linux, 64-bit Intel or AMD	-linux-x64.AppImage
Linux on ARM	-linux-arm64.AppImage

Every download holds one program, ileapp. Started without arguments, from the
Applications folder or a double-click, it opens the window. Given arguments in a terminal,
it is the command line. On macOS the command line is inside the app:

/Applications/iLEAPP.app/Contents/MacOS/ileapp --help

For tools that run iLEAPP themselves. The options, output and exit codes of ileapp
are those of earlier releases, but there is no ileappGUI any more, since ileapp
without arguments opens the window. On Windows the zip holds the whole program as one
file, ileapp.exe, which can be put wherever the tool expects it; there is no installer.
The executable inside the macOS app needs the folder it came in; on Linux the AppImage is
the whole program.

ileapp.exe on Windows unpacks itself to a temporary folder each time it starts, so it
takes a few seconds to start, and it does not run where a policy (AppLocker, WDAC) forbids
running programs from the temporary folder. There, run iLEAPP from source; the README has
the steps.

First launch

The macOS disk images are signed with a Developer ID and notarised by Apple, so they open
without a warning.

The Windows binaries are not signed yet, so SmartScreen says "Windows protected your PC"
the first time. Choose More info, then Run anyway.

On Linux, make the AppImage executable once (chmod +x iLEAPP-*.AppImage). It needs FUSE
to start; where FUSE is not available, run it with --appimage-extract-and-run.

If you would rather not clear a warning, run from source instead; the README has the steps.

Verify what you downloaded

SHA256SUMS.txt covers every file in this release. On macOS or Linux, from the folder you
downloaded into:

grep <the file you downloaded> SHA256SUMS.txt | shasum -a 256 -c -

Use sha256sum in place of shasum -a 256 on Linux. On Windows, in PowerShell:

(Get-FileHash -Algorithm SHA256 .\<the file you downloaded>).Hash

and compare it with the line in SHA256SUMS.txt, which is lower case.

Linux

The build is made on Ubuntu 22.04, so it needs glibc 2.35 or newer and will not start on
an older distribution.

Code signing policy

The code signing policy covers
Windows signing, team roles and privacy.