v2.3.0

iLEAPP v2.3.0

• New features :
  • Support of iTunes encrypted backups
  • New Unified Logs artifacts
  • Progress / status count to console output
• Improve media file lookup speed (~20x faster)
• New modules : Sysdiagnose, AMDSQLiteDB, Airbnb messages, Potato Chat Parser, CashApp, User defaults
• Modules updated for LAVA output

What's Changed

• Update logarchive.py by @abrignoni in #1154
• logarchive by @abrignoni in #1157
• updates by @JamesHabben in #1158
• Update logarchive.py by @abrignoni in #1159
• Add logarchive_artifacts by @Johann-PLW in #1161
• Logarchive update by @abrignoni in #1163
• Update ileapp.py - fix missing modules when a profile was loaded by @Johann-PLW in #1164
• Update logarchive.py by @abrignoni in #1165
• Update ileapp.py - Add None to paths for Unified Logs modules by @Johann-PLW in #1166
• Update ileapp.py - Add progress / status count to console output #1160 by @Johann-PLW in #1167
• Parse Sysdiagnose - First artifact: "Account Devices" by @prosch88 in #1162
• New contributor by @prosch88 in #1168
• Update ileapp.py - logarchive artifact execution by @Johann-PLW in #1169
• Update execution of Unified Logs artifacts by @Johann-PLW in #1170
• More Apple Unified Logs Artifacts by @abrignoni in #1171
• Update logarchive.py by @abrignoni in #1172
• ignore, image manifest, test module by @JamesHabben in #1173
• Update ilapfuncs.py - get_birthday fix by @kobo220 in #1174
• Update logarchive.py by @abrignoni in #1175
• Update version_info.py by @MetadataForensics in #1177
• Update logarchive.py by @abrignoni in #1178
• Update logarchive.py by @abrignoni in #1179
• Update Mobile Installation Logs to parse sysdiagnose archives in a backup by @prosch88 in #1176
• Update builds_ids.py by @stark4n6 in #1180
• test harness updates by @JamesHabben in #1181
• Update SystemVersionPlist and MobileActivationLogs (for Sysdiagnose) by @prosch88 in #1182
• In progress by @abrignoni in #1184
• Update Kleinanzeigen.de by @prosch88 in #1183
• Update tcc.py by @stark4n6 in #1188
• Fix LAVA only pop-up in GUI and warns in HTML report if no file was found among selected artifacts by @Johann-PLW in #1192
• Faster logarchive artifact by @bconstanzo in #1191
• Update builds_ids.py by @Johann-PLW in #1193
• Casing fix on knowledgeC.py by @Jadoo4QFan in #1198
• add 'file' run type by @JamesHabben in #1190
• Updated Discord by @stark4n6 in #1201
• Add Bluetooth PIDs to builds by @stark4n6 in #1204
• Chrome bookmarks modified by @dumbermore in #1197
• Update health.py by @MetadataForensics in #1199
• Update builds_ids.py by @abrignoni in #1205
• Media mgr updates and context class by @JamesHabben in #1203
• Podcasts and Photos Meta updates by @stark4n6 in #1212
• Language Updates by @JamesHabben in #1213
• updates by @JamesHabben in #1217
• Update builds_ids.py by @Johann-PLW in #1218
• AMDSQLiteDB parsers by @stark4n6 in #1219
• Update builds_ids.py by @Johann-PLW in #1220
• Update builds_ids.py by @Johann-PLW in #1222
• Update logarchive.py by @abrignoni in #1223
• Modified LinkedIn Artifacts and added Airbnb message artifact by @kalink0 in #1224
• Update applicationstate.py by @stark4n6 in #1228
• Build ID updates by @stark4n6 in #1230
• Update builds_ids.py by @Johann-PLW in #1231
• Update builds_ids.py by @Johann-PLW in #1232
• fix last used timestamp conversion and uberID column by @snoop168 in #1234
• Potato Chat Parser by @prosch88 in #1233
• New CashApp parser by @abrignoni in #1235
• Update cashAppB.py by @abrignoni in #1236
• Improve media file lookup speed by @JamesHabben in #1238
• module update docs by @JamesHabben in #1239
• add support for XBApplicationSnapshotManifest metadata from applicationState.db by @mxkrt in #1225
• Encrypted backups now supported by @Johann-PLW in #1240
• Add native support for iTunes encrypted backups by @threeplanetssoftware in #1023
• User defaults by @snoop168 in #1221
• Fix issue with PotatoChat Media path string by @prosch88 in #1241
• Update logarchive.py - Fix invalid escape sequence '%' by @Johann-PLW in #1242
• Update builds_ids.py by @Johann-PLW in #1243
• Update to v2.3.0 by @Johann-PLW in #1244

New Contributors

• @Jadoo4QFan made their first contribution in #1198
• @mxkrt made their first contribution in #1225

Full Changelog: v2.2.0...v2.3.0

v2.2.0

iLEAPP v2.2.0

• New features :
  • Processing of Apple Unified Logs
  • Add your agency's logo to the HTML report
  • Hardlinks for media files in HTML report
• New modules : Biome keybag
• Module updated for LAVA output: Booking, burnerCache

What's Changed

• Update version number and builds_ids.py by @Johann-PLW in #1132
• Add Agency logo in Case data by @Johann-PLW in #1133
• Update ileapp.py by @stark4n6 in #1136
• Update ileappGUI.py - Fix typo in file extension for logo agency by @Johann-PLW in #1137
• Update modules for lava output and media manager by @djangofaiola in #1138
• Biome keybag by @snoop168 in #1140
• Update builds_ids.py by @Johann-PLW in #1141
• Update media manager with hardlinks for HTML report by @Johann-PLW in #1142
• Update last_update_date of modules using media manager with hardlinks by @Johann-PLW in #1143
• Update builds_ids.py by @Johann-PLW in #1144
• Logarchive.json parser by @abrignoni in #1146
• Update requirements.txt: Add ijson for Unified Logs by @Johann-PLW in #1147
• Add info about Lava only artifacts by @Johann-PLW in #1148
• Update logarchive.py by @abrignoni in #1149
• Update ileappGUI.py - remove extra spaces in lava-only pop-up by @Johann-PLW in #1150
• Update logarchive.py by @abrignoni in #1151
• LAVA only notifications by @Johann-PLW in #1152
• Update version to 2.2.0 by @Johann-PLW in #1153

Full Changelog: v2.1.3...v2.2.0

v2.1.3

iLEAPP v2.1.3

• New module: storeUser
• Modules enhancements: Voicemail, Discord
• Module updated for LAVA output: WithingsHealthMate
• Bug fixes

What's Changed

• add additional files by @snoop168 in #1119
• Update .spec files to compile executables by @Johann-PLW in #1122
• Fix issue #1121 - iOS version = 0 by @Johann-PLW in #1123
• Fix Paths (remove private/var) by @stark4n6 in #1124
• Create storeUser parser by @stark4n6 in #1125
• Update builds_ids.py by @Johann-PLW in #1126
• GUI & Discord Updates by @stark4n6 in #1129
• Refactored the Module WithingsHealthMate by @kalink0 in #1128
• Update voicemail.py by @Johann-PLW in #1127
• Update builds_ids.py by @Johann-PLW in #1130
• Update ileapp.py by @Johann-PLW in #1131

Full Changelog: v2.1.2...v2.1.3

v2.1.2

iLEAPP v2.1.2

• Short Cuts added to GUI
  • Crtl + I - Focus in Input File Field
  • Crtl + O - Focus in Output File Field
  • Crtl + F - Focus in Filter Field
• New modules: Kleinanzeigen.de, Apple WorldClock, BeReal
• Module enhancements
• Modules updated for LAVA output
• Bug fixes

What's Changed

• Update mailprotect.py by @stark4n6 in #1063
• New parser for Kleinanzeigen.de by @prosch88 in #1064
• Update systemVersionPlist by @stark4n6 in #1065
• Update builds_ids.py and README.md by @Johann-PLW in #1066
• Added default Apple WorldClock Parser by @dumbermore in #1067
• Update search_files.py by @Johann-PLW in #1069
• Update builds_id.py by @Johann-PLW in #1070
• Update builds_ids.py by @Johann-PLW in #1071
• Update Health Parsers by @stark4n6 in #1072
• Add MetaData from Forwarded Messages && Create Link and Attachments by @BrunoFischerGermany in #1073
• Update mobileInstallb by @stark4n6 in #1074
• Bug Fixes by @stark4n6 in #1075
• Minor Report Updates by @stark4n6 in #1076
• Biome Report Updates by @stark4n6 in #1077
• Add 3 Short Cuts by @BrunoFischerGermany in #1080
• BeReal by @djangofaiola in #1082
• Update builds_ids.py by @Johann-PLW in #1084
• Reorder ilapfuncs.py code - Update media-manager by @Johann-PLW in #1085
• Update builds_ids.py by @Johann-PLW in #1086
• Update teamsSegment.py - Fix issue #1087 by @Johann-PLW in #1088
• Update builds_ids.py by @Johann-PLW in #1096
• Update notificationsXII.py - Fix issue #1091 by @Johann-PLW in #1097
• Update sms.db - Fix issues #1098 & #1089 by @Johann-PLW in #1099
• Minor Error Fixes by @stark4n6 in #1100
• Fix issue with modules using return_on_first_hit=True with seeker.sea… by @Johann-PLW in #1101
• Update builds_ids.py by @Johann-PLW in #1102
• Update waze.py by @stark4n6 in #1103
• System Info/Build Updates by @stark4n6 in #1104
• Add iOS object to get iOS_version in artifacts in read only mode by @Johann-PLW in #1105
• Update builds_ids.py by @Johann-PLW in #1107
• Update appleWalletCards.py for lava output by @Johann-PLW in #1109
• Update media manager by @Johann-PLW in #1110
• Update builds_ids.py by @Johann-PLW in #1111
• Fix: Kleinanzeigen.de parser - Improve message direction method by @prosch88 in #1115
• Whatsapp mono module by @NeoSlugman in #1108
• Code standardization and updates for lava output by @Johann-PLW in #1116
• Code standardization by @Johann-PLW in #1117

New Contributors

• @prosch88 made their first contribution in #1064
• @NeoSlugman made their first contribution in #1108

Full Changelog: v2.1.0...v2.1.2

v2.1.0

iLEAPP v2.1.0

• You can now filter modules displayed in GUI to select or unselect them more easily
• Media manager (pre-release) for LAVA
• Fix error when attaching a SQLite DB in read-only mode on Windows
• New modules and module enhancements

What's Changed

• Update search_files.py for media manager and add documentation by @Johann-PLW in #977
• Update lavafuncs.py for media manager by @Johann-PLW in #978
• Update voicemail.py for lava-output and media manager by @Johann-PLW in #979
• Update ilapfuncs.py : media datatype for exports by @Johann-PLW in #980
• Update addressBook.py for lava-output and media manager by @Johann-PLW in #981
• Update ileapp.py by @Johann-PLW in #982
• Update appSnapshots.py for lava output and media manager by @Johann-PLW in #983
• Update iTunesBackupInfo.py by @Johann-PLW in #984
• Update messageRetention.py for lava output by @Johann-PLW in #985
• Add files via upload by @MetadataForensics in #1041
• Fix error when attaching a SQLite DB in R/O on Windows by @Johann-PLW in #1043
• Table Checks by @stark4n6 in #1044
• Minor Fixes by @stark4n6 in #1045
• Minor Formatting and R/O fixes by @stark4n6 in #1049
• Fix icon by @stark4n6 in #1050
• Update mailprotect.py by @stark4n6 in #1051
• Enhance Apple Clock Artifacts with New Stopwatch and Timer Artifacts by @justan00b91 in #996
• Update health.py by @MetadataForensics in #1047
• Minor Fixes by @stark4n6 in #1054
• Create callHistoryGroupCall by @MetadataForensics in #1052
• Update Call History Group Call by @stark4n6 in #1056
• Added Support for new Photos.sqlite db & report icons by @ScottKjr3347 in #1055
• Media manager by @Johann-PLW in #1057
• Update search_files.py by @Johann-PLW in #1058
• Update search_files.py and lavafuncs.py by @Johann-PLW in #1059
• Update builds_ids.py by @Johann-PLW in #1060
• iLEAPP version 2.1.0 by @Johann-PLW in #1061

New Contributors

• @justan00b91 made their first contribution in #996

Full Changelog: v2.0.4...v2.1.0

v2.0.4

What's Changed

• Update version number and builds_ids.py by @Johann-PLW in #1020
• Update iTunesBackupInfo.py for lava output by @Johann-PLW in #1024
• Update iTunesBackupInfo.py for lava output by @Johann-PLW in #1025
• Update appleMapsGroup.py for lava output by @Johann-PLW in #1026
• Update builds_ids.py by @Johann-PLW in #1027
• Calculator# Application by @charpy4n6 in #1028
• Update appConduit.py by @Johann-PLW in #1029
• Update ileapp.py by @Johann-PLW in #1030
• Update nsVault.py for lava output by @Johann-PLW in #1031
• Update README.md by @stark4n6 in #1032
• Update builds_ids.py by @Johann-PLW in #1033
• Update HTML report with new icon and logo by @Johann-PLW in #1034
• Update version number by @Johann-PLW in #1035
• Update ileappGUI_macOS.spec to support assets in binary by @Johann-PLW in #1036
• Update ileappGUI.py - Fix issue missing assets for binaries by @Johann-PLW in #1037

Full Changelog: v2.0.3...v2.0.4

v2.0.3

What's Changed

• Foursquare Swarm by @djangofaiola in #968
• Remove 'version' and add 'last_update_date' in artifact_v2 by @Johann-PLW in #991
• Update filesApp.py for lava output by @Johann-PLW in #992
• Minor modules updates by @Johann-PLW in #993
• Update report.py - Ignoring files starting with '._' by @Johann-PLW in #994
• Update builds_ids.py by @Johann-PLW in #995
• Update wire.py for lava output by @Johann-PLW in #1002
• Update ilapfuncs.py - Improve kmlgen by @Johann-PLW in #1003
• Update ilapfuncs.py - Fix Issue #1004 by @Johann-PLW in #1005
• Update builds_ids.py by @Johann-PLW in #1006
• Update builds_ids.py by @Johann-PLW in #1008
• Update Splitwise.py for lava output by @Johann-PLW in #1009
• Update googleTranslate.py for lava output by @Johann-PLW in #1010
• Fix open db issue with does_table_exist function by @Johann-PLW in #1011
• Update does_column_exist_in_db function by @Johann-PLW in #1012
• Rename does_table_exist to does_table_exist_in_db by @Johann-PLW in #1013
• Rename does_view_exist to does_view_exist_in_db by @Johann-PLW in #1014
• Update fsCachedData.py by @hollykennedy in #1016
• Updated for LAVA and ios17-18 updates by @ScottKjr3347 in #1015
• Fix issue #1017 by @Johann-PLW in #1018
• Update builds_ids.py by @Johann-PLW in #1019

New Contributors

• @hollykennedy made their first contribution in #1016

Full Changelog: v2.0.2...v2.0.3

v2.0.2

What's Changed

• header language admin stuff by @JamesHabben in #944
• Bug fix telegramMessages.py by @kobo220 in #945
• Update builds_ids.py by @stark4n6 in #946
• Update version number and specs files to build binaries by @Johann-PLW in #947
• Update README.md by @Johann-PLW in #948
• Update builds_ids.py by @Johann-PLW in #949
• Update kmlgen function ilapfuncs.py by @Johann-PLW in #950
• New get_sqlite_db_records(path, query) function by @Johann-PLW in #951
• Update ilapfuncs.py - get_plist_content now uses logfunc to report errors by @Johann-PLW in #952
• Add admin scripts to check modules parsing SQLite databases by @Johann-PLW in #953
• Update accountData.py using new get_sqlite_db_records function by @Johann-PLW in #954
• Update modules_parsing_sqlite_db.md by @Johann-PLW in #955
• Update callHistory.py with new get_sqlite_db_records function by @Johann-PLW in #956
• Update modules for lava output by @Johann-PLW in #957
• Adding new get_file_path function by @Johann-PLW in #958
• Update get plist content feature by @Johann-PLW in #959
• Update documentation by @Johann-PLW in #960
• Update modules with new safety functions by @Johann-PLW in #961
• Skg archive by @snoop168 in #962
• Modules updates and minor fixes by @Johann-PLW in #963
• Update builds_ids.py - Typo for iOS 18.2 RC by @Johann-PLW in #964
• Improve kmlgen function by @Johann-PLW in #965
• add PayByPhone module by @borelmo in #966
• Update payByPhone.py by @Johann-PLW in #967
• Update modules with safety functions by @Johann-PLW in #970
• call history temp and transactions artifacts by @snoop168 in #969
• Update callHistory.py - Merging callHistoryTemp into callHistory by @Johann-PLW in #971
• Rename filesApps.py to filesApp.py by @Johann-PLW in #972
• Update builds_ids.py by @Johann-PLW in #973
• detect proper file based on ios version comments by @snoop168 in #974
• Update bluetoothPairedReg.py - Fix Last Seen Time displayed in local … by @Johann-PLW in #986
• Update bluetoothPairedReg.py - Fix Last Seen timestamp by @Johann-PLW in #987
• Trusted Peers Database by @charpy4n6 in #975
• Update ilapfuncs.py - Missing return statement in convert_cocoa_core_… by @Johann-PLW in #989
• Update spec files to build binaries for v2.0.2 by @Johann-PLW in #990

New Contributors

• @kobo220 made their first contribution in #945
• @borelmo made their first contribution in #966

Full Changelog: v2.0.1...v2.0.2

v2.0.1

What's Changed

• Update modules for lava output by @Johann-PLW in #914
• Lava output dev by @snoop168 in #915
• Update ilapfuncs.py - Fix path issue with media_to_html by @Johann-PLW in #917
• Lava output updates by @Johann-PLW in #918
• Update lavafuncs.py - Fix issue #916 by @Johann-PLW in #919
• Update modules for lava output by @Johann-PLW in #920
• Lava output dev by @snoop168 in #921
• Lava output code refactorisation by @Johann-PLW in #922
• Modules update for lava output by @Johann-PLW in #923
• Update builds_ids.py by @Johann-PLW in #924
• Updates health module for lava output by @Johann-PLW in #925
• Updates for lava output by @Johann-PLW in #926
• Update knowledgeC.py for lava output and small updates by @Johann-PLW in #927
• Update health.py for lava output - merged WatchSleepData.py and Watch… by @Johann-PLW in #928
• Update carCD.py - LastVehicleConnectionV2 key, update for device_info by @Johann-PLW in #929
• Update lastBuild.py - Merged Ph99SystemVersionPlist.py updated for lava output by @Johann-PLW in #930
• Clean up root directory of iLEAPP by @Johann-PLW in #931
• Fix issues with iTunes backups by @Johann-PLW in #932
• Split systemVersionPlist from lastBuid by @Johann-PLW in #933
• Remove extra ',' in artifact_v2 block by @Johann-PLW in #934
• Adding support of artifact_icon in Artifact Info Block Structure by @Johann-PLW in #936
• update image_manifest.json reference by @emmanuel-ferdman in #935
• Add Plist Handling Functions in ilapfuncs.py by @Johann-PLW in #938
• GeoD Maptiles add support for Tiles table and update lava output by @snoop168 in #939
• Add new subscriberInfo module by @Johann-PLW in #940
• chrome lava updates by @snoop168 in #941
• Chrome Fix and TextInputSession Fix by @snoop168 in #942

New Contributors

• @emmanuel-ferdman made their first contribution in #935

Full Changelog: v2.0.0...v2.0.1

v2.0.0

What's Changed

• Initial load for lava output by @JamesHabben in #825
• Update ileappGUI.py by @Johann-PLW in #826
• Update ileappGUI.py - Generate LAVA-specific output by @Johann-PLW in #827
• Update modules for lava-output by @Johann-PLW in #828
• update lava output by @JamesHabben in #830
• Module Info Script by @JamesHabben in #831
• Update modules for lava-output by @Johann-PLW in #832
• Code cleaning by @Johann-PLW in #833
• Filepath Search Script and Documentation by @JamesHabben in #834
• Update update_module_info.yml by @JamesHabben in #835
• Update builds_ids.py by @stark4n6 in #836
• Update alarms.py for lava-output by @Johann-PLW in #837
• Code polishing for lava-output by @Johann-PLW in #838
• Update module_updates.md by @Johann-PLW in #839
• removing logdevinfo by @Johann-PLW in #842
• Update applelocationd.py for lava-output by @Johann-PLW in #843
• Update applePodcasts.py by @abrignoni in #844
• update advanced module update by @JamesHabben in #845
• Update applePodcasts.py by @abrignoni in #846
• Modules update by @Johann-PLW in #847
• New HTML report folder structure by @Johann-PLW in #848
• feature docs by @JamesHabben in #852
• Apple wallet nano passes by @abrignoni in #853
• Update module_updates.md by @JamesHabben in #856
• Update module_updates.md by @JamesHabben in #857
• Appcounduit & TCC lava support by @abrignoni in #859
• Update appGrouplisting.py by @abrignoni in #860
• Update appItunesmeta.py by @abrignoni in #861
• Improve regex searches and file copies by @Johann-PLW in #862
• Added Artifact parser for App LinkedIn by @kalink0 in #858
• create module test harness by @JamesHabben in #863
• Update ilapfuncs.py - Fix convert_plist_date_to_timezone_offset by @Johann-PLW in #864
• update test docs and action trigger by @JamesHabben in #865
• Update search_files.py - Fix windows path for files extracted from a zip by @Johann-PLW in #866
• Lava output by @JamesHabben in #867
• Applicationstate & apple maps last activity camera by @abrignoni in #868
• Update report folder structure - Improve regex searches and file copies by @Johann-PLW in #869
• Update builds_id.py and remove Python 3.12 warnings by @Johann-PLW in #870
• Update version number to reflect additions since last binaries by @Johann-PLW in #871
• Update search_files.py by @Johann-PLW in #872
• Remove Python3.12 warnings & fix path issue with some zip extractions by @Johann-PLW in #873
• Update ileappGUI.py by @Johann-PLW in #874
• Update ileappGUI.py by @Johann-PLW in #875
• Lava output by @JamesHabben in #876
• testing and module updates by @JamesHabben in #877
• Update ilapfuncs.py - Fix _TSV Exports folder path by @Johann-PLW in #878
• update to testing docs by @JamesHabben in #880
• resolve kml error issue with 'all' in output_types by @Johann-PLW in #881
• Update module_updates.md - Output types by @Johann-PLW in #882
• Update module_updates.md - Output types by @Johann-PLW in #883
• minor module updates and testing update by @JamesHabben in #884
• Update airtags.py for Lava output - Renamed findMyItems.py by @Johann-PLW in #885
• module and docs by @JamesHabben in #886
• Lava output by @snoop168 in #879
• Lava output by @JamesHabben in #887
• control center Lava output by @JamesHabben in #890
• Create file_content_access_architecture.md by @JamesHabben in #891
• Lava output biomes by @snoop168 in #889
• Move test data and results by @JamesHabben in #893
• module updates by @JamesHabben in #894
• show path as the filename in html report by @snoop168 in #895
• update conDev by @JamesHabben in #896
• embed ccl-segb library by @snoop168 in #897
• Update sysShutdown by @stark4n6 in #898
• Update DataUsage for LAVA by @stark4n6 in #899
• Spotlight Search Engagements by @snoop168 in #900
• use artifact_processor by @snoop168 in #901
• new module for webkit by @JamesHabben in #902
• update device_info by @JamesHabben in #903
• module updates by @JamesHabben in #904
• Update builds_ids.py by @stark4n6 in #906
• Update builds_ids.py by @stark4n6 in #907
• Merged lava-output branch by @Johann-PLW in #908
• Files processed are logged only with research_mode by @Johann-PLW in #909
• update teams by @JamesHabben in #911
• update teams by @JamesHabben in #912
• Add source file path in a tooltip in DeviceInfo.html file by @Johann-PLW in #913

Full Changelog: v1.19.5...v2.0.0