Alexis Brignoni🪫

New DFIR Thoughts post: Put AI in the code, not the conclusions 🎯 Ask a chatbot the same question ten times, get ten answers. Tested code gives one, and if it's wrong, you fix it once. leapps.org/blog-post?po... #DFIR #AI

The Dropbox DBX key used to need DPAPI. On the install we tested, it sits in a file next to the databases. New post on how DLEAPP now opens config.dbx and instance.dbx, with thanks to Heather Charpentier and Mattia Epifani. leapps.org/blog-post?post=2026-10-18-dropbox-dbx-decryption-revisited

Two new probes, and every probe now opens a window. chromiumcacheprobe rebuilds the H.264 video Chrome caches on Android. mediacarve carves images and video by signature. All five ship a window beside the command line. leapps.org/probes #DFIR

VLEAPP nearly doubled: 103 artifacts at the last release, 202 on main now. Ford SYNC, GM OnStar, GM Bosch HMI, Nissan 08IT, BMW MGU, SiriusXM and more. Also: DLEAPP +65, iLEAPP +11, ALEAPP +9, and raw images can now offer free space and deleted files to artifacts. leapps.org/releases#sec... #DFIR

GLEAPP never goes online. The new GLEAPP Map Downloader cuts an area of the Protomaps planet map into one .pmtiles file for it. Planet: 138.4 GB. DC to street level: 27.2 MB. leapps.org/releases#section-gleapp-map-downloader #DigitalForensics

Go figure! I'm #6 on the trending developers list on Github.

qnxprobe v1.50 recovers deleted files off YAFFS2, JFFS2 and UBIFS flash, opens BitLocker and encrypted APFS with a password, and opens E01, AFF4, .dmg and VMDK directly. leapps.org/probes#section-qnxprobe #DFIR

Deleting a file on flash does not erase it. The pages stay until garbage collection gets to the block. qnxprobe recovers deleted files from YAFFS2, JFFS2 and UBIFS. On a real Android dump: 1,945 deleted, 1,924 complete, 149 of 150 checked byte for byte. leapps.org/releases#section-qnxprobe #DFIR

github.comRelease Arc2Lite v3.0.0 · stark4n6/Arc2LiteWhat's Changed Huge thank you to @abrignoni for adding E01 and forensic container support. Feat/disk image input by @stark4n6 in #3 Full Changelog: v2.0.0...v3.0.0

New LEAPP in the family: GLEAPP 🖼️🎞️ Image and video triage. Hashing, visual de-dup, EXIF and GPS, video key frames, known-hash matching and a review gallery. By Heather Charpentier. Free and open source. www.leapps.org/releases#sec... #DigitalForensics #DFIR

Alexis Brignoni🪫 reposted

Kevin 🤖🕵️🍺

@stark4n6.bsky.social

18 Sept

Arc2Lite v3.0.0 has been released, now with support to index E01 and other forensic containers thanks to @abrignoni.com #DFIR github.com/stark4n6/Arc...

4 Sept

I interviewed MMKV, the key-value store inside TikTok, Discord, Coinbase and a billion WeChat accounts. It gave up what survives a delete, how to spot an encrypted file, and the one byte that will wreck your report. leapps.org/blog-post?po...

theverge.comMark Zuckerberg doesn’t understand how to liveAn AI future of sleek, streamlined, and totally empty relationships.

26 Aug

iLEAPP now reports FEWER installed apps. 3,981 down to 791. That is the fix. The old count included app extensions and container activity that never proved an install. History went up, 9,575 to 11,786. The claim got smaller, the evidence got bigger. leapps.org/blog

Alexis Brignoni🪫 reposted

iLEAPP and ALEAPP are both at v2026.3.1. Snapchat, Tinder, TikTok, Reddit, Proton Mail, WhatsApp and Chrome payments landed on both sides in the same release. Plus DuckDuckGo absent columns now read empty instead of "No". Absence is not a finding. leapps.org/releases

Alexis Brignoni🪫 reposted

The Verge

@theverge.com

15 Aug

"Is the point of life merely to stockpile accomplishments? If that is what Silicon Valley believes, no wonder all the billionaires seem so unhappy all the time! They have traded experience for accomplishment, and cheated themselves out of their own lives in the process."

15 Aug

All five LEAPPs just went v2026.3.0. LAVA v0.15.0. Same day. iLEAPP: Apple Unified Logs bundled in every build ALEAPP: Signal with full SQLCipher decryption DLEAPP: Roblox and Telegram Desktop leapps.org/releases

leapps.orgUsing AI Effectively in Digital Forensics — LEAPPs BlogA decent version of most digital forensics software can now be made at home, in a few hours, by a user that does not code. What does that mean for vendors and for us as users, and what actually makes ...

7 Aug

A decent version of most #DFIR software can now be made at home, in a few hours, by someone who does not code. So what makes anyone an expert now? Five qualities, and "has access to #AI" is not one. leapps.org/blog-post?po...

5 Aug

📱 Telegram: 15 new artifacts across iLEAPP and ALEAPP, plus a cross-platform system events reference. ⚠️ No settings key does not mean "off." It means the app default applied. Printing "off" invents evidence. leapps.org/blog-post?post=2026-08-04-telegram-ios-android-coverage #DFIR

leapps.orgEvery Step You Take, Eight Years Later: Android UsageStats and Recent Tasks — LEAPPs BlogAndroid's pattern-of-life evidence grew from readable XML into tokenized protobufs carrying app lifecycle, lock state, notifications, services, task roots, and more. We went back to the source, update...

4 Aug

📱 Eight years after my Android UsageStats posts, the XML became protobuf, 4 event types became 32, and ALEAPP now parses all of it. ⚠️ ACTIVITY_RESUMED is not "the user tapped the app." It is a lifecycle state. leapps.org/blog-post?post=2026-08-03-android-usagestats-recent-tasks #DFIR

leapps.orgApple Unified Log Predicates in iLEAPP: The Reference — LEAPPs BlogEvery Unified Log message predicate iLEAPP searches for, artifact by artifact, with the processes involved, the iOS versions each pattern was observed on, the sources that documented them, and the cav...

2 Aug

Every Apple Unified Log predicate iLEAPP searches for, artifact by artifact. 34 artifacts, 230 predicates, each sourced and validated against real iOS extractions. Free, PDF included. #DFIR leapps.org/blog-post?po...

1 Aug

Good analogy.

Dare Obasanjo@carnage4life.bsky.social

Someone saying I didn’t actually build a vibe coded app because “you simply pushed a button” is like telling me I didn’t sew my shirt and just clicked [Buy] on Amazon. I’m sure it’s an insult in some circles but to me this is exactly why technology exists.

leapps.orgExtracting, Processing, and Querying Apple Unified Logs from an iOS Device — LEAPPs BlogApple Unified Logs can show locks, app launches, connectivity, navigation, and more. Here is the updated workflow for acquiring them, processing them with iLEAPP, and working the results in LAVA.

29 July

Apple Unified Logs may reveal locks, app launches, connectivity changes, screenshots, navigation, and more. Updated: acquisition, iLEAPP processing, 132 message predicates, and LAVA/SQLite analysis. leapps.org/blog-post?po... #DFIR #iOSForensics

Alexis Brignoni🪫 reposted

Andrea Pitzer

@andreapitzer.bsky.social

28 July

Some of you are still posting AI-generated images, and it’s always tremendously disappointing.

blog.digital-forensics.it84 Streams Later: Exploring the Evolution of Apple Biome in iOSDFIR research

26 July

Mattia Epifani mapped Apple Biome from iOS 14 to iOS 26 and documented 84 streams worth of forensic value. He sent the streams over as he found them. iLEAPP went from 45 Biome artifacts to 101 in two days. Blog: blog.digital-forensics.it/2026/07/84-s... iLEAPP: leapps.org/releases#sec... #DFIR

25 July

🚀 Everybody gets a release! iLEAPP, ALEAPP, RLEAPP, VLEAPP at v2026.2.0. LAVA at v0.14.0. Biome artifacts, iOS 26 Photos, Samsung clipboard WAL recovery, Snapchat returns overhaul, and row tagging in LAVA. leapps.org/blog-post?post=2026-07-25-everybody-gets-a-release #DFIR

digitalforensicsnowespanol.buzzsprout.comDigital Forensics Now - EspañolEs Digital Forensics Now pero traducido al español gracias a la inteligencia artificial.

25 July

Digital Forensics Now ahora habla español. 🎙️ Same show, same voices, ahora en tu idioma. AI voice cloning, open source models, running locally, and every translation verified. Stochastic tools, deterministic output, human verification. That's the recipe. digitalforensicsnowespanol.buzzsprout.com

25 July

🌋 LAVA 0.14.0 is here. Tag rows of interest in any artifact table, add examiner notes, then export just those rows as an HTML report or a full subset LAVA project with provenance built in. Your evidence db is never written to. leapps.org/releases#section-lava #DFIR

23 July

New in iLEAPP: Biome - Device TimeZone, contributed by Cynthia van Dorp. iOS 17+ keeps a timezone change log in the Device.TimeZone biome, and every change timestamped. On one test ima ge it mapped the device moving between New York, Chicago, and Honolulu time. Travel evidence hiding in a biome#DFIR

23 July

New in ALEAPP: full Mister Skinnylegs integration by Alex Caithness and CCL. 28 new browser artifacts for Android Chromium browsers and webviews, from history and searches to crypto apps, Discord, and AI chats. And it auto-picks up every Skinnylegs plugin. Free and open source. #DFIR

leapps.orgASTC, Cython, and bugs! — LEAPPs BlogWhat do texture decompression, C-extensions for python, and LEAPPs have in common? Read to find out!

22 July

New on the LEAPPs blog. ⚙️ astc_decomp_faster now builds on Python 3.13 and 3.14, every platform, including Apple Silicon. That unblocks the LEAPPs on the latest Python A great deep-dive from Bruno Constanzo on ASTC, Cython, and bugs. #DFIR leapps.org/blog-post?post=2026-07-22-astc-cython-and-bugs

leapps.orgFeature Highlight: Recent Run History in LAVA — LEAPPs BlogA quick look at the new opt-in LEAPPs recent run history feature and how LAVA can use it to put recent parser outputs right on the welcome screen.

21 July

New LEAPPs feature highlight! ✨ Run a parser and lose track of the output folder? LAVA now shows your recent iLEAPP, ALEAPP, RLEAPP, and VLEAPP runs right on the welcome screen. Opt-in by design. Nice work by the awesome James Habben. leapps.org/blog-post?post=feature-leapps-recent-run-history

leapps.orgA Trip Through the United iOS App — LEAPPs BlogA look at United Airlines iOS app research in iLEAPP, including where the data lived, which rabbit holes mattered, and why nearby app/plugin data can change the shape of the parser.

16 July

New iLEAPP parser: the United Airlines iOS app! ✈️ Trips, boarding passes, saved travelers, booking searches, inflight watch history, even iMessage recipients from a plugin cache. 12 artifacts. Great write-up from the awesome James Habben. #DFIR leapps.org/blog-post?post=united-ios-app-artifacts

leapps.orgReleases — LEAPPsDownload the latest releases of iLEAPP, ALEAPP, RLEAPP, VLEAPP, and LAVA — free open-source digital forensics tools.

16 July

Photos.sqlite in LAVA! 📸 The full Photos.sqlite parser family in iLEAPP, 42 artifacts, now in LAVA. Assets, locations, GenAI images, faces, shared albums, iOS 14-26. Data heavy reports crash HTML output. LAVA does not. Massive work by the awesome Scott Koenig. leapps.org/releases#section-ileapp

leapps.orgBlog — LEAPPsForensics deep dives, tool updates, artifact write-ups, and community contributions from the LEAPPs project.

16 July

Busy stretch on the LEAPPs blog, a lot of it about AI in forensics: 🪔 Be Careful What You Wish For 🖼️ Spotting AI Generated Images in iLEAPP and ALEAPP 🧬 The Rules Keep Changing All free and open source. leapps.org/blog

leapps.orgBe Careful What You Wish For — LEAPPs BlogThe genie can grant almost anything. It cannot grant you judgment. And judgment is the one thing you need in order to control it.

14 July

We are implementing AI in digital forensics wrong A technology that works like a genie: make a wish, the genie provides. What is not to like? Plenty. New post on wishes, monkey's paws and the one thing the genie can never grant you leapps.org/blog-post?post=2026-07-12-be-careful-what-you-wish-for

Alexis Brignoni🪫 reposted

Ian Coldwater 🧊🚫

@lookitup.baby

13 July

Replying to @lookitup.baby

if the UI and UX suck or features people want to use aren’t there I promise you it’s not as good an alternative as you think most users just want to get things done on software that works well, and yelling at them about how they’re wrong to want what they want doesn’t actually help them or you

13 July

🚨 RELEASE THE LEAPPS! 🚨 New parsers, better timelines, AI-content flags, cleaner reports. All free, all open source. 🔗 Get them: leapps.org/releases It's alive!!! #DFIR #MobileForensics #MobileForensics

leapps.orgSpotting AI Generated Images in iLEAPP and ALEAPP — LEAPPs BlogiLEAPP and ALEAPP can now flag AI generated images by reading content provenance two ways, C2PA Content Credentials manifests and the IPTC Digital Source Type in XMP. Pure Python, no new…

New in iLEAPP and ALEAPP: flag AI generated images! 🤖 The new C2PA Content Provenance artifact reads AI provenance two ways: 🧬 C2PA Content Credentials 🏷️ IPTC Digital Source Type (XMP) 🐍 Pure Python Merged now, run from source today. 🔗 leapps.org/blog-post?po... #DFIR #FLOSS #DigitalForensics

💫 New episode of the Digital Forensics Now Podcast is out! 🛠️ It is all about tools and automation. 🫥 We also discuss testing and transparency. 📱 Announcement of the latest iLEAPP & ALEAPP releases. 🌋 All LEAPP artifacts are fully LAVA compliant. 🔗 Check it out! www.youtube.com/c/AlexisBrig...

leapps.orgThe Rules Keep Changing — LEAPPs BlogThe first fully LLM-generated set of artifacts lands in iLEAPP: fourteen Biome parsers built from public community research and test data, 3,668 rows of previously unparsed data on the first clean pas...

What? Brigs using an LLM? Yes. I had Claude generate a complete iLEAPP artifact for the new iOS Biome SQLite databases. 14 artifacts, 3,668 rows, clean first pass. The LLM wrote the code. The examiner owned the verification. leapps.org/blog-post?post=2026-07-11-the-rules-keep-changing

leapps.orgArtifacts — LEAPPsBrowse all artifacts supported by iLEAPP, ALEAPP, RLEAPP, and VLEAPP.

🔎 New on the LEAPPs Artifact Browser: click "samples" on any parser to see the test images it was validated against, with row counts. Knowing what a tool was tested against is the work, not a nice to have. leapps.org/artifacts #DFIR

leapps.orgReleases — LEAPPsDownload the latest releases of iLEAPP, ALEAPP, RLEAPP, VLEAPP, and LAVA — free open-source digital forensics tools.

11 July

🚀 iLEAPP + ALEAPP v2026.1.0 are out! New calendar versioning, the LAVA migration essentially complete, Tabler icons, and fresh parsers: Oura Ring, Zalo, Home Depot, HONOR, Samsung Secure Folder, plus new conversation views. 🔗 leapps.org/releases #DFIR #MobileForensics

leapps.orgThe Apps We Are Not Parsing (Yet) — LEAPPs BlogBatch LEAPP now answers a question I have wanted answered for years. Out of all the apps installed on our test devices, which ones do the LEAPPs actually parse, and which ones are we missing? One flag...

9 July

Which apps are the LEAPPs NOT parsing? Batch LEAPP's new --coverage mode measures it against real test images and gives you the gaps ranked by evidence. Snapchat: unparsed in 5 of 5 iPhones, 29k files unread. Full write-up: leapps.org/blog-post?po... #DFIR #DigitalForensics #FLOSS #MobileForensics

leapps.orgGetting It Done with Home Depot iOS Artifacts — LEAPPs BlogA look at new iLEAPP parsing for the Home Depot iOS app, including account details, store preferences, searches, viewed products, shopping lists, cached location, and a few useful cache artifacts.

1 July

New iLEAPP artifact by James Habben: Home Depot iOS App Check out the blog post here: 👉 leapps.org/blog-post?po...

leapps.orgIntroducing Batch LEAPP — LEAPPs BlogBatch LEAPP runs any LEAPP tool across an entire folder of extractions and builds one report index that links every result, with hashing and a manifest for your case file. Here is what it does and how...

30 June

🚨 Introducing Batch LEAPP. Ever had a folder full of extractions and run them through iLEAPP one at a time? Not anymore. #DFIR Batch LEAPP points at a directory, finds every extraction inside, and runs iLEAPP, ALEAPP, RLEAPP, or VLEAPP on each one. 🔗 Read the post: leapps.org/blog-post?po...

leapps.orgReleases — LEAPPsDownload the latest releases of iLEAPP, ALEAPP, RLEAPP, VLEAPP, and LAVA — free open-source digital forensics tools.

29 June

🚀 Django Faiola rebuilt the Waze parser for the new iLEAPP framework. 📍 Account details, GPS tracks, search history, recent destinations, favorites, shared locations, planned events, TTS navigation. 🔧 Fully integrated into LAVA too. 🔗 Read the blog post: djangofaiola.blogspot.com/2026/06/comp...

leapps.orgLEAPPs — Digital Forensics ToolsFree digital forensics tools. iLEAPP, ALEAPP, RLEAPP, VLEAPP, and LAVA — parse and visualize artifacts from iOS, Android, Windows, and more.

29 June

🚨 New blog post at LEAPPs.org! 🍺 The LEAPPs and LAVA now install on macOS through Homebrew. ➕ Add the tap and get your digital forensics on. 🙏 Thanks to James Habben for the implementation and post. 👇 Read the blog post here: leapps.org/blog-post?po...

26 June

Digital Forensics visually explained. 🌐 leapps.org 🌐 abrignoni.github.io