#ileapp

📱 New: Telegram support across both LEAPPs, plus a reference nobody had published. Fifteen artifacts. Six for iOS in iLEAPP, nine for Android in ALEAPP, which had no Telegram support at all before this. Thanks Geraldine Blay for the questions that spurred all this research and development. ⚙️ The settings. Auto download stored per network type and per chat category, plus Save to Photos and Save to Gallery. These are what answer whether a photo ever reached the device gallery, which the message record cannot tell you. ⚠️ The warning that matters most: Telegram writes no settings record until the user changes something. No key in the database does not mean "off," it means the app default applied. A tool that prints "off" there is inventing evidence. Ours distinguishes the two states explicitly. 📖 The system events reference. The two clients name the same events differently, and only 27 of roughly 70 pair by name. So: 64 iOS types, 68 Android types, 62 paired, every row linking to the defining line in Telegram's own source, pinned to a commit. Printable PDF included. Also documented: our own gaps. Five capabilities we could not validate against real data, listed in the post, with a request for research images. Blogpost: leapps.org/blog-post?post=2026-08-04-telegram-ios-android-coverage Telegram Events Reference Documentation: leapps.org/blog-post?post=2026-08-04-telegram-system-events-reference #DFIR #DigitalForensics #MobileForensics #LEAPPs #ILEAPP #ALEAPP

Apple Unified Logs are no longer an edge-case data source. 🔒 Lock/unlock activity 📱 App launches 📶 Connectivity changes 📸 Screenshots 🧭 Navigation My updated article covers acquisition, macOS 26.4 Info.plist requirements, iLEAPP processing, 132 message predicates across 23 evidentiary themes, and analysis in LAVA/SQLite. Article + printable guide: https://leapps.org/blog-post?post=2026-07-29-apple-unified-logs #DFIR #iOSForensics #DigitalForensics #iLEAPP

🚀 iLEAPP v2026.2.1 is out! The Biome rabbit hole keeps going deeper. This release adds 60+ new Biome streams: 🔋 Device power and lock state 📍 Location visits and app location activity 📸 Camera AutoFocus ROI ⚡ Energy mode and boot sessions 🚨 Emergency voice calls 😀 Emoji engagement 🧠 A full Apple Intelligence family, including Safety Overrides Several of those came out of research by the awesome Mattia Epifani. Thank you Mattia! Also in this release: 💬 Signal for iOS: full message and contact parsing, conversation view with attachments, and detection of Signal's timestamped GRDB directories 🔑 Expanded keychain handling: examiner-supplied keychains, a pure Python SQLCipher reader, UFED encrypted keychain dumps, and reuse of a keychain already carried by the extraction 🔔 Notifications overhaul: attachments checked in as media, embedded payload images recovered, payload fields split into their own columns, and notifications no longer reported three times over Plus fixes for addressBook column pruning, a MemoryError during HTML report generation, several Timeline issues, and an SMS rendering crash. Welcome to four first-time contributors: CynthiavDorp, JSap0914, Sanjays2402, and sandrzejewskipl! 🔗 Get iLEAPP: https://www.leapps.org/releases#section-ileapp #DFIR #MobileForensics #DigitalForensics #iOS #FLOSS #iLEAPP

New iLEAPP parser: the United Airlines iOS app! ✈️ New blog post from the awesome James Habben walking through the research: where the data lived, which rabbit holes were worth chasing, and which ones he left alone. 12 new artifacts in iLEAPP: 👤 Account profile 🧳 Saved travelers and trip passengers 🎫 Trips, boarding passes, and PNR documents 🔎 Booking and flight status searches 📋 Boarding status log 🎬 Inflight entertainment watch history ⌚ Watch complications 💬 iMessage recipients from the app's plugin cache The traveler/passenger split, the trip JSON mining, and that late-discovered iMessage plugin cache are the fun ones. Read the write-up, it shows the actual thinking, not just the results. Thank you James! 📖 Read it: https://leapps.org/blog-post?post=united-ios-app-artifacts 🔗 Get iLEAPP: https://www.leapps.org/releases#section-ileapp #DFIR #MobileForensics #DigitalForensics #iOS #FLOSS #iLEAPP