#mobileforensics

@abrignoni@infosec.exchange · 53m ago

Mattia Epifani published "84 Streams Later", tracking Apple Biome from iOS 14 through iOS 26 and what it means for examiners. Community work at its best: he found the streams and shared samples, we wrote and validated the parsers. iLEAPP went from 45 Biome artifacts to 101 in two days. Where we could check a field against another source on the same device, we did. Call direction against CallHistory, message direction against sms.db, lock state against the DKEvent streams. Where we could not confirm a value, the column says raw and the notes say why. Run from python code to benefit today. Parsers will be added to the next tool release soon Free and open source, as always. Blog: https://blog.digital-forensics.it/2026/07/84-streams-later-exploring-evolution-of.html iLEAPP: https://leapps.org/releases#section-ileapp #DFIR #MobileForensics #iOSForensics

0

Alexis Brignoni

@abrignoni@infosec.exchange · 2d ago

New iLEAPP artifact: Biome - Device TimeZone, contributed by Cynthia van Dorp. Starting around iOS 17, the Device.TimeZone biome stream keeps a record of every timezone the device switches into, each entry with a SEGB timestamp. That means a built-in travel timeline: on one of our test images the output showed the device going New York, then Chicago, then Honolulu, then back, all with exact times. Tested against 8 iOS 17 and 18 images from our corpus before merging. Free and open source, as always. #DFIR #iosforensics #mobileforensics

0

Alexis Brignoni

@abrignoni@infosec.exchange · 3d ago

Happy to share that ALEAPP now integrates Mister Skinnylegs, the browser artifact framework from Alex Caithness and CCL Solutions Group. This adds 28 artifacts targeting Chromium-based browsers and webviews on Android: browsing history, Google/Bing/DuckDuckGo searches, local and session storage, and app-specific data from Binance, Coinbase, Discord, ChatGPT, DeepSeek, Dropbox, Google Drive, Reddit and more. Best part: the artifacts are generated at runtime, so ALEAPP picks up whatever Skinnylegs plugins ship with the version you have installed. Free and open source. #DFIR #mobileforensics #Android

0

Alexis Brignoni

@abrignoni@infosec.exchange · Jul 16, 2026

New iLEAPP parser: the United Airlines iOS app! ✈️ New blog post from the awesome James Habben walking through the research: where the data lived, which rabbit holes were worth chasing, and which ones he left alone. 12 new artifacts in iLEAPP: 👤 Account profile 🧳 Saved travelers and trip passengers 🎫 Trips, boarding passes, and PNR documents 🔎 Booking and flight status searches 📋 Boarding status log 🎬 Inflight entertainment watch history ⌚ Watch complications 💬 iMessage recipients from the app's plugin cache The traveler/passenger split, the trip JSON mining, and that late-discovered iMessage plugin cache are the fun ones. Read the write-up, it shows the actual thinking, not just the results. Thank you James! 📖 Read it: https://leapps.org/blog-post?post=united-ios-app-artifacts 🔗 Get iLEAPP: https://www.leapps.org/releases#section-ileapp #DFIR #MobileForensics #DigitalForensics #iOS #FLOSS #iLEAPP

0

Alexis Brignoni

@abrignoni@infosec.exchange · Jul 14, 2026

New blog post: Be Careful What You Wish For. We are implementing AI in digital forensics wrong. Here is a new technology that works like a genie. You make a wish, the genie provides. Need a timeline? Ask the genie. A data source you don't understand? Ask the genie, it comes back parsed. What is not to like? Plenty, it turns out. For the last few weeks I have been using Claude extensively on the LEAPPs codebase, reviewing every single PR. That work taught me exactly what the genie can do, what it cannot, and what happens the moment you forget the difference. So I wrote it down. It is about wishes, monkey's paws, and the one thing the genie can never grant you. 📖 Read it: https://leapps.org/blog-post?post=2026-07-12-be-careful-what-you-wish-for #DFIR #MobileForensics #DigitalForensics #AI #FLOSS

0

About This Hashtag

#mobileforensics

Related