Alexis Brignoni

· 2mo ago

New blog post: Be Careful What You Wish For. We are implementing AI in digital forensics wrong. Here is a new technology that works like a genie. You make a wish, the genie provides. Need a timeline? Ask the genie. A data source you don't understand? Ask the genie, it comes back parsed. What is not to like? Plenty, it turns out. For the last few weeks I have been using Claude extensively on the LEAPPs codebase, reviewing every single PR. That work taught me exactly what the genie can do, what it cannot, and what happens the moment you forget the difference. So I wrote it down. It is about wishes, monkey's paws, and the one thing the genie can never grant you. 📖 Read it: https://leapps.org/blog-post?post=2026-07-12-be-careful-what-you-wish-for #DFIR #MobileForensics #DigitalForensics #AI #FLOSS

Be Careful What You Wish For — LEAPPs Blog

The genie can grant almost anything. It cannot grant you judgment. And judgment is the one thing you need in order to control it.

· 7mo ago

🆕 #Android Samsung #Knox (Secure Folder) history log artifact in #ALEAPP.
🪵 SQLite database contains a log of items requested be moved in or out of the secure folder in Samsung Android devices.
👏 Thanks to HSI Digital Forensics Examiner Geovanny Perez for the discovery of this artifact.

#DFIR

Infosec Exchange

· 2mo ago

Apple Unified Logs are no longer an edge-case data source. 🔒 Lock/unlock activity 📱 App launches 📶 Connectivity changes 📸 Screenshots 🧭 Navigation My updated article covers acquisition, macOS 26.4 Info.plist requirements, iLEAPP processing, 132 message predicates across 23 evidentiary themes, and analysis in LAVA/SQLite. Article + printable guide: https://leapps.org/blog-post?post=2026-07-29-apple-unified-logs #DFIR #iOSForensics #DigitalForensics #iLEAPP

Extracting, Processing, and Querying Apple Unified Logs from an iOS Device — LEAPPs Blog

Apple Unified Logs can show locks, app launches, connectivity, navigation, and more. iLEAPP now parses them natively on Windows, Linux, and macOS. No Mac and no JSON conversion required. Here is the updated workflow.

· 2mo ago

🚀 iLEAPP v2026.2.1 is out! The Biome rabbit hole keeps going deeper. This release adds 60+ new Biome streams: 🔋 Device power and lock state 📍 Location visits and app location activity 📸 Camera AutoFocus ROI ⚡ Energy mode and boot sessions 🚨 Emergency voice calls 😀 Emoji engagement 🧠 A full Apple Intelligence family, including Safety Overrides Several of those came out of research by the awesome Mattia Epifani. Thank you Mattia! Also in this release: 💬 Signal for iOS: full message and contact parsing, conversation view with attachments, and detection of Signal's timestamped GRDB directories 🔑 Expanded keychain handling: examiner-supplied keychains, a pure Python SQLCipher reader, UFED encrypted keychain dumps, and reuse of a keychain already carried by the extraction 🔔 Notifications overhaul: attachments checked in as media, embedded payload images recovered, payload fields split into their own columns, and notifications no longer reported three times over Plus fixes for addressBook column pruning, a MemoryError during HTML report generation, several Timeline issues, and an SMS rendering crash. Welcome to four first-time contributors: CynthiavDorp, JSap0914, Sanjays2402, and sandrzejewskipl! 🔗 Get iLEAPP: https://www.leapps.org/releases#section-ileapp #DFIR #MobileForensics #DigitalForensics #iOS #FLOSS #iLEAPP

leapps.org

blog.digital-forensics.it

· 2mo ago

Mattia Epifani published "84 Streams Later", tracking Apple Biome from iOS 14 through iOS 26 and what it means for examiners. Community work at its best: he found the streams and shared samples, we wrote and validated the parsers. iLEAPP went from 45 Biome artifacts to 101 in two days. Where we could check a field against another source on the same device, we did. Call direction against CallHistory, message direction against sms.db, lock state against the DKEvent streams. Where we could not confirm a value, the column says raw and the notes say why. Run from python code to benefit today. Parsers will be added to the next tool release soon Free and open source, as always. Blog: https://blog.digital-forensics.it/2026/07/84-streams-later-exploring-evolution-of.html iLEAPP: https://leapps.org/releases#section-ileapp #DFIR #MobileForensics #iOSForensics

84 Streams Later: Exploring the Evolution of Apple Biome in iOS

· 2mo ago

Happy to share that ALEAPP now integrates Mister Skinnylegs, the browser artifact framework from Alex Caithness and CCL Solutions Group. This adds 28 artifacts targeting Chromium-based browsers and webviews on Android: browsing history, Google/Bing/DuckDuckGo searches, local and session storage, and app-specific data from Binance, Coinbase, Discord, ChatGPT, DeepSeek, Dropbox, Google Drive, Reddit and more. Best part: the artifacts are generated at runtime, so ALEAPP picks up whatever Skinnylegs plugins ship with the version you have installed. Free and open source. #DFIR #mobileforensics #Android

· 2mo ago

New iLEAPP parser: the United Airlines iOS app! ✈️ New blog post from the awesome James Habben walking through the research: where the data lived, which rabbit holes were worth chasing, and which ones he left alone. 12 new artifacts in iLEAPP: 👤 Account profile 🧳 Saved travelers and trip passengers 🎫 Trips, boarding passes, and PNR documents 🔎 Booking and flight status searches 📋 Boarding status log 🎬 Inflight entertainment watch history ⌚ Watch complications 💬 iMessage recipients from the app's plugin cache The traveler/passenger split, the trip JSON mining, and that late-discovered iMessage plugin cache are the fun ones. Read the write-up, it shows the actual thinking, not just the results. Thank you James! 📖 Read it: https://leapps.org/blog-post?post=united-ios-app-artifacts 🔗 Get iLEAPP: https://www.leapps.org/releases#section-ileapp #DFIR #MobileForensics #DigitalForensics #iOS #FLOSS #iLEAPP

A Trip Through the United iOS App — LEAPPs Blog

A look at United Airlines iOS app research in iLEAPP, including where the data lived, which rabbit holes mattered, and why nearby app/plugin data can change the shape of the parser.

· 2mo ago

Photos.sqlite in LAVA! 📸 The entire Photos.sqlite parser family in iLEAPP, 42 artifacts, is now converted to LAVA. A massive body of work from the awesome Scott Koenig, covering one of the richest sources of evidence on any iOS device. What it parses: 📷 Basic asset and album data 📍 Assets with valid locations ⭐ Favorites, hidden, trashed, and burst assets 🤖 GenAI-detected images 👥 People and detected faces 📤 Shared albums plus iCloud Shared Photo Library assets and contributors 🔗 iCloud shared links 🗂️ Asset internal resource data ⚙️ Camera, MediaAnalysis, and SlideShow plist configs 📱 Per-version reference tables from iOS 14 all the way through iOS 26 Standardized timestamps, guarded queries across iOS versions, and full LAVA output for every one. Here is why that matters. Photos.sqlite is data heavy. The old HTML report can choke and crash under that many rows. LAVA does not. It handles the volume and stays fast and filterable, exactly when you need it to. Huge thank you to Scott Koenig for the research and for keeping it current release after release. 🔗 Get iLEAPP: https://www.leapps.org/releases#section-ileapp #DFIR #DigitalForensics #iOS

leapps.org

· 6mo ago

Sunny and chilly day in Washington DC today

Extremely pleased to be presenting on #DigitalForensics & AI topics for the Organization for American States Workshop on Cybercrime for Prosecutors this week

Amazing group of legal experts from 26 member states collaborating on legal and technical topics

Infosec Exchange

· 2mo ago

💫 New episode of the Digital Forensics Now Podcast is out! 🛠️ It is all about tools and automation. 🫥 We also discuss testing and transparency. What do our tools not cover? 📱 Announcement of the latest iLEAPP & ALEAPP releases. Tons of new stuff. 🌋 All LEAPP artifacts are fully LAVA compliant. 🔗 Check it out! https://www.youtube.com/c/AlexisBrignoni

youtube.com

#DigitalForensics #DigitalForensics #DFIR

· 8mo ago

I'm poor now. 😆

Infosec Exchange

#DigitalForensics #MobileForensics

· 6mo ago

Satisfaction in a job well done.

Infosec Exchange

#DigitalForensics #MobileForensics #LLM #AI

· 6mo ago

Right up till machines ask questions to each other.

We have to be more than question askers. Do more than outsourcing our thinking to a pattern matching device.

Infosec Exchange

· 7mo ago

In a world where #DigitalForensics is moving to a black box tooling model, having the ability to openly check the code and add functionality is priceless.

How can you support open source projects?
🧭 Provide code with test data. Anyone can ask an LLM to produce code but providing testing data is divine.
🧭 Help with documentation.
🧭 Donate money to useful projects.
🧭 Share success stories and use cases.
🧭 Help verify data and validate processes. Communicate any issues to developers in a constructive way.
🧭 Give credit. Maintaining a project is not easy. Recognize those that are helping in transparent and dutiful ways.

What other ways to assist did I miss?

Infosec Exchange

#DigitalForensics #MobileForensics #DFIR

· 9mo ago

Some stats from our Digital Forensics Now Podcast audio version for 2025.
Thank you so much for geeking out without this past year. Let's keep it going on 2026!
https://digitalforensicsnow.buzzsprout.com/

digitalforensicsnow.buzzsprout.com

· 6mo ago

If you use #LLM technologies on #DigitalForensics cases you could be creating case law. Proceed with caution.

Infosec Exchange

#DigitalForensic #MobileForensics #AI #LLMs

· 6mo ago

How true or false is yet to be seen. And we will know the answer soon enough...

Infosec Exchange

· 6mo ago

Are LLMs a technology I currently support for #DigitalForensics? No.

Do LLMs have issues with hallucinations and pattern matching errors? Yes.

Can LLMs provide value? Yes.

Will LLMs become unavoidable due to tool availability and market requests? Absolutely.

What does this mean to us? We have to become experts with deep skills. If the machine lies to you and you don't know how to find out, what do you think will happen?

We need to become experts over expert systems. Be ready for everything.

Infosec Exchange

· 6mo ago

⚖️ Last day of the The Organización de los Estados Americanos #REMJA Cybercrime Training Workshop. 65 prosecutors from 26 countries, 4 languages, and one purpose. Amazing event.

#LLMs #AI #DigitalForensics #MobileForensics

· 6mo ago

*Chuckles* I'm in danger.

Infosec Exchange

#DigitalForensics #MobileForensics #DFIR #AI

· 6mo ago

Latest Digital Forensics Now Podcast episode straight from the MSAB Digital Summit 2026 is available to watch on YouTube or listened to from any of your favorite podcasting directories.

Check it out:
YouTube
https://youtu.be/0otgZswj0M4

Digital Forensics Now Podcast S3 - 3

· 6mo ago

Apropos to my latest LinkedIn posts on LLM tooling in #DigitalForensics.

Post 1 : https://tinyurl.com/yenesis1
Post 2: https://tinyurl.com/yenesis11

Infosec Exchange

#PericiaDigitalForense #DigitalForensics #MobileForensics #DFIR

· 7mo ago

Lo mismo dijo acerca del sueldo también. 😂

Infosec Exchange

· 8mo ago

Uppercase and uppercase +

#Fonts #Lettering #Signs

Infosec Exchange

· 2mo ago

Been a busy stretch on the LEAPPs blog. If you missed them, here are the latest posts, and yes, a lot of them are about AI in our field. As one does nowadays. 🪔 Be Careful What You Wish For Where AI in digital forensics goes wrong, and the one thing the genie can never grant you. https://leapps.org/blog-post?post=2026-07-12-be-careful-what-you-wish-for 🖼️ Spotting AI Generated Images in iLEAPP and ALEAPP Both tools now flag AI generated images by reading content provenance: C2PA Content Credentials and the IPTC Digital Source Type. https://leapps.org/blog-post?post=2026-07-12-ai-image-provenance 🧬 The Rules Keep Changing The first fully LLM-generated set of artifacts lands in iLEAPP. Fourteen Biome parsers, 3,668 rows of previously unparsed data, clean on the first pass. https://leapps.org/blog-post?post=2026-07-11-the-rules-keep-changing 📊 The Apps We Are Not Parsing (Yet) Batch LEAPP now shows which installed apps the LEAPPs actually parse, and which ones we are missing. https://leapps.org/blog-post?post=2026-07-08-app-coverage-analysis

Be Careful What You Wish For — LEAPPs Blog

The genie can grant almost anything. It cannot grant you judgment. And judgment is the one thing you need in order to control it.

· 2mo ago

New iLEAPP artifact: Biome - Device TimeZone, contributed by Cynthia van Dorp. Starting around iOS 17, the Device.TimeZone biome stream keeps a record of every timezone the device switches into, each entry with a SEGB timestamp. That means a built-in travel timeline: on one of our test images the output showed the device going New York, then Chicago, then Honolulu, then back, all with exact times. Tested against 8 iOS 17 and 18 images from our corpus before merging. Free and open source, as always. #DFIR #iosforensics #mobileforensics

digitalforensicsnowespanol.buzzsprout.com

· 2mo ago

Digital Forensics Now ahora habla español. 🎙️ Same show, same voices, ahora en tu idioma. AI voice cloning, open source models, running locally, and every translation verified. Stochastic tools, deterministic output, human verification. That's the recipe. https://digitalforensicsnowespanol.buzzsprout.com

· 2mo ago

📱 New: Telegram support across both LEAPPs, plus a reference nobody had published. Fifteen artifacts. Six for iOS in iLEAPP, nine for Android in ALEAPP, which had no Telegram support at all before this. Thanks Geraldine Blay for the questions that spurred all this research and development. ⚙️ The settings. Auto download stored per network type and per chat category, plus Save to Photos and Save to Gallery. These are what answer whether a photo ever reached the device gallery, which the message record cannot tell you. ⚠️ The warning that matters most: Telegram writes no settings record until the user changes something. No key in the database does not mean "off," it means the app default applied. A tool that prints "off" there is inventing evidence. Ours distinguishes the two states explicitly. 📖 The system events reference. The two clients name the same events differently, and only 27 of roughly 70 pair by name. So: 64 iOS types, 68 Android types, 62 paired, every row linking to the defining line in Telegram's own source, pinned to a commit. Printable PDF included. Also documented: our own gaps. Five capabilities we could not validate against real data, listed in the post, with a request for research images. Blogpost: leapps.org/blog-post?post=2026-08-04-telegram-ios-android-coverage Telegram Events Reference Documentation: leapps.org/blog-post?post=2026-08-04-telegram-system-events-reference #DFIR #DigitalForensics #MobileForensics #LEAPPs #ILEAPP #ALEAPP

· 3w ago

iLEAPP, ALEAPP, RLEAPP, VLEAPP and DLEAPP v2026.4.0 are out! 💽 Raw disk images and E01s read directly 🖥️ GUI stays responsive while processing 📱 iLEAPP: Garmin Connect, Tutanota, MEGA 🤖 ALEAPP: Blink, Avast Cleanup, Kwai, YouCam Perfect 📑 RLEAPP: Synchronoss DV access log workbooks, quarantined CyberTip media 🚗 VLEAPP: E01, HFS+ and APFS volumes 🍎 DLEAPP: macOS iMessage, Safari, Keychain, Slack Desktop https://leapps.org/releases #DFIR #DigitalForensics #FOSS #MobileForensics