ALEAPP CLI: পুরোনো সংস্করণ ডাউনলোড করুন

ALEAPP v2026.4.1
- New parser: Nova AI Chatbot (com.scaleup.chatai) forensic modules.
- Forensic input and performance improvements: NTFS and APFS images now read in one pass with qnxprobe 1.30, the LAVA database now commits once per artifact instead of once per staged file, and a new ArtifactResult streaming path added for handling large artifacts more efficiently.
- Legacy code cleanup: media_to_html fully removed (with check_report_local_paths updated to follow paths through it first), and reporting logic simplified around conversation views preserving data values exactly as artifacts wrote them.
- Reporting and reliability fixes: duplicate zip/tar member names now staged as a single file, oversized HTML report tables held back with a summarized view, database errors in validate_sample_data now reported using SQLite's own wording, and evidence-relative source paths recorded for directory and single-file inputs.
New Contributors
- @guilhermegui08 made their first contribution in #696
Full Changelog: v2026.4.0...v2026.4.1

ALEAPP v2026.4.0
- Forensic input expansion: raw disk images and E01 acquisitions now readable directly via a new -t raw flag, with qnxprobe re-vendored to add F2FS filesystem support and fix a NAT copy-selection bug.
- GUI responsiveness fix: artifact crunching now runs on a worker thread so the interface no longer freezes during processing, with a follow-up fix resetting stdout and guarding the close button.
- New app coverage: full Blink camera/doorbell support (app data, network information, remaining populated tables), plus Avast Cleanup, Kwai, YouCam Perfect, and expanded MEGA cloud storage (node cache and media caches) for Android.
- Multi-file and multi-user reporting fixes: artifacts now list every source file read instead of just the last one (gass.db, TikTok IM stores), every distinct external.db read in emulatedSmeta, Samsung media provider rows tagged with their originating database, and GalleryVault account profiles correctly paired per container.
New Contributors
- @frahmco made their first contribution in #1196
Full Changelog: v2026.3.3...v2026.4.0

ALEAPP v2026.3.3
- New app coverage: 70+ new parsers added, spanning secure messaging (WeChat, Element X, Silent Phone, Tutanota, Dust), password/security managers (Bitwarden, KeePassDX, Aegis, Magisk), productivity/note apps (Joplin, Tasks.org, Orgzly Revived, ColorNote), media/streaming (NewPipe, AntennaPod, Snapseed, Musicolet, InShot, VivaVideo), navigation/fitness (Organic Maps, OsmAnd, OpenTracks, Trail Sense, Sleep as Android), and dozens more (GETTR, Xiaohongshu, Houseparty, CCleaner, Aurora Store, Wikipedia, Kiwix, and others).
- Deep Android system artifact expansion: dex usage stores, App Ops (recent accesses, standby buckets, permission modes), permission subsystem access.abx, Android users/ADB authorizations/telecom accounts, install sessions and per-app SSAID, dropbox/tombstone/ANR crash records, and Nearby Fast Pair discovery.
- MMKV parsing overhaul: a dedicated mmkv_parser vendored and iterated through several revisions (decryption support, correct varint header handling, fixing a false-positive encryption flag), plus a new MMKV - Recovered Records artifact and Xiaohongshu account/chat data read directly from MMKV.
- WeChat brought to full readability: message content decoded and made human-readable, with media correctly attached to the messages it belongs to.
Full Changelog: v2026.3.2...v2026.3.3

#ALEAPP v2026.3.2
- New apps: over 35 new parsers added, including Uber, Facebook, Threads, Twitch, Zoom, PayPal, Revolut, Outlook, Yahoo Mail, Adobe Acrobat Reader, Disney+, Amazon Prime Video, Pinterest, Hinge, NordVPN, Roblox, eBay, Etsy, Vinted, Booking.com, Ryanair, DHL, CapCut, Shazam, Truecaller, SimpleX Chat, TeleGuard (calls, account, drafts, downloads), Threema, Opera Browser, Samsung Bixby Routines, Spotify (6 artifacts), and Private Photo Vault.
- Timestamp accuracy fixes: corrected Unix timestamp conversion for pre-1970/pre-2001 values, deprecated utcfromtimestamp replaced project-wide, and two timezone-dependent timestamps fixed to no longer depend on the host system's clock.
- Container and account scoping: eBay/Disney+ cache indexes now keyed by container to prevent cross-app bleed, Gmail parsing now reads every account store across users instead of just the first, and Facebook msys duplicate rows merged.
- Source-path and reporting accuracy: real device/source paths reported instead of examiner folder paths, extraction-relative paths enforced library-wide, a report checker crash on large TSV cells fixed, and Gmail bodies now shown as readable text with a dedicated Links column.
New Contributors
- @forest-savage1234 made their first contribution in #1199
Full Changelog: v2026.3.1...v2026.3.2

ALEAPP v2026.3.1
- Broad new app coverage: Instagram, Tinder, Netflix, Reddit, Amazon Shopping, plus a new Proton Mail db-mail (MailX) Room store parser.
- Snapchat and TikTok expansion: chat media, core.db and session artifacts for Snapchat, new TikTok Account/activity artifacts with multi-account database handling for IM data (plus deduplication of duplicate extraction paths).
- WhatsApp add-on artifacts (reactions, edits, revokes, polls, receipts, system events), Wire data recovery surviving encrypted app generations, LINE messages/calls now reported even with empty contact tables, and GroupMe deletion state, FCM queued messages, and a scoped group-creator lookup.
- Chrome additions: saved credit cards and payments customer data artifacts, aligned with the same fixes shipped in iLEAPP.
- Multiple crash fixes for unopenable databases (siminfo, Samsung My Files, usageapps, airGuard now logging errors instead of silently reporting no data), a Windows long-path SQLite fix, tolerance for older Snapchat arroyo schemas, and artifact reference permalinks pinned to specific commits.
Full Changelog: v2026.3.0...v2026.3.1

ALEAPP v2026.3.0
- New encrypted messenger support: Signal for Android with full SQLCipher decryption, attachment/thumbnail decryption and message-linking, plus Telegram for Android (accounts, chats, peers, group/channel members, VoIP call logs, service message actions) and Session messenger account parsing.
- Broad new app coverage: MeWe (posts, comments, media, polls, reactions, groups), Kik, BeReal, GalleryVault (hidden-file recovery), JusTalk and JusTalk Kids, Weibo, Xiaohongshu (RED), Slack, AllTrails, BRD (BreadWallet), Dropbox, what3words, DJI drone flight tracks, Claude, and Smart Sidebar File Dock (OxygenOS/ColorOS).
- Deep system artifact expansion: Google Play services databases (constellation, account history, icing, ODLH), Samsung system databases (Privacy Dashboard, WiFi, Sleep Detection, CMH tagging, media provider), modernized UsageStats/Recent Tasks, and Google Dialer/Calendar artifacts.
- Forensic integrity fixes: databases now opened read-only to stop artifacts writing to evidence files, ProtonVPN hostname resolution no longer touches the network at parse time, and Snapchat's arroyo.db parsing recovers WAL-only rows with row-provenance columns.
- Security and stability hardening: HTML report injection fixes (escaped evidence names, removed remote destinations, CDN locale fetch removed, new CI guard), WAL visibility restored for SQLite artifacts, concurrent-run history.json corruption fixed, and expanded CI (full Python version matrix, sample_data validation, manual PyInstaller test builds).
New Contributors
- @Rugikex made their first contribution in #720
- @bcbtree made their first contribution in #1038
- @AlexC-DF made their first contribution in #1052
- @Gear-I made their first contribution in #962
- @Newhope81 made their first contribution in #1078
- @mpolastro made their first contribution in #656
- @akhil-dara made their first contribution in #958
Full Changelog: v2026.2.0...v2026.3.0

ALEAPP v2026.2.0
- New artifact: C2PA Content Provenance (AI provenance), with signer certificate/signing time parsing added in phase 2, case-insensitive media path matching, and a Media State column grouping manifest rows per media file.
- Complete context-form migration across the entire codebase: six sequential batches converting Garmin family (24 files), FCM family (8 files), browsers (17 files), and bulk artifacts A-Z (over 200 files), standardizing the parser architecture project-wide.
- New Mister Skinnylegs artifact parser, alongside a Samsung Honeyboard clipboard rework (WAL recovery, SEFT support, dual-schema handling) and Samsung CMH now parsed from the files table.
- Dependency and security hardening: Pillow bumped to 12.3.0 (July 2026 security fixes), protobuf upgraded to 5.29.6 (resolving 3 high-severity Dependabot alerts), an HTML report fix escaping evidence in report cells, and a fix for missing Tabler-icons resources in compiled binaries.
- Large sample_data refresh from an updated 8-image Android test corpus plus 2 new Android 13 test images, with crash fixes surfaced during coverage testing and a memory leak fix for large dataset processing.
What's Changed
- Update version number and specs files by @Johann-PLW in #944
- Fix artifact crashes surfaced by the 8-image Android coverage run by @abrignoni in #945
- Parse Samsung CMH from the files table; document modern Garmin storage by @abrignoni in #946
- Update sample_data from the refreshed 8-image Android corpus by @abrignoni in #947
- Fix googlemapaudioTemp crash on archives with file/directory name collisions by @abrignoni in #948
- Populate sample_data from 2 new Android 13 test images by @abrignoni in #949
- Add C2PA Content Provenance (AI provenance) artifact by @abrignoni in #950
- C2PA phase 2: parse signer certificate and signing time by @abrignoni in #951
- C2PA: case-insensitive media paths (catch uppercase iOS extensions) by @abrignoni in #952
- C2PA: add Media State column (group manifest rows per media file) by @abrignoni in #953
- fix: check for empty data and source files before msg by @JamesHabben in #954
- Samsung Honeyboard clipboard: WAL recovery + SEFT + dual-schema (rework of #955) by @abrignoni in #956
- Minor improvements and bug fixes by @djangofaiola in #959
- Security: escape evidence in html_columns report cells by @abrignoni in #961
- ALEAPP context-form migration — batch 1: Garmin family (24 files) by @abrignoni in #963
- ALEAPP context-form migration — batch 2: FCM family (8 files) by @abrignoni in #964
- ALEAPP context-form migration — batch 3: browsers (17 files) by @abrignoni in #965
- ALEAPP context-form migration — batch 4: bulk A–M (110 files) by @abrignoni in #966
- ALEAPP context-form migration — batch 5: bulk N–Z (104 files) by @abrignoni in #967
- ALEAPP context-form migration — batch 6 (final): specials + tail (15 files) by @abrignoni in #968
- Update report.py - Fix missing Tabler-icons ressources from binaries by @Johann-PLW in #970
- chore: update module_info to level with ileapp by @JamesHabben in #971
- airtagAndroid: fitting icons for the four Airtag Detection artifacts by @abrignoni in #972
- Update version number to 2026.2.0 by @Johann-PLW in #973
- Add Mister Skinnylegs by @AlexC-CCL in #969
- Fix runtime-contract CI: reconcile NQ Vault path-security test with LAVA pipeline by @abrignoni in #976
- chore: bump Pillow 12.1.1 -> 12.3.0 for July 2026 security fixes by @abrignoni in #974
- chore: bump protobuf 3.10.0 -> 5.29.6, resolve 3 high Dependabot alerts by @abrignoni in #975
- ci: guard against PyPI-style blackboxprotobuf imports by @abrignoni in #978
- Memory Leak in Large Dataset Processing by @Johann-PLW in #979
New Contributors
- @AlexC-CCL made their first contribution in #969
Full Changelog: v2026.1.0...v2026.2.0

ALEAPP v2026.1.0
- Massive LAVA migration: 150+ artifacts converted to the @artifact_processor decorator (Firefox, BitTorrent, Chrome/Chromium family, the full Garmin suite, Fitbit, WhatsApp, Facebook Messenger, Snapchat, Skype, Viber, Teams, ChatGPT, Life360, TikTok, offline GPS trackers, and many more), with UTC timestamp normalization and extraction-relative source paths.
- New parsers: HONOR Media Library/Gallery, Samsung Secure Folder HistoryLog, Rema 1000/Scan Selv (Denmark), and a developer-only App Inventory module for parsing-coverage analysis.
- Full refactor of the Waze, MeWe, and Life360 parsers, plus threaded conversation views added to a dozen SMS/chat artifacts (Burner, Google Messages, TikTok, Google Chat, Discord, LinkedIn).
- Visual identity overhaul: adoption of Tabler icons (as webfonts) for HTML reports, migrating legacy icon names to native Tabler names.
- Numerous stability fixes: hardened XML parsing against invalid tokens (4 batches), resolved LAVA duplicate-name collisions, fixed Windows MAX_PATH crashes on long report paths, migrated legacy media artifacts to check_in_media, and added a Windows CI smoke test to validate all module imports.
What's Changed
- Fix in artifact androidauto by @FrancoMorales1 in #707
- Update androidauto.py by @stark4n6 in #708
- update version to 3.7.0-dev.0 by @JamesHabben in #713
- update context class to have data extraction path functions by @JamesHabben in #710
- Add SQLite URI path regression tests by @JamesHabben in #715
- Fixed a bug where # is treated as a URI delimiter. Issue #711 by @JamieSharpe in #712
- feat: Added script to analyse Rema 1000 | Scan Selv from Denmark. by @NicolaiMartini in #714
- Add LAVA launch actions in final GUI by @JamesHabben in #718
- chore: parameterize LAVA media SQL by @JamesHabben in #719
- Convert artifact scripts to artifacts_v2 header format by @abrignoni in #721
- Convert Firefox artifacts to LAVA (@artifact_processor) by @abrignoni in #722
- Convert BitTorrent artifacts to LAVA (@artifact_processor) by @abrignoni in #723
- Convert vault/locker and Cash App artifacts to LAVA (@artifact_processor) by @abrignoni in #724
- Fix pre-existing crashes in three artifacts by @abrignoni in #725
- Convert chat artifacts to LAVA (@artifact_processor) by @abrignoni in #726
- Convert ProtonVPN/ProtonMail to LAVA (multi-report split) by @abrignoni in #727
- Convert TextNow/Skout to LAVA (multi-report split) by @abrignoni in #728
- Convert chromeBookmarks to LAVA with per-browser tables (iLEAPP pattern) by @abrignoni in #729
- Convert chromeOfflinePages/chromeTopSites to LAVA (per-browser tables) by @abrignoni in #730
- Convert chromeCookies/chromeNetworkActionPredictor to LAVA (per-browser tables) by @abrignoni in #731
- Convert chromeLoginData to LAVA (per-browser tables) by @abrignoni in #732
- Convert chromeMediaHistory to LAVA (multi-report x per-browser) by @abrignoni in #733
- Convert HideX, samsungSmartThings, mega, smyfilesStored, PodcastAddict to LAVA by @abrignoni in #734
- Convert keepNotes, rarlabPreferences, googleTasks to LAVA by @abrignoni in #735
- Fix LAVA timestamps for Firefox artifacts (tz-aware UTC) by @abrignoni in #737
- Convert imo and samsungWeatherClock to LAVA (multi-report split) by @abrignoni in #736
- Replace deprecated datetime.utcfromtimestamp in converted artifacts by @abrignoni in #738
- Fix LAVA timestamps for the Chrome family (tz-aware UTC) by @abrignoni in #739
- Fix LAVA timestamps across remaining converted artifacts (tz-aware UTC) by @abrignoni in #740
- Convert DocList, wellbeingaccount, appopSetupWiz to LAVA by @abrignoni in #741
- Convert Skype to LAVA (multi-report split) by @abrignoni in #742
- Convert googleNowPlaying to LAVA by @abrignoni in #743
- Convert 5 Samsung/system text-parser artifacts to LAVA @artifact_processor by @abrignoni in #744
- Convert Chess.com + Chess With Friends artifacts to LAVA @artifact_processor by @abrignoni in #745
- Convert build, packageInfo, roles, runtimePerms to L

ALEAPP v3.6.0
- New module: Deepseek_ChatMessages
- Modules updates for LAVA support: LinkedIn Withings HealthMate
- Check_in_media functions and data_views aligned with iLEAPP
- Add SVG image type matcher
- LAVA: processed files output in LAVA db and run information in LAVA JSON file.
What's Changed
- Update version number by @Johann-PLW in #695
- Update Update filetype package by @Johann-PLW in #697
- Parser modifications for LAVA support (LinkedIn, Withings HealthMate) by @kalink0 in #690
- Added forensic modules for DeepSeek by @RicardoBeny in #698
- Update Deepseek_ChatMessages.py by @abrignoni in #699
- Update requirements.txt by @abrignoni in #700
- Update Deepseek_ChatMessages.py by @abrignoni in #701
- Eliminated markdown by @abrignoni in #702
- Update check_in_media functions and data_views by @Johann-PLW in #703
- Data views update in artifacts by @abrignoni in #704
- Update Regex Paths by @stark4n6 in #705
- Update version number by @Johann-PLW in #706
New Contributors
- @RicardoBeny made their first contribution in #698
Full Changelog: v3.5.0...v3.6.0

ALEAPP v3.5.0
- Modules updated: bluetoothConnections, appSemloc.py
- Added JPEG XL and DDS image type matcher
- Fix issue related to file timestamps preservation
What's Changed
- Update bluetoothConnections.py by @abrignoni in #688
- Fix issue #689 related to file timestamps preservation by @Johann-PLW in #691
- Update appSemloc.py by @abrignoni in #692
- Update appSemloc.py by @abrignoni in #693
- Update filetype package by @Johann-PLW in #694
Full Changelog: v3.4.1...v3.5.0

ALEAPP v3.4.1
- New features:
- Add Agency logo in Case data
- ALEX Live Data
- Improve media file lookup speed (~20x faster)
- Modules updated for LAVA output
- New modules: LinkedIn, DuckDuckGo Browser, knuddels chat messenger, chatgpt2, kik fcm notifications, Zepp Life heart rate extractor, Android Auto extractor, Speedtest, IMAP Email Extractor, callTranscription, Messages of the FairEMail App, ZangiChat, Thunderbird Mail, Google Voice, Citymapper, SwissMeteo, App Ops, Pixel Watch (Wear OS) support to fitbit, shistorylog, RandoChat, Samsung Notes, SDHMS, Samsung Trash Provider App, Romeo Dating App, SBB Mobile, batterystats-daily
- Modules updated: Gmail, Chrome & SimpleStorage, gmailIMAPEmails, Samsung Digital Wellbeing, chromeDIPS, WhatsApp, Chrome Downloads History, googleCalendar
- Security fixes
What's Changed
- Update version number and specs files to build binaries by @Johann-PLW in #555
- Add Agency logo in Case data by @Johann-PLW in #556
- Added parser for LinkedIn (Account and Messages) by @kalink0 in #554
- Update aleappGUI.py by @stark4n6 in #561
- Add missing hiddenimports to compile windows binaries by @Johann-PLW in #563
- Fix missing hiddenimports to compile Windows binaries by @Johann-PLW in #564
- Fix improper formatting in Windows .spec files by @Johann-PLW in #565
- Remove GUI part in aleapp.spec file by @Johann-PLW in #566
- Add DuckDuckGo Browser Parsers by @SpyderForensics in #567
- Update media manager by @Johann-PLW in #568
- DuckDuckGo Updates by @stark4n6 in #569
- new parser for knuddels chat messenger by @As-arsenicum-33 in #557
- Knuddels Updates by @stark4n6 in #571
- Create chatgpt2.py by @abrignoni in #574
- Brigs working by @abrignoni in #575
- Update chatgpt2.py by @abrignoni in #576
- Update chatgpt2.py by @abrignoni in #577
- Update chatgpt2.py by @abrignoni in #578
- Update chatgpt2.py by @Jeremy440 in #579
- kik fcm notifications by @snoop168 in #586
- don't raise error. keep parsing by @snoop168 in #585
- Implement Zepp Life heart rate extractor by @its5Q in #584
- Implement Android Auto extractor by @its5Q in #583
- Gmail Updates by @stark4n6 in #587
- Power Events LAVA Updates by @stark4n6 in #588
- More LAVA Updates & Fixes by @stark4n6 in #589
- Added Speedtest artifact extractor by @its5Q in #582
- IMAP Email Extractor - com.google.android.gm by @ogmini in #590
- Update chatgpt2.py by @Jeremy440 in #581
- Update chatgpt2.py by @stark4n6 in #592
- More LAVA compliant parsers by @stark4n6 in #593
- More LAVA updates by @stark4n6 in #594
- admin docs update by @JamesHabben in #595
- Fixed bug #596 by @JamieSharpe in #597
- Create callTranscription.py by @abrignoni in #598
- Update Chrome & SimpleStorage by @stark4n6 in #599
- Update README.md by @derekeiri in #601
- Rename and Update Device Health Services by @stark4n6 in #602
- Display device information data generated by ALEX by @prosch88 in #604
- Small fix for googleCalendar.py by @prosch88 in #605
- Update gmailIMAPEmails.py - Attachments/Accounts by @ogmini in #603
- Fix: Improve Chrome Downloads History Compatibility (Pre-v65) by @dollyaswin in #609
- Added Support for Messages of the FairEMail App by @kalink0 in #611
- Added ZangiChat Parser by @prosch88 in #613
- Fix AttributeError in Turbo_Battery when processing TAR based extractions by @hipzi in #617
- Fix utcfromtimestamp() TypeError in offlinePages artifact by @hipzi in #614
- Fix SQL syntax error in bashHistory artifact caused by reserved keyword order by @hipzi in #616
- Fix: Handle missing magic bytes in Chrome Browser Cache by @dollyaswin in #621
- Fix UnicodeDecodeError in persistentProp artifact by @hipzi in #615
- Spyder forensics patch 1 by @SpyderForensics in #607
- Fix(googlePhotos): Add backward compatibility for older Android 6 schemas by @dollyaswin in #612
- Parser Thunderbird Mail by @kalink0 in #627
- Add Google Voice Parsers (User Accounts, Calls, Voicemails, and Messages) by @campwill in #606
- Add Citymapper parser by @Funeoz in #644
- Add Parsing 

ALEAPP v3.4.0
- LAVA output added
- New modules: OneDrive Metadata, FairMail App,
- Modules updated: shutdown_checkpoints, WhatsApp
- Modules updated for LAVA output: accounts_ce, accounts_de, adb_hosts, airtagAndroid, appicons, usagestatsVersion
What's Changed
- Add new Query for Group Details by @BrunoFischerGermany in #542
- Update to LAVA output by @Johann-PLW in #543
- Update appicons.py for lava output - Update media-manager by @Johann-PLW in #545
- Lava by @Johann-PLW in #546
- Update ilapfuncs.py - media-manager by @Johann-PLW in #547
- Update shutdown_checkpoints.py by @stark4n6 in #549
- Added FairMail App Parser - Contacts and Accounts by @kalink0 in #550
- OneDrive Metadata Artifact by @dabeersboys in #551
- Lava by @Johann-PLW in #552
- Adding support for LAVA output by @Johann-PLW in #553
Full Changelog: v3.3.0...v3.4.0

ALEAPP v3.3.0
- New Graphical User Interface with module filtering
- New template for HTML report
- New modules:
- Bluesky
- Google Keep Notes
- MeetMe Chats
- Module updated:
- airGuard
What's Changed
- Bluesky artifacts by @abrignoni in #527
- Removed Bluesky test directory grep by @abrignoni in #528
- Bluesky support for emojis by @abrignoni in #529
- Google Keep Notes by @charpy4n6 in #532
- Google Keep Notes Updated by @charpy4n6 in #534
- New Artifact- MeetMe Chats by @dabeersboys in #536
- Adding new icon and logo to GUI by @Johann-PLW in #537
- Update README.md by @stark4n6 in #538
- Update airGuard.py by @stark4n6 in #540
- Update HTML report with new icon and banner by @Johann-PLW in #539
- Updates to compile binaries on Windows and Linux by @Johann-PLW in #541
Full Changelog: v3.2.5...v3.3.0