iLEAPP parses iOS and iPadOS forensic extractions and produces HTML, TSV, timeline, KML, and LAVA output. It supports iOS/iPadOS 11 through current versions.
Browse the full searchable artifact list at leapps.org/artifacts (filter by LEAPP tool).
Download a pre-built release — no Python installation required.
- LEAPPs Releases — browse all LEAPP family tools
- iLEAPP GitHub Releases — direct downloads
| Platform | GUI | CLI |
|---|---|---|
| Windows | ileappGUI-*-Windows_x64.zip |
ileapp-*-Windows_x64.zip |
| macOS (Apple Silicon) | ileappGUI-*-macOS_Apple_Silicon.dmg |
ileapp-*-macOS_Apple_Silicon.zip |
| macOS (Intel) | ileappGUI-*-macOS_Mac_Intel.dmg |
ileapp-*-macOS_Mac_Intel.zip |
| Linux | ileappGUI-*-Linux_x86_64.AppImage |
ileapp-*-Linux_x86_64.AppImage |
GUI — extract the download, run ileappGUI, then select your input type, source path, output folder, and modules to process.
CLI — extract the download and run from a terminal. The output folder must already exist.
ileapp.exe -t zip -i C:\path\to\extraction.zip -o C:\path\to\output\
On macOS and Linux, use the ileapp binary from the extracted archive instead of ileapp.exe.
| Type | Description |
|---|---|
fs |
Folder of extracted files with normal paths and names |
zip |
ZIP archive containing files with normal names |
tar |
TAR archive |
gz |
GZIP-compressed archive |
itunes |
iTunes/Finder backup folder with hashed paths and names |
file |
Single file input |
Encrypted iTunes/Finder backups (-t itunes) are supported. The GUI will prompt for a password before processing when encryption is detected. On the CLI, pass the password with --itunes_password (see Optional parsing options below).
These options apply only to the CLI build (ileapp / ileapp.exe / python ileapp.py). The GUI (ileappGUI) exposes the same settings through its interface instead of command-line flags.
Run ileapp --help (or python ileapp.py --help from source) for the built-in reference.
These three arguments are required for a normal parse run:
| Argument | Long form | Description |
|---|---|---|
-t |
Input type: fs, tar, zip, gz, itunes, or file |
|
-i |
--input_path |
Path to the input file or folder |
-o |
--output_path |
Path to the output folder (must already exist) |
Example:
ileapp -t zip -i /path/to/extraction.zip -o /path/to/output/
| Argument | Long form | Description |
|---|---|---|
-w |
--wrap_text |
Pass this flag to disable text wrapping in output files |
-m |
--load_profile |
Path to an iLEAPP profile file (.ilprofile) to limit which modules run |
-d |
--load_case_data |
Path to a LEAPP case data file (.lcasedata) |
--custom_output_folder |
Custom name for the report output subfolder | |
--custom_artifacts_path |
Extra folder to load artifact modules from (e.g. scripts/alternate_artifacts) |
|
--itunes_password |
These modes do not parse a case. Use them alone — without -t, -i, or -o:
| Argument | Long form | Description |
|---|---|---|
-p |
--artifact_paths |
Write all artifact search paths to path_list.txt in the current directory |
-c |
--create_profile_casedata |
Interactive wizard to create a .ilprofile or .lcasedata file in the given folder |
Examples:
ileapp -p
ileapp -c /path/to/output/folder/
Artifact modules live in scripts/artifacts/ and are loaded dynamically at runtime.
New modules: start with the step-by-step guide at How to Write an iLEAPP Module.
Additional references:
- Artifact Info Block Structure
- Updating Modules for Automatic Output Generation
- Updating Complex Modules to Include LAVA Output
- Testing Modules
A PR that adds or changes an artifact is easiest to review and merge when it arrives with
two things: a small test fixture cut from a real extraction, and sample_data values that
record what the module produced. Scripts generate both. Here is the whole flow.
One rule before anything else: whatever you commit here becomes public. Only use data you are allowed to share, like a test device you populated yourself, a public research image, or a file you sanitized by hand. Never casework.
1. Cut a fixture from your extraction
python admin/test/scripts/make_test_data.py <module> --case 1 --input <extraction.zip>
This pulls the files your module's paths patterns match out of the extraction and writes
the case file admin/test/cases/testdata.<module>.json plus one small zip per artifact
under admin/test/cases/data/<module>/.
Size rules: under 10 MB per zip, commit it with the PR. Between 10 and 25 MB, commit the case file and attach the zip to a PR comment. Bigger than that, say so in the PR and a maintainer will arrange a handoff.
2. Record the expected output
TZ=UTC python admin/test/scripts/test_module.py <module> -a all -c all
This runs the module against the fixture and writes a snapshot of the output under
admin/test/results/<module>/. Commit the snapshot too. It becomes the baseline that
guards the module after merge. Keep the TZ=UTC part: the committed snapshots are UTC
and CI runs UTC.
3. Run the same comparison CI will run
python admin/test/scripts/run_test_cases.py --module <module>
4. Generate the sample_data values
python admin/scripts/validate_sample_data.py --emit <extraction.zip> --key <image_name>
This runs iLEAPP end to end on your extraction and prints ready-to-paste sample_data
blocks for the modules changed on your branch. Paste them into your module's
__artifacts_v2__ and add the app name and version you saw on the image. If a count is
zero, check the source file really is empty before recording it.
5. Commit it all and open the PR
Commit the module, the case file, the fixture zips, and the recorded snapshot together. More detail lives in admin/docs/testing/create_module_test_cases.md.
If your extraction cannot be shared, open the PR anyway and say so. A fixture can often be cut from a public research image instead, or the real file can be sanitized by hand. The review does not stop while we work that out.
Releases are the easiest way to run iLEAPP. Use source if you are developing modules or need unreleased changes from main.
- Python 3.10 to 3.14
- Git
git clone https://github.com/abrignoni/iLEAPP.git
cd iLEAPP
python3 -m venv venv
source venv/bin/activate # Windows: venv\Scripts\activate
pip install -r requirements.txt
On Linux, install tkinter for the GUI:
sudo apt-get install python3-tk
Windows setup help from Hexordia:
The output folder must exist before running. Source builds report a -dev version (e.g. 2.6.0-dev.0) to distinguish them from official release builds.
CLI:
python ileapp.py -t zip -i /path/to/extraction.zip -o /path/to/output/
GUI:
python ileappGUI.py
See CLI Arguments above, or run python ileapp.py --help.
This traiging tool is the result of a collaborative effort of many people in the DFIR community.
iLEAPP logo courtesy of Derek Eiri.