iLEAPP, ALEAPP and RLEAPP
Alexis Brignoni · 2026
Access and status
Cost
Free
Free to read or download at source. No account, no purchase.
Status
Current
Current as at the verification date below. Standards and tools both move — confirm at source before you rely on it.
What it is
A family of open-source Python parsers for mobile and returns data: iLEAPP for iOS logs, events and plists, ALEAPP for Android, and RLEAPP for returns and records from cloud and carrier providers. All three are released very frequently and are among the most actively maintained tools in mobile forensics.
Who it is for, and when
These are the free route from a mobile extraction or a warrant return to a readable HTML and CSV report covering app usage, location history, connectivity, notifications, and hundreds of app-specific artefacts. They are widely used as an independent check on a commercial mobile suite: two differently written parsers reaching the same conclusion about an artefact is a materially stronger position than one vendor's output. The parser modules are short and readable, so an examiner can verify exactly which database and column a finding came from — or add a module for an app nobody has covered.
What it does not cover
They parse extractions; they do not acquire them. Getting a file system or full extraction off a modern locked iPhone or Android device still requires a commercial tool, a service, or lawful process, and none of the LEAPP tools assist with that. They also do not decrypt, do not bypass passcodes, and do not manage a case — and because modules are community-contributed, coverage and quality vary between artefacts.
Go to the source
Open at github.com (opens in a new tab)https://github.com/abrignoni/iLEAPP
Details
- Type
- Tool
- Written for
- Working examinerAdvancedWorking examiner, Advanced
- Author
- Alexis Brignoni
- Year
- 2026
- Topics
- mobile, ios, android, cloud, reporting, open-source, sqlite
- Checked at source
Related entries
A device-by-device walkthrough of mobile acquisition and analysis: iOS and Android internals and file systems, logical and physical extraction, app and SQLite artifacts, cloud extraction, mobile malware and reporting.
Cellebrite's mobile forensics flagship, now branded Inseyets and positioned within the company's broader Case-to-Closure platform. The familiar component names persist inside it rather than having been retired: UFED, Physical Analyzer, Kiosk, CFID, Reader, and C-TEK are all listed as parts of the Inseyets suite.
MSAB XRY
PaidA commercial mobile forensics family from the Swedish vendor MSAB, sold as separate modules rather than one product: XRY Logical for live and file system extraction, XRY Physical for bypassing the operating system, XRY Pro combining advanced extraction and decryption, plus XRY Cloud, XRY Photon for screen-scraping app data, and XRY Camera for device documentation.
Alexis Brignoni's blog on mobile forensics and open-source tooling, closely tied to the xLEAPP family of parsers — iLEAPP, ALEAPP, RLEAPP and VLEAPP — which he maintains with others.
An open-access reference to the structures underneath mobile evidence, in two parts: mobile file systems (APFS, Ext4, F2FS, QNX6) and the serialisation formats that carry app data (SQLite, property lists, Java serialization, Realm, protocol buffers), each chapter written by a specialist and each noting the forensic value of the structure.