Open Source
We build on open-source forensics and give back.
Most of what we can read from a phone, we can read because the community wrote a parser and shared it. We use these tools, check our results against them, and contribute what we learn.
Tools we use and recommend
Independent projects with their own maintainers. We list them because we rely on them, and because each dataset names the parser that reads each file. Listing does not mean the projects endorse us, or that we speak for them.
- AndroidExternal project
ALEAPP
Parses artifacts from Android extractions into reports.
Maintained by Alexis Brignoni and contributors
- iOSExternal project
iLEAPP
Parses artifacts from iOS extractions into reports.
Maintained by Alexis Brignoni and contributors
- Android, iOSExternal project
Mobile Verification Toolkit (MVT)
Helps look for indicators of compromise on Android and iOS.
Developed by Amnesty International Security Lab
- iOSExternal project
sysdiagnose
A framework for parsing and analysing iOS sysdiagnose archives.
From the EC-DIGIT-CSIRC project
- AndroidExternal project
Battery Historian
Turns the battery and power data in an Android bug report into an interactive view.
A Google open-source project
- PlatformExternal project
Autopsy
A graphical platform built on The Sleuth Kit for examining disk images.
Maintained by the Sleuth Kit project
- PlatformExternal project
Plaso
Extracts events from many sources into one timeline (log2timeline).
From the log2timeline project
- BothExternal project
DB Browser for SQLite
Opens SQLite databases read-only for inspection.
An open-source community project
Our contributions
Every merged pull request and every one that has a post, with the issue it addresses, the method and the value. Each post links the pull request itself.
ALEAPP (Android)
Android parsers and bug report readers.
- MergedALEAPP #1835
Boot reasons and setup flags, decoded
ALEAPP now decodes the boot reason entries of the Android property store and adds a Setup Flags artifact that gathers the setup settings, their history and the setup properties.
Read the post - MergedALEAPP #1834
Samsung recovery history, read in full
ALEAPP now reads all the Samsung recovery history files, shows the options as printed, and adds a bug report artifact for a log copy kept inside an extraction.
Read the post - MergedALEAPP #1819
Security, storage, logs and crash records from bug reports
A bug report holds device policy, lock settings, storage, the system and kernel logs, crash records and restart reasons. ALEAPP now reads them into 38 tables and shows where each log window begins.
Read the post - MergedALEAPP #1818
Accounts, power, location and media from bug reports
A bug report records accounts, sync, backup, battery, processes, location, sensors, camera, audio and display state. ALEAPP now reads them into 59 tables and says how long each window reaches.
Read the post - MergedALEAPP #1817
Network, radio and telephony state from bug reports
A bug report records Wi-Fi, network policy, Bluetooth, NFC, USB and telephony state in separate dumps. ALEAPP now reads them into 37 tables and shows which sections a build does not print.
Read the post - MergedALEAPP #1816
Permissions, usage, alarms and notifications from bug reports
An Android bug report holds permissions, app ops, usage, alarms, jobs and notifications in separate dumps. ALEAPP now reads them into 15 tables, each checked against the report text.
Read the post - MergedALEAPP #1809
Bug report artifact groups and invented fixture values
Nine bug report artifacts shared one category. This change groups them by question, adds device identifiers as printed in their own table, and replaces fixture numbers that also occur in real reports.
Read the post - MergedALEAPP #1796
Usage, settings and boot history from bug reports
A bug report holds recent app usage, ended processes, settings and boot reasons, but ALEAPP did not read them. This contribution adds five tables with stated time rules.
Read the post - MergedALEAPP #1795
Reading Android bug reports in a single pass
ALEAPP did not read the main text of an Android bug report. This contribution adds a one-pass reader and four tables: device facts, a section index, installed packages and package times.
Read the post - In reviewALEAPP #1787
Reading SIM slot logs and network lookups
Four ALEAPP artifacts for the phone app's SIM slot log, SIM subscriptions and telephony network lookups, each reporting values as stored with the unknowns named.
Read the post - In reviewALEAPP #1786
Reading App Ops history databases in ALEAPP
Two ALEAPP artifacts that read the Android App Ops history databases and the rows that exist only before the write-ahead log is applied, checked row by row on five extractions.
Read the post - In reviewALEAPP #1785
Reading WhatsApp Business stores in ALEAPP
Nine ALEAPP artifacts for the WhatsApp Business package folder, built on the existing WhatsApp code, with a plain statement of what has and has not been checked on real data.
Read the post - MergedALEAPP #1784
Reading the Android Health Connect store
ALEAPP now reads the Android Health Connect store: apps, preferences, permission times, records and access logs, with a plain account of which artifacts were checked on real data.
Read the post - MergedALEAPP #1783
Samsung Smart Switch transfer history
ALEAPP now reads the notes Samsung Smart Switch keeps about phone-to-phone transfers: sessions, data categories, the other device's lists and the backup media index.
Read the post - MergedALEAPP #1782
Reading every Android user's database
Four ALEAPP artifacts now read one database for each Android user and add an Android User column, so a Secure Folder copy no longer hides the primary user.
Read the post - MergedALEAPP #1781
Bluetooth file transfers from btopp.db
ALEAPP now reads the Bluetooth app's transfer table, btopp.db, and this post states how few populated copies we have seen.
Read the post - MergedALEAPP #1780
Blocked numbers and Android Auto rejected cars
ALEAPP now reads the Android block list and the rejected-cars table of Android Auto, and reads every Android user's Android Auto database instead of the first one.
Read the post - MergedALEAPP #1779
Gallery rows kept when the address table is gone
ALEAPP now keeps the Samsung Gallery image rows when the location view cannot be queried, and the notes say what a blank Address means.
Read the post
iLEAPP (iOS)
iOS parsers for file system, unified log and sysdiagnose artifacts.
- MergediLEAPP #2577
Lockdown Mode, passkey, shortcut and VPN log lines
Four small iLEAPP artifacts for iOS unified log lines about Lockdown Mode, passkeys, background shortcuts and VPN state, and what each line does not say.
Read the post - MergediLEAPP #2576
What Messages keeps after edits, unsends and deletes
Eight new iLEAPP tables that read reactions, edit history, unsent parts, inline replies, Recently Deleted entries, link previews and app messages from the Messages database, and how we checked them.
Read the post - MergediLEAPP #2575
Reading sysdiagnose files with five new modules
Ten iLEAPP artifacts for associated domains, managed-configuration events, Network Extension, iCloud Drive state and process task info in a sysdiagnose, with recounts and limits.
Read the post - MergediLEAPP #2574
Three parser fixes for empty and failed reports
Three iLEAPP fixes for an artifact that failed on an out-of-range date, one that returned nothing after a key was renamed, and one that read a database sidecar, and how we checked them.
Read the post - MergediLEAPP #2573
Reading the Screen Time store databases
Eight iLEAPP artifacts for the Screen Time and remote-management stores: settings, blueprints, installed apps, usage, change history and deleted-row entries, and how we checked them.
Read the post - MergediLEAPP #2522
Reading ManagedSettings stores in a sysdiagnose
Two iLEAPP artifacts that read the ManagedSettings stores in a sysdiagnose: one row per stored key and a directory of stores, for two sets of store names, and how we checked them.
Read the post - MergediLEAPP #2521
Per-app runtime from the BatteryUI property lists
How per-app foreground and background runtime in a sysdiagnose's BatteryUI files became three iLEAPP artifacts, how the unit was tested, and why the bucket width is shown as stored.
Read the post - MergediLEAPP #2518
Permission cache and location state dumps
How iLEAPP now reads the permission cache and location manager statedumps in the unified log, and why a dump is a snapshot and not an event.
Read the post - MergediLEAPP #2517
Camera and microphone sessions in the unified log
How iLEAPP now lists camera and microphone capture sessions from the unified log, and why a session line is a lead and not proof of recording.
Read the post - MergediLEAPP #2509
Reading app containers from the container manager state
How a JSON state file replaced the container manager's text logs in a recent sysdiagnose, and the three iLEAPP artifacts that read it, with their checks and limits.
Read the post - MergediLEAPP #2311
Reading URL opens from the unified log
How iLEAPP now lists the unified log lines that record a link being opened, what they say, and why the URL itself is usually missing.
Read the post
sysdiagnose framework (iOS)
The same iOS 27 parser, offered to the EC-DIGIT-CSIRC framework.
- In reviewSAF #262
A container state parser for the sysdiagnose framework
A parser for the container manager's JSON state file in the sysdiagnose framework, now in review: how it relates to the same reader in iLEAPP and how the two projects differ.
Read the post
How we contribute back
The same steps every time, so maintainers know what to expect.
Study and write up
We find out how a device records something, publish the method and the limits, and cite the evidence.
Make a synthetic fixture
We build a small test file in the real layout with invented values and known answers. Never case data, never real identifiers.
Write the parser and tests
The parser comes with tests that read the fixture and check the answers, in the style of the project.
Talk to the maintainers
We open an issue first, follow the project's contribution guide, and accept their review.
Match the licence
Contributions carry the upstream licence. We keep nothing back.
Contribution principle
What we learn about how devices record their history belongs to everyone who has to read it. We publish it, and we put the parsers where examiners already look.
On GitHub
Counts read from GitHub on 5 November 2026.
- 26Merged pull requests (ALEAPP and iLEAPP)
- 4In review
- 30Posts