iOS Logs, Events, And Plists Parser

iLEAPP parses iOS and iPadOS forensic extractions and produces HTML, TSV, timeline, KML, and LAVA output. It supports iOS/iPadOS 11 through current versions.

Browse the full searchable artifact list at leapps.org/artifacts (filter by LEAPP tool).

Quick Start (Recommended)

Download a pre-built release — no Python installation required.

• LEAPPs Releases — browse all LEAPP family tools
• iLEAPP GitHub Releases — direct downloads

GUI — extract the download, run ileappGUI, then select your input type, source path, output folder, and modules to process.

CLI — extract the download and run from a terminal. The output folder must already exist.

ileapp.exe -t zip -i C:\path\to\extraction.zip -o C:\path\to\output\

On macOS and Linux, use the ileapp binary from the extracted archive instead of ileapp.exe.

Input Types

Encrypted iTunes/Finder backups (-t itunes) are supported. The GUI will prompt for a password before processing when encryption is detected. On the CLI, pass the password with --itunes_password (see Optional parsing options below).

CLI Arguments

These options apply only to the CLI build (ileapp / ileapp.exe / python ileapp.py). The GUI (ileappGUI) exposes the same settings through its interface instead of command-line flags.

Run ileapp --help (or python ileapp.py --help from source) for the built-in reference.

Parsing a case

These three arguments are required for a normal parse run:

Example:

ileapp -t zip -i /path/to/extraction.zip -o /path/to/output/

Optional parsing options

Standalone utility modes

These modes do not parse a case. Use them alone — without -t, -i, or -o:

Examples:

ileapp -p
ileapp -c /path/to/output/folder/

Contributing

Artifact modules live in scripts/artifacts/ and are loaded dynamically at runtime.

New modules: start with the step-by-step guide at How to Write an iLEAPP Module.

Additional references:

• Artifact Info Block Structure
• Updating Modules for Automatic Output Generation
• Updating Complex Modules to Include LAVA Output
• Testing Modules

Running from Source

Releases are the easiest way to run iLEAPP. Use source if you are developing modules or need unreleased changes from main.

Requirements

• Python 3.10 to 3.14
• Git

Setup

git clone https://github.com/abrignoni/iLEAPP.git
cd iLEAPP
python3 -m venv venv
source venv/bin/activate          # Windows: venv\Scripts\activate
pip install -r requirements.txt

On Linux, install tkinter for the GUI:

sudo apt-get install python3-tk

Windows setup help from Hexordia:

• ILEAPP Walkthrough (PDF)
• ILEAPP Walkthrough (video)

Usage

The output folder must exist before running. Source builds report a -dev version (e.g. 2.6.0-dev.0) to distinguish them from official release builds.

CLI:

python ileapp.py -t zip -i /path/to/extraction.zip -o /path/to/output/

GUI:

python ileappGUI.py

See CLI Arguments above, or run python ileapp.py --help.

Acknowledgements

This traiging tool is the result of a collaborative effort of many people in the DFIR community.

iLEAPP logo courtesy of Derek Eiri.