Quick Start
From zero to your first forensic report in five steps. Pick your tool, acquire the data, run the parser, and review results in LAVA.
Start with the device or platform you're analyzing. Each LEAPPs tool targets a specific ecosystem.
Not sure? Check the Artifacts page to see which tool covers the data you need.
LEAPPs works on extracted data — it does not acquire from live devices. You need a file system or backup from your preferred acquisition tool.
| Platform | Extraction type | Compatible tools |
|---|---|---|
| iLEAPP | iTunes/Finder backup, full file system (FFS), GrayKey, Cellebrite | Cellebrite UFED, GrayKey, iTunes backup |
| ALEAPP | Full file system, adb backup, Cellebrite, GrayKey | Cellebrite UFED, GrayKey, adb pull |
| RLEAPP | ISP/carrier records, warrant returns, subscriber data exports | Carrier-provided CSV/Excel returns, law enforcement subpoena responses |
| VLEAPP | Vehicle system image | Logical acquisitions |
Point LEAPPs at the extraction source.
LEAPPs tools run on Python 3.12+. Download the latest release, install dependencies, and run against your extraction folder.
💡 Prefer not to run Python scripts directly? The Releases page provides pre-built executables — no Python installation required.
Select your input folder (extraction source) and output folder, then click Process. The GUI will show progress per module.
- Download the latest release from leapps.org/releases
- Requires Python 3.12 or later — python.org/downloads
- Point the tool at the extraction source, not individual files
- Runtime depends on extraction size
When processing completes, LEAPPs writes an HTML report to your output folder. You have two ways to review it.
- Direct HTML — open
index.htmlin your output folder in any browser. Artifacts are organized into categories with search and filtering built in. - LAVA viewer — for a richer, structured experience load the report into LAVA (see below).
LAVA (LEAPPs Artifact Viewer Application) is the purpose-built viewer for LEAPPs reports. Instead of browsing a flat HTML file, LAVA gives you filtering capabilities and data export options.
How to use it:
- Download LAVA from leapps.org/releases
- Launch LAVA and open the output folder from your LEAPPs run
- Browse artifacts by category with structured navigation
- Filter artifacts by category, date, or keyword to zero in on relevant data
- Export findings for reports and documentation
LAVA works with output from iLEAPP, ALEAPP, RLEAPP, and VLEAPP. View LAVA on GitHub →
Found an artifact that isn't parsed yet? LEAPPs is open-source and built by the community. Adding a parser is straightforward.
- Fork the relevant repo on GitHub
- Add a new Python file to the
scripts/artifacts/folder following the existing module pattern - Open a pull request — the maintainer reviews and merges quickly
- Your GitHub handle appears on the Scoreboard once your parser ships
Questions? Ask in Discord — the community is active and happy to help new contributors get started.