From zero to your first forensic report in five steps. Pick your tool, acquire the data, run the parser, and review results in LAVA.
Start with the device or platform you're analyzing. Each LEAPPs tool targets a specific ecosystem.
Not sure? Check the Artifacts page to see which tool covers the data you need.
LEAPPs works on extracted data — it does not acquire from live devices. You need a file system or backup from your preferred acquisition tool.
| Platform | Extraction type | Compatible tools |
|---|---|---|
| iLEAPP | iTunes/Finder backup, full file system (FFS), GrayKey, Cellebrite | Cellebrite UFED, GrayKey, iTunes backup |
| ALEAPP | Full file system, adb backup, Cellebrite, GrayKey | Cellebrite UFED, GrayKey, adb pull |
| RLEAPP | ISP/carrier records, warrant returns, subscriber data exports | Carrier-provided CSV/Excel returns, law enforcement subpoena responses |
| VLEAPP | Vehicle system image | Logical acquisitions |
Point LEAPPs at the extraction source.
LEAPPs tools run on Python 3.12+. Download the latest release, install dependencies, and run against your extraction folder.
💡 Prefer not to run Python scripts directly? The Releases page provides pre-built executables — no Python installation required.
A Homebrew install handles Python and dependencies for you — skip the pip steps below and run the tool directly. Full walkthrough in the Homebrew guide. On Windows, use the pre-built executables or the manual steps below.
Select your input folder (extraction source) and output folder, then click Process. The GUI will show progress per module.
Three commands: install, parse, review. No extraction to test with yet? Explore a pre-processed report in the LAVA sample projects to see what the output looks like.
When processing completes, LEAPPs writes an HTML report to your output folder. You have two ways to review it.
index.html in your output folder in any browser. Artifacts are organized into categories with search and filtering built in.LAVA (LEAPPs Artifact Viewer Application) is the purpose-built viewer for LEAPPs reports. Instead of browsing a flat HTML file, LAVA gives you filtering capabilities and data export options.
How to use it:
LAVA works with output from iLEAPP, ALEAPP, RLEAPP, and VLEAPP. View LAVA on GitHub →
Found an artifact that isn't parsed yet? LEAPPs is open-source and built by the community. Adding a parser is straightforward.
scripts/artifacts/ folder following the existing module patternQuestions? Ask in Discord — the community is active and happy to help new contributors get started.