Exploits, Tools & Data Recovery · The Forensic Tool Landscape · Lesson 2 of 5

Open-Source & Free Tools

Discover the free LEAPP parsers, Autopsy and why open code matters.

The LEAPP family

Commercial suites can cost thousands of dollars per license each year. Alongside them sits a community of free tools, many written by working examiners. The best known for phones are the LEAPPs, started by digital forensics examiner Alexis Brignoni.

• iLEAPP (iOS Logs, Events, And Plist Parser) reads iPhone and iPad extractions.
• ALEAPP (Android Logs Events And Protobuf Parser) does the same for Android.

The names point to what they read. A plist (property list) is a file format Apple uses for settings and records. Protobuf (Protocol Buffers) is a compact data format from Google that many Android apps use to store information.

It helps to be clear about what these tools are not. They don't connect to a phone and they don't unlock anything. They are parsers. They take an extraction that someone already made, such as a folder of files, an archive or an iTunes or Finder backup, and turn what's inside into reports: web pages, tables, timelines and map files. Of the four jobs from the last module, they cover decoding and reporting.

Each kind of record the tools understand, such as a location database or one chat app's messages, is handled by its own small module. That design makes it easy for someone to add support for a new app. iLEAPP's project page credits the wider digital forensics community, names several maintainers who review changes, and publishes the code under the MIT license, a permissive license that lets anyone read, reuse and modify it.

The LEAPPs also show up inside other tools. Autopsy, which you'll meet next, includes iOS and Android analyzer modules that run iLEAPP and ALEAPP and show their results in its own interface.

Free parsers are popular for a second opinion. An examiner who decoded a phone with a commercial suite can run the same extraction through a LEAPP and compare the results, an idea that comes back in the module on testing.

Why open code matters

Autopsy is a free, open-source digital forensics platform built by Sleuth Kit Labs, with development led by Brian Carrier. It gives a graphical interface to The Sleuth Kit, a set of tools for reading disk images and file systems. Autopsy is best known for computer investigations, but it can bring in phone data too, including through its analyzer modules that run iLEAPP and ALEAPP. Its website says tens of thousands of law enforcement and corporate investigators use it.

You met the Mobile Verification Toolkit (MVT) in Mobile Malware. Amnesty International's Security Lab released it in 2021 to look for traces of spyware by comparing a phone's records with published indicators. It's a reminder that free tools also serve people on the other side: those who think they've been targeted, sometimes with tools that governments bought.

Why do open-source tools matter in a field led by commercial suites?

• Transparency. Anyone can read exactly how a parser turns raw data into a result. With a commercial tool, the method is usually a trade secret, so examiners and courts have to trust the vendor's word.
• Peer review. Many people can inspect the code, spot mistakes and fix them in public, leaving a record of what changed and when.
• Cost and access. Small agencies, defense experts, students and researchers can use them without a license budget.
• A second opinion. Running an extraction through a different tool is a cheap way to check a result.

Open source has limits too. Free tools generally don't extract data from locked phones, projects depend on volunteers' time, and help comes from the community rather than a support desk. Code that anyone can read hasn't necessarily been read by anyone. Like every tool, open-source tools still need testing, which is where the next module picks up.