Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
173 commits
Select commit Hold shift + click to select a range
ae77041
Makes some internal functionality visible to Task implementations.
patrickdalla Oct 6, 2023
8f325da
'#43 Initial ALeapp/ILeapp integration classes.
patrickdalla Oct 6, 2023
cd8ede2
'#43 improves exception handling. Unique skipped exception is the one
patrickdalla Oct 9, 2023
63d4b19
'#43 adds the device info to the 4th processing queue.
patrickdalla Oct 9, 2023
1f650aa
'#43 As leapp scripts declare the output temp report folder as a a
patrickdalla Oct 9, 2023
b2ff524
'#43 corrects loop on data fields
patrickdalla Oct 9, 2023
dfaf2bd
'#43 downloads ALEAPP into tools dir.
patrickdalla Oct 10, 2023
aaf3064
'#43 get ALeappPlugins from ALeappConfig.
patrickdalla Oct 10, 2023
442cc73
'#43 implements Python hook to change ALeapp code before loading,
patrickdalla Oct 10, 2023
787c2a0
'#43 Repositions PythonHook class to iped-utils and adjust dependecies.
patrickdalla Oct 11, 2023
539f0bc
'#43 Implements method wrapsClass that inserts a decoupled Wrapper from
patrickdalla Oct 11, 2023
947fdb1
'#43 If the artifact has a field that corresponds to a href to a temp
patrickdalla Oct 11, 2023
03af1ac
'#43 If the value of the html column is a path to the dump or to an
patrickdalla Oct 15, 2023
724850e
'#43 Adds ALeapp device details html as sub type of text/html mimetype.
patrickdalla Oct 15, 2023
3dbd758
'#43 Removes dependency of aleapp from class PythonHook.
patrickdalla Oct 17, 2023
ce81e08
'#43 In the IPED embedded python some code were inside zip files. This
patrickdalla Oct 17, 2023
ebbd15a
'#43 Removes redundant code.
patrickdalla Oct 17, 2023
e0a0d64
'#43 removes debugging error messages.
patrickdalla Oct 17, 2023
318fba3
'#43 Adds a distinct tree icon for report folders (decoded data that has
patrickdalla Oct 17, 2023
fa1488c
'#43 Replaces backslash occurrences of path strings passed to python
patrickdalla Oct 17, 2023
fefb2a7
'#43 Adjust temp report folder name, as there is a method inside
patrickdalla Oct 17, 2023
c390424
'#43 Makes aleappDir static as it is a config that is loaded once and is
patrickdalla Oct 17, 2023
58218ec
'#43 overrides timeline function to do nothing as the timeline will be
patrickdalla Oct 18, 2023
e6af24f
'#43 Puts task report folder in upper tmp folder, to avoid too long path
patrickdalla Oct 18, 2023
c9e9ea4
'#43 media_to_html override. ALeapp uses this method is used to show a
patrickdalla Oct 18, 2023
6ad1a2e
'#43 adds suport for multiple parameter python function override.
patrickdalla Oct 18, 2023
5ead16f
'#43 Add support for folder class path search when debugging (Eclipse
patrickdalla Oct 18, 2023
17eaec9
'#43 some plugins declares a lambda function directly on artifact parse
patrickdalla Oct 18, 2023
84883ab
'#43 Implements a more detailed naming scheme for timestamp fields.
patrickdalla Oct 19, 2023
715d5d5
'#43 uses package name to describe eventtype of FCMQueuedMessageDump
patrickdalla Oct 19, 2023
0ff7e5d
'#43 initial file hook implementations.
patrickdalla Oct 19, 2023
1ba2875
'#43 initial file hook implementation
patrickdalla Oct 19, 2023
236b9e5
'#43 Mark setToignore on plugins evidence items which execution did not
patrickdalla Oct 20, 2023
6b2bef6
'#43 Initial code to handle special characters
patrickdalla Oct 20, 2023
4e7272f
'#43 Moves complete folder to tmp when returned as needed by a plugin
patrickdalla Oct 20, 2023
37e435e
'#43 creates symbolik links with the original path an name to the tmp
patrickdalla Oct 20, 2023
6b1c7bf
'#43 Symbolic links creation are not permitted by default on windows
patrickdalla Oct 20, 2023
4401847
'#43 support media_to_html data return and improves link info
patrickdalla Oct 20, 2023
4d7a4fa
'#43 better exception treatment when creating links to other items
patrickdalla Oct 23, 2023
53d6e0a
'#43 adds executed plugin name info as a metadata of the item extracted.
patrickdalla Jan 17, 2024
bd086a1
'#43 Including ALeapp python dependencies in distribution
patrickdalla Jan 17, 2024
99569f1
'#43 Removes fixed third party library from resources. It will be
patrickdalla Jan 18, 2024
6b60491
'#43 Uses maven exec to install pip and Aleapp dependencies on embedded
patrickdalla Jan 18, 2024
7672ace
'#43 Add new metadata to identify if item is a plugin item and add log
patrickdalla Jan 19, 2024
aaa8586
'#43 Removes subitem processing time from logic to calc ALeapp plugin
patrickdalla Jan 19, 2024
c099a25
'#43 Moves code inside try catch to better handle exceptions.
patrickdalla Jan 22, 2024
034e314
'#43 Initial code of Task to categorize ALeapp extracted items
patrickdalla Jan 22, 2024
6750caf
'#43 installation of ALeapp items categorization task
patrickdalla Jan 22, 2024
e9074e7
'#43 Better rules implementation to identify a folder structure as a
patrickdalla Jan 22, 2024
c8a1f35
'#43 filter to avoid redundant code execution
patrickdalla Jan 22, 2024
f1241e7
'#43 removes debugging helper code.
patrickdalla Jan 24, 2024
d2ae74f
'#43 removes ALeapp dependencies installation from IPED project as it
patrickdalla Jan 24, 2024
4dedd1c
'#43 It was identified that ALeapp plugin factory_reset get modified
patrickdalla Jan 29, 2024
5ff79b2
'#43 Implements some ALeapp artifacts categorization.
patrickdalla Jan 29, 2024
40a6e6b
'#43 Assures method override restoration after ALeapp plugin execution
patrickdalla Jan 29, 2024
6d9cf3f
'#43 Corrects sim info plugin name in sim info categorization rule.
patrickdalla Jan 30, 2024
fce41bc
'#43 Checks decoded data via path before special character removal.
patrickdalla Jan 30, 2024
e223cf0
'#43 Add facebook user id to User Accounts category.
patrickdalla Jan 30, 2024
5c29786
'#43 use "/data/data/com.android.vending" as it is a more common file
patrickdalla Jan 30, 2024
7282da8
'#43 Adds hard coded method to classify artifacts and maps some
patrickdalla Feb 1, 2024
03eadb4
'#43 Refactor pracessPlugin method to separate code related to file
patrickdalla Feb 1, 2024
123e172
'#43 Some plugins send file parameter as a relative path to the Dump
patrickdalla Feb 1, 2024
023b18d
'#43 Removes LeappCategoryTask as it will be coded in java, or even in
patrickdalla Feb 1, 2024
2e897ef
'#43 Adding some comments for documentation
patrickdalla Feb 1, 2024
c491541
'#43 reverses method creation as it breaks logic when evidence processed
patrickdalla Feb 1, 2024
7032a5f
'#43 Supports new 3.1.9 version which changed main plugin parse
patrickdalla Feb 5, 2024
4564c5c
'#43 Add communications metadata info of ALeapp extracted emails from
patrickdalla Feb 5, 2024
0a6ab17
'#43 extends ALeappConfig with excludePlugins and includePlugins
patrickdalla Feb 5, 2024
bd5f462
'#43 SMS communications metadata mapping. There were no information from
patrickdalla Feb 5, 2024
2c83cec
'#43 Some url references are not insider delimiters
patrickdalla Feb 6, 2024
3c61144
'#43 prints aleapp dir log info only once
patrickdalla Feb 6, 2024
c47f606
'#43 Categorizes chrome cookies.
patrickdalla Feb 6, 2024
00aece5
'#43 correctly config date property as such
patrickdalla Feb 7, 2024
4a9d61b
'#2078 Android backup parser code.
patrickdalla Feb 7, 2024
f2774ec
'#2079 renames wrong named constant name
patrickdalla Feb 8, 2024
fe1f645
Merge branch 'AndroidBackup' into ALeappTask
patrickdalla Feb 8, 2024
306a0a8
'#43 Corrects last merge conflict.
patrickdalla Feb 8, 2024
7d0baa5
'#43 Adaptation to support generation of ALeapp reports on Android
patrickdalla Feb 8, 2024
9ead7ff
'#43 Makes some more classifications. Improves exception handling to
patrickdalla Feb 14, 2024
67cc7c2
'#43 Implements functionality to check data type before adding location
patrickdalla Feb 14, 2024
49f4967
'#2095 Add supports to dump recognition if it is passed as root
patrickdalla Feb 23, 2024
6720d07
'#43 Creates factory method and logic to avoid multiple installation of
patrickdalla Feb 23, 2024
1e7f788
'#43 Separates logic to install overriden ilapfuncs methods
patrickdalla Feb 23, 2024
ece1fb8
'#43 adds some comments.
patrickdalla Feb 23, 2024
2038c02
'#43 Corrects logic of PythonHook installation.
patrickdalla Feb 23, 2024
106cc05
'#2095 adds some georeferenced extracted items to Locations category.
patrickdalla May 8, 2024
170bd00
'#2095 modify pattern to lucene query transformation, so it doesn't
patrickdalla May 9, 2024
7682505
'#2095 Corrects pattern matching when patterns starts with *
patrickdalla May 9, 2024
0781105
'#2095 Classifications of items extracted from badoo and tiktok plugins.
patrickdalla May 10, 2024
df229a3
'#2095 Improves method to return query to filter resultset before
patrickdalla May 10, 2024
4753a11
'#2095 JSON Syntax error correction
patrickdalla May 10, 2024
35b7094
'#2095 Adds category to represent app notification messages.
patrickdalla May 13, 2024
0c45481
'#2095 Replaces the string /storage/emulated/0 with /data/media/0 as the
patrickdalla May 13, 2024
5537ddb
'#2095 parses some coords from google maps links.
patrickdalla May 13, 2024
00d7586
'#2095 Correctly treats getTempFile if it is a reference to an exported
patrickdalla May 15, 2024
b054ced
'#2095 Adds some methods to support future improvements.
patrickdalla May 15, 2024
4229aca
Merge remote-tracking branch 'origin/master' into ALeappTask
patrickdalla May 20, 2024
eeeac5f
'#2095 Modifications to recognize UFDR files as source for ALeapp
patrickdalla May 21, 2024
3497efd
'#2095 includes all zip files as potential dump to check, as Graykey
patrickdalla Jul 2, 2024
1f88345
Merge branch 'master' into ALeappTask
aberenguel Jul 7, 2025
7b5a1fd
#43 - Refactoring AleappTask to support interceptors using kwargs (ne…
aberenguel Jul 14, 2025
aa9348c
#43 - Missing commit
aberenguel Jul 14, 2025
ca4c35b
#43 - Revert unnecessary changes
aberenguel Jul 14, 2025
c57de76
#43 - Remove unncessary code
aberenguel Jul 14, 2025
31a6db0
#43: Better logging control
aberenguel Jul 15, 2025
5765d75
#43: Don't use temp path as metadata values
aberenguel Jul 15, 2025
a65f8bf
#43: Avoid to use backslash as path separator
aberenguel Jul 15, 2025
a9a5605
#43: Property to enable Aleapp task
aberenguel Jul 15, 2025
743bfa6
Merge branch 'master' into ALeappTask
aberenguel Jul 13, 2026
b79c628
#43: upgrade to JEP 4.3.1
aberenguel Jul 13, 2026
4eb7437
#43: upgrade to ALEAPP v2026.1.0
aberenguel Jul 13, 2026
579960d
#1714: introduce FileZipReader to make possible to process ZIP files …
aberenguel Jul 14, 2026
02d0333
#43: fixes for ALeapp upgrade to version v2026.1.0
aberenguel Jul 14, 2026
bff6348
#43: run ALeapp scripts in separated threads to avoid conflict with P…
aberenguel Jul 14, 2026
d79bdd1
#43: fix variable typo
aberenguel Jul 14, 2026
2a36518
#43: Remove unknown parameters for plugin 'maven-surefire-plugin:2.18…
aberenguel Jul 14, 2026
ed86663
#43: use only one download-maven-plugin in pom.xml
aberenguel Jul 14, 2026
c12a2e3
#43: change report folder icons
aberenguel Jul 14, 2026
f1f13fc
#43: execute code in background task only when necessary
aberenguel Jul 14, 2026
5c36e78
#43: remove unused icons
aberenguel Jul 14, 2026
0964d78
#43: do not create an item for tsv_node; use plugin item
aberenguel Jul 14, 2026
9ffc75b
#43: Fix resource leaks, missing cleanup call, and TSV metadata mapping
cleitonaugusto Jul 13, 2026
d1cbf35
#43: set translatedPaths in stateThreadLocal to make the cleanup in t…
aberenguel Jul 19, 2026
b80dca6
#43: link plugin foundFiles with plugin report items using globalId a…
aberenguel Jul 19, 2026
9d46091
#43: intercept python call ilapfuncs.get_sqlite_db_path
aberenguel Jul 19, 2026
c0d7e30
#43: add globalId to be used in ReferencedBy table
aberenguel Jul 19, 2026
ae3c373
#43: fix unit tests
aberenguel Jul 19, 2026
cbb2a12
Add ALeapp credits information
patrickdalla Jul 20, 2026
3478a64
Merge branch 'ALeappTask' of https://github.com/sepinf-inc/IPED.git i…
patrickdalla Jul 20, 2026
62c6067
#43: ignore sample data artifact info
aberenguel Jul 19, 2026
978623d
#43: render decoded report icon in TableCellRenderer
aberenguel Jul 19, 2026
745ae74
#43: create plugin category item to better organize plugins in tree
aberenguel Jul 20, 2026
dd5bbd4
#43: link foundFiles to plugin item instead of plugin result items
aberenguel Jul 20, 2026
c95cb73
#43: logfunc python call logs as info level
aberenguel Jul 20, 2026
8117dd2
#43: ignore categories with no plugin results
aberenguel Jul 20, 2026
859f41a
#43: don't add "artifact_icon" to metadata
aberenguel Jul 20, 2026
fe5a1e1
#43: enhance globToLuceneQuery add checkLucenePath method for precise…
aberenguel Jul 20, 2026
0fd0219
#43: remove "get_" from mimetypes
aberenguel Jul 21, 2026
5ea1a3d
#43: isolate the Aleapp interceptors from other SharedInterpreters
aberenguel Jul 21, 2026
cbfca81
#43: migrate AleappTask.states to LeapContext
aberenguel Jul 21, 2026
2821c42
#43: expose seeker.file_infos
aberenguel Jul 21, 2026
9b9107e
#43: intercepts python call os.stat - used by many plugins
aberenguel Jul 21, 2026
6a98cc5
#43: update stats of exported files in temp folder
aberenguel Jul 21, 2026
9ae4b65
#43: create aleapp output files in temp folder
aberenguel Jul 21, 2026
f53c97c
#2095: fix counting of processed items
aberenguel Jul 22, 2026
b53f2e0
#43: revert the strategy of intercept native python call -> now alway…
aberenguel Jul 22, 2026
6d4e73a
#43: log module + plugin names in interceptor
aberenguel Jul 22, 2026
9649070
#43: improve comments and code organization
aberenguel Jul 22, 2026
9a57e13
#43: rename CallInterceptor vars and add comments
aberenguel Jul 22, 2026
028fe2c
#43: rename the package and classes to represent the Leapp tools
aberenguel Jul 22, 2026
4fed678
#43: make FileSeeker.search compatible with python call
aberenguel Jul 22, 2026
4aef5d2
#43: make LEAPP Context state thread-local to support concurrent IPED…
aberenguel Jul 22, 2026
c37777c
#43: Update TaskInstaller.xml
aberenguel Jul 22, 2026
ec4902d
#43: capture LEAPP results from lava_insert_sqlite_data instead of tsv
aberenguel Jul 22, 2026
a1c1f9d
#43: use double for dates in FileSeeker.FileInfo
aberenguel Jul 22, 2026
459f949
#43: reuse PythonParser.getJep() in AleappTask + create unique global…
aberenguel Jul 22, 2026
83d39a6
#43: create method execPythonResource for possible reuse
aberenguel Jul 22, 2026
6e2f03b
#43: make the access to ilapfuncs.device_info thread-safe
aberenguel Jul 22, 2026
6fa0ddd
#43: don't export embedded items
aberenguel Jul 22, 2026
0a24a07
#43: prefer active over deleted/carved items when paths collide in Fi…
aberenguel Jul 22, 2026
a71bbbe
#43: simplify AleappTask/FileSeeker export cleanup
aberenguel Jul 23, 2026
5cdc417
#43: render HTML chats for plugins that have "data_views" attributes
aberenguel Jul 23, 2026
9b75edf
#43: fix aleapp chat icons and enable JS for aleapp chats HTML
aberenguel Jul 23, 2026
4980b66
#43: convert chat aleapp metadata to the ones prefixed with "Conversa…
aberenguel Jul 23, 2026
1e22c70
#43: fix unit tests related to conversation items
aberenguel Jul 23, 2026
9629016
Merge branch 'master' into ALeappTask
aberenguel Jul 23, 2026
7b51954
#43: link ALEAPP file-path columns to their case items
aberenguel Jul 23, 2026
91b493c
#43: Refactor ALEAPP row classification into AleappMediaTypeResolver
aberenguel Jul 24, 2026
67a437a
#43: change extraction root detection for UFDR files and fix adding l…
aberenguel Jul 24, 2026
f20330c
#43: don't exclude "appicons" plugin since it supports lava
aberenguel Jul 24, 2026
b7ae853
#43: skip ALEAPP over non-android extractions, e.g. iOS inside an ufdr
aberenguel Jul 25, 2026
9e93606
'#2095
patrickdalla Jul 27, 2026
6d917f8
#43: fix FFS root skip check: compare path with equals instead of ==
aberenguel Jul 28, 2026
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 10 additions & 1 deletion ThirdParty.txt
Original file line number Diff line number Diff line change
Expand Up @@ -182,4 +182,13 @@ JUnRAR

Lottie-player
- Site: https://github.com/LottieFiles/lottie-player/blob/master/LICENSE
- License: licenses/LOTTIE-PLAYER.txt
- License: licenses/LOTTIE-PLAYER.txt

------------------------------------------

ALeapp
- Site: https://github.com/abrignoni/ALEAPP
- Project: ALEAPP (Android Logs Events And Protobuf Parser)
- Project contributors: https://github.com/abrignoni/ALEAPP/graphs/contributors?from=18%2F04%2F2026
- License: MIT

77 changes: 51 additions & 26 deletions iped-app/pom.xml
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,7 @@
<properties>
<release.dir>${project.parent.build.directory}/release/iped-${project.version}</release.dir>
<parent.root>${resources.dir}/../..</parent.root>
<aleapp.version>v2026.1.0</aleapp.version>
</properties>

<dependencies>
Expand Down Expand Up @@ -61,30 +62,56 @@
<artifactId>findbugs-maven-plugin</artifactId>
<version>3.0.0</version>
</plugin>
<plugin>
<groupId>com.googlecode.maven-download-plugin</groupId>
<artifactId>download-maven-plugin</artifactId>
<version>1.6.8</version>
<executions>
<execution>
<id>download-regripper</id>
<goals>
<goal>wget</goal>
</goals>
</execution>
</executions>
<configuration>
<url>https://github.com/sepinf-inc/RegRipper3.0/archive/refs/tags/3.0-p3.zip</url>
<unpack>true</unpack>
<fileMappers>
<org.codehaus.plexus.components.io.filemappers.RegExpFileMapper>
<pattern>RegRipper[^/]+/</pattern>
<replacement>./</replacement>
</org.codehaus.plexus.components.io.filemappers.RegExpFileMapper>
</fileMappers>
<outputDirectory>${tools.dir}/regripper</outputDirectory>
</configuration>
</plugin>
<plugin>
<groupId>io.github.download-maven-plugin</groupId>
<artifactId>download-maven-plugin</artifactId>
<version>2.1.0</version>
<executions>
<execution>
<id>download-regripper</id>
<goals>
<goal>wget</goal>
</goals>
<configuration>
<url>https://github.com/sepinf-inc/RegRipper3.0/archive/refs/tags/3.0-p3.zip</url>
<unpack>true</unpack>
<fileMappers>
<org.codehaus.plexus.components.io.filemappers.RegExpFileMapper>
<pattern>^RegRipper[^/]+/(.*)$</pattern>
<replacement>$1</replacement>
</org.codehaus.plexus.components.io.filemappers.RegExpFileMapper>
</fileMappers>
<outputDirectory>${tools.dir}/regripper</outputDirectory>
</configuration>
</execution>
<execution>
<id>download-aleapp</id>
<goals>
<goal>wget</goal>
</goals>
<configuration>
<url>https://github.com/abrignoni/ALEAPP/archive/refs/tags/${aleapp.version}.zip</url>
<unpack>true</unpack>
<fileMappers>
<org.codehaus.plexus.components.io.filemappers.RegExpFileMapper>
<pattern>^ALEAPP[^/]+/(.*)$</pattern>
<replacement>$1</replacement>
</org.codehaus.plexus.components.io.filemappers.RegExpFileMapper>
</fileMappers>
<excludes>
<exclude>*/admin/</exclude>
<exclude>*/assets/</exclude>
<exclude>*/tests/</exclude>
<exclude>**/*.md</exclude>
<exclude>**/*.lcasedata</exclude>
<exclude>**/*.alprofile</exclude>
<exclude>*/aleappGUI.py</exclude>
</excludes>
<outputDirectory>${tools.dir}/aleapp</outputDirectory>
</configuration>
</execution>
</executions>
</plugin>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-dependency-plugin</artifactId>
Expand Down Expand Up @@ -854,8 +881,6 @@
<version>2.18.1</version>
<configuration>
<testFailureIgnore>true</testFailureIgnore>
<aggregate>true</aggregate>
<linkXRef>true</linkXRef>
</configuration>
</plugin>
</plugins>
Expand Down
7 changes: 6 additions & 1 deletion iped-app/resources/config/IPEDConfig.txt
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
########################################################################
########################################################################
# Processing Settings
########################################################################

Expand Down Expand Up @@ -171,3 +171,8 @@ enableHTMLReport = true
# It performs classification of image and video files.
# Advanced settings can be modified in file "conf/RemoteImageClassifierConfig.txt"
enableRemoteImageClassifier = false

# Enables ALEAPP integration.
# You can configure a custom path to the ALEAPP installation folder in conf/ALeappConfig.txt.
enableAleapp = true

30 changes: 30 additions & 0 deletions iped-app/resources/config/conf/ALeappConfig.txt
Original file line number Diff line number Diff line change
@@ -0,0 +1,30 @@
# -----------------------------------------------------------------------------
# ALEAPP Integration Settings
# -----------------------------------------------------------------------------

# Path to the main ALEAPP installation directory.
# If this property is commented out or left empty, IPED will search for ALEAPP
# in the default directory: <IPED_installation_folder>/tools/aleapp
# Example for Windows: aleapFolder=C:\Forensic Tools\aleapp
# Example for Linux: aleapFolder=/home/user/aleapp
# aleapFolder=

# -----------------------------------------------------------------------------

# Comma-separated list of specific ALEAPP plugins to run.
# Use this to create an inclusion list, forcing IPED to run ONLY the specified plugins.
# If left empty (default behavior), IPED will run all available ALEAPP plugins
# except for those defined in the 'excludePlugins' property below.
# Example: includePlugins=firefox,teams,googleCalendar
includePlugins=

# -----------------------------------------------------------------------------

# Comma-separated list of ALEAPP plugins to specifically exclude from processing.
# This is useful for disabling plugins that are redundant with native IPED parsers,
# are irrelevant to the case, or produce undesired output.
#
# The default exclusions are listed below with justifications:
# - walStrings: Excluded because IPED natively parses strings from unparsed files.
# - WhatsApp: Excluded because IPED uses its own robust, internal parser for WhatsApp artifacts.
excludePlugins=walStrings,WhatsApp
Loading
Loading