iLEAPP iOS Forensics Simulator

CASE

Loading case...

Synthetic mobile evidence case.

Device

Selected handset

Operating system

Case platform version

Lab progress

Saved in this browser

Parsing workflow

Validation, discovery, modules, output, and review

Ready

iLEAPP command laboratory

Safe command interpreter modeled on current CLI concepts

student@mobile-lab:~/casework

Parsed report workspace

Inspect source-aware artifacts and build a correlated timeline

No report

Student laboratory guide

Tasks, interpretation, notes, and exports

Establish scope

Read the scenario, record authority, identify the acquisition type, and verify the supplied digest.

Choose a parser scope

Compare a focused profile with a full parse. Explain what evidence is excluded by each choice.

Run and review

Use the graphical controls or construct the equivalent CLI command. Review source paths, not just labels.

Correlate and qualify

Build a timeline from independent artifacts and distinguish observations from inferences.

Export the record

Save a report, machine-readable data, timeline, notes, and parsing profile.

Current workflow note

iLEAPP parses acquired iOS/iPadOS data; it does not perform live-device acquisition. Current CLI parsing requires an input type, input path, and existing output folder. Encrypted Finder/iTunes backups can use --itunes_password.

Artifact inspector

Run a parse, open an artifact table, and select a row to inspect its fields.

Case checkpoint

The checkpoint becomes available after parsing.

Interpretation check

Analyst notes

Export examination products

Official references

Available when an Internet connection is present; the simulator itself remains offline