wingetCollections
  • Auto
  • Search
  • Awesome Collections
  • Awesome Programs
  • My Favorite Collections
  • My Collections
  • Account / Settings
  • Terms of Service
  • Privacy
  • About
  • What is WinGet?

© 2026 winget.ragerworks.com

Loading...
Install iLEAPP CLI using Winget - wingetCollections
  1. Go back
  2. Packages
  3. iLEAPP CLI
iLEAPP CLI logo

iLEAPP CLI abrignoni

Use this command to install iLEAPP CLI:
winget install --id=abrignoni.iLEAPP-cli -e

iLEAPP CLI is a command-line tool designed to parse iOS logs, events, and plist files, providing detailed forensic analysis of device data. It supports iOS/iPadOS versions 11 through 17 and can process compressed .tar/.zip files, decompressed directories, or iTunes/Finder backups.

Key Features:

  • Parses Mobile Installation Logs, iOS 12+ notifications, build info (iOS version, etc.), wireless cellular service details, screen icons by grid order, application state data for app bundle ID correlation, and user/device connection history.
  • Supports parsing directly from compressed files or decompressed directories, including iTunes/Finder backups.
  • Available in both CLI and GUI versions for flexible workflow preferences.
  • Extensible with artifact plugins that can be added to enhance functionality.

Audience & Benefit: Ideal for forensic investigators, incident responders, and researchers who need to extract detailed information from iOS devices. iLEAPP CLI provides a powerful toolset for analyzing device data without requiring jailbreaking, enabling efficient extraction of critical forensic evidence in both criminal and civil investigations.

README

iLEAPP

iOS Logs, Events, And Plists Parser

iLEAPP parses iOS and iPadOS forensic extractions and produces HTML, TSV, timeline, KML, and LAVA output. It supports iOS/iPadOS 11 through current versions.

Browse the full searchable artifact list at leapps.org/artifacts (filter by LEAPP tool).

Quick Start (Recommended)

Download a pre-built release — no Python installation required.

  • LEAPPs Releases — browse all LEAPP family tools
  • iLEAPP GitHub Releases — direct downloads
PlatformGUICLI
WindowsileappGUI-*-Windows_x64.zipileapp-*-Windows_x64.zip
macOS (Apple Silicon)ileappGUI-*-macOS_Apple_Silicon.dmgileapp-*-macOS_Apple_Silicon.zip
macOS (Intel)ileappGUI-*-macOS_Mac_Intel.dmgileapp-*-macOS_Mac_Intel.zip
LinuxileappGUI-*-Linux_x86_64.AppImageileapp-*-Linux_x86_64.AppImage

GUI — extract the download, run ileappGUI, then select your input type, source path, output folder, and modules to process.

CLI — extract the download and run from a terminal. The output folder must already exist.

ileapp.exe -t zip -i C:\path\to\extraction.zip -o C:\path\to\output\

On macOS and Linux, use the ileapp binary from the extracted archive instead of ileapp.exe.

Input Types

TypeDescription
fsFolder of extracted files with normal paths and names
zipZIP archive containing files with normal names
tarTAR archive
Versions
2.5.0
2.4.0
2.3.1
2.3.0
2.1.0
1.18.7
Website
github.com
License
Last updated
5/27/2026
Download latest version
gz
GZIP-compressed archive
itunesiTunes/Finder backup folder with hashed paths and names
fileSingle file input

Encrypted iTunes/Finder backups (-t itunes) are supported. The GUI will prompt for a password before processing when encryption is detected. On the CLI, pass the password with --itunes_password (see Optional parsing options below).

CLI Arguments

These options apply only to the CLI build (ileapp / ileapp.exe / python ileapp.py). The GUI (ileappGUI) exposes the same settings through its interface instead of command-line flags.

Run ileapp --help (or python ileapp.py --help from source) for the built-in reference.

Parsing a case

These three arguments are required for a normal parse run:

ArgumentLong formDescription
-tInput type: fs, tar, zip, gz, itunes, or file
-i--input_pathPath to the input file or folder
-o--output_pathPath to the output folder (must already exist)

Example:

ileapp -t zip -i /path/to/extraction.zip -o /path/to/output/

Optional parsing options

ArgumentLong formDescription
-w--wrap_textPass this flag to disable text wrapping in output files
-m--load_profilePath to an iLEAPP profile file (.ilprofile) to limit which modules run
-d--load_case_dataPath to a LEAPP case data file (.lcasedata)
--custom_output_folderCustom name for the report output subfolder
--custom_artifacts_pathExtra folder to load artifact modules from (e.g. scripts/alternate_artifacts)
--itunes_password

Standalone utility modes

These modes do not parse a case. Use them alone — without -t, -i, or -o:

ArgumentLong formDescription
-p--artifact_pathsWrite all artifact search paths to path_list.txt in the current directory
-c--create_profile_casedataInteractive wizard to create a .ilprofile or .lcasedata file in the given folder

Examples:

ileapp -p
ileapp -c /path/to/output/folder/

Contributing

Artifact modules live in scripts/artifacts/ and are loaded dynamically at runtime.

New modules: start with the step-by-step guide at How to Write an iLEAPP Module.

Additional references:

  • Artifact Info Block Structure
  • Updating Modules for Automatic Output Generation
  • Updating Complex Modules to Include LAVA Output
  • Testing Modules

Running from Source

Releases are the easiest way to run iLEAPP. Use source if you are developing modules or need unreleased changes from main.

Requirements

  • Python 3.10 to 3.14
  • Git

Setup

git clone https://github.com/abrignoni/iLEAPP.git
cd iLEAPP
python3 -m venv venv
source venv/bin/activate          # Windows: venv\Scripts\activate
pip install -r requirements.txt

On Linux, install tkinter for the GUI:

sudo apt-get install python3-tk

Windows setup help from Hexordia:

  • ILEAPP Walkthrough (PDF)
  • ILEAPP Walkthrough (video)

Usage

The output folder must exist before running. Source builds report a -dev version (e.g. 2.6.0-dev.0) to distinguish them from official release builds.

CLI:

python ileapp.py -t zip -i /path/to/extraction.zip -o /path/to/output/

GUI:

python ileappGUI.py

See CLI Arguments above, or run python ileapp.py --help.

Acknowledgements

This traiging tool is the result of a collaborative effort of many people in the DFIR community.

iLEAPP logo courtesy of Derek Eiri.