Free & open-source tools
A curated list of tools used by the mobile forensics community for acquisition, parsing, validation, and reporting. Always validate a tool against known data before relying on it in casework.
Peer Review Checklist: Mobile Forensics
By Ricky Johnson and Jessica Hyde, published by Hexordia. A structured checklist for a second examiner to review scope, tool validation, and analysis before a report goes out.
UFADE
Universal Forensic Apple Device Extractor. Open-source logical and advanced logical acquisition for Apple devices.
iLEAPP
iOS Logs, Events & Plists Parser. Turns iOS and iPadOS extractions into organized, searchable reports.
ALEAPP
Android Logs, Events & Protobuf Parser. Parses Android databases, logs, and app data into organized reports.
VLEAPP
Vehicle Logs, Events & Plists Parser, built for vehicle infotainment and telematics extractions.
RLEAPP
Returns, Logs, Events & Properties Parser, for warrant returns and other provider data.
LAVA
LEAPP Artifact Viewer App. Review and filter LEAPP output in one place instead of paging through HTML reports.
DLEAPP
Desktop Logs, Events and Protobuf Parser. Parses desktop application artifacts, and anything that does not fit the other LEAPPs.
GLEAPP
Graphics, Logs, Examination, Automated Processing, Parsing. Triage large sets of images and video, with offline maps via the GLEAPP Map Downloader.
Batch LEAPP
Run any LEAPP tool across a whole folder of extractions in one pass.
ArtEx
Artifact Examiner by Doubleblak. Analyze iOS artifacts and map location data. A staple in any mobile toolkit.
iCatch
iOS Cache Analysis for Tracking Coordinates History. Recovers and maps cached location records.
Crush
Open-source forensic workbench. Opens archives, iOS and Android backups, E01 images, and UFDR exports in place, with viewers for SQLite, plists, protobuf, LevelDB, and hex.
Plaso (log2timeline)
Build super-timelines from many artifact types with this widely used open-source engine.
Evanole
Live log monitoring and analysis for iOS devices, from Hexordia.
DB Browser for SQLite
A GUI for viewing and querying the SQLite databases behind most mobile apps. Essential for manual verification.
CyberChef
Encode, decode, convert, and carve data entirely in your browser.
UNFURL
Break apart complex URLs to reveal parameters, timestamps, and embedded identifiers.
DCode
Timestamp decoder supporting dozens of formats across platforms.
Know a tool that belongs here? Send it over. Listings are informational and are not endorsements. Check each tool's license and your agency's policy before use.