You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
|[allTrails.py](https://github.com/abrignoni/iLEAPP/blob/main/scripts/artifacts/allTrails.py)| allTrailsUserInfo | AllTrails - User Info | all | user || 2024-12-17 | Extract user info from AllTrails App |``*/Documents/AllTrails.sqlite*``|
132
+
|[appConduit.py](https://github.com/abrignoni/iLEAPP/blob/main/scripts/artifacts/appConduit.py)| appConduit | App Conduit | standard | activity || 2025-04-05 | The AppConduit log file stores information about interactions between iPhone and other iOS devices, i.e. Apple Watch |``*/mobile/Library/Logs/AppConduit/AppConduit.log.*``|
132
133
|[appGrouplisting.py](https://github.com/abrignoni/iLEAPP/blob/main/scripts/artifacts/appGrouplisting.py)| appGrouplisting | Bundle ID by AppGroup & PluginKit IDs | html, tsv, lava | package || 2024-12-20 | List can included once installed but not present apps. Each file is named .com.apple.mobile_container_manager.metadata.plist |``*/Containers/Shared/AppGroup/*/.com.apple.mobile_container_manager.metadata.plist``, ``*/Containers/Data/PluginKitPlugin/*/.com.apple.mobile_container_manager.metadata.plist``|
133
134
|[appItunesmeta.py](https://github.com/abrignoni/iLEAPP/blob/main/scripts/artifacts/appItunesmeta.py)| get_appItunesmeta | Apps - Itunes Metadata | standard || 0.2 || iTunes & Bundle ID Metadata contents for apps |``*/iTunesMetadata.plist``, ``**/BundleMetadata.plist``|
134
135
|[appleAlarms.py](https://github.com/abrignoni/iLEAPP/blob/main/scripts/artifacts/appleAlarms.py)| alarms | Alarms | standard | clock || 2024-12-22 | Extraction of alarms set |``*/mobile/Library/Preferences/com.apple.mobiletimerd.plist``|
@@ -287,7 +288,7 @@ Number of modules with errors or no recognized artifacts: 3
287
288
|[subscriberInfo.py](https://github.com/abrignoni/iLEAPP/blob/main/scripts/artifacts/subscriberInfo.py)| subscriberInfo | Subscriber Info | standard | settings | 0.1 || Information about inserted SIM Cards |``*/wireless/Library/Databases/CellularUsage.db*``|
288
289
|[sysShutdown.py](https://github.com/abrignoni/iLEAPP/blob/main/scripts/artifacts/sysShutdown.py)| get_sysShutdown | Sysdiagnose - Shutdown Log | none || 0.1 || Parses the shutdown.log file from Sysdiagnose logs, based off work by Kaspersky Lab https://github.com/KasperskyLab/iShutdown|``*/shutdown.log``|
289
290
|[systemVersionPlist.py](https://github.com/abrignoni/iLEAPP/blob/main/scripts/artifacts/systemVersionPlist.py)| systemVersionPlist | System Version plist | standard, tsv, none || 5.0 || Parses basic data from */System/Library/CoreServices/SystemVersion.plist which is a plist in GK Logical Plus extractions that will contain the iOS ver |``*/System/Library/CoreServices/SystemVersion.plist``|
290
-
|[tcc.py](https://github.com/abrignoni/iLEAPP/blob/main/scripts/artifacts/tcc.py)| tcc | Application Permissions | standard ||0.7.2|| Extract application permissions from TCC.db database |``*/mobile/Library/TCC/TCC.db*``|
291
+
|[tcc.py](https://github.com/abrignoni/iLEAPP/blob/main/scripts/artifacts/tcc.py)| tcc | Application Permissions | standard |key||2025-04-07| Extract application permissions from TCC.db database |``*/mobile/Library/TCC/TCC.db*``|
291
292
|[teams.py](https://github.com/abrignoni/iLEAPP/blob/main/scripts/artifacts/teams.py)| teamsMessages | Teams Messages | standard || 1.0 || Microsoft Teams messages and shared media |``*/mobile/Containers/Shared/AppGroup/*/SkypeSpacesDogfood/*/Skype*.sqlite*``, ``*/mobile/Containers/Shared/AppGroup/*/SkypeSpacesDogfood/Downloads/*/Images/*``|
292
293
|[teams.py](https://github.com/abrignoni/iLEAPP/blob/main/scripts/artifacts/teams.py)| teamsContacts | Teams Contacts | standard || 1.0 || Microsoft Teams contact list |``*/mobile/Containers/Shared/AppGroup/*/SkypeSpacesDogfood/*/Skype*.sqlite*``|
293
294
|[teams.py](https://github.com/abrignoni/iLEAPP/blob/main/scripts/artifacts/teams.py)| teamsUser | Teams User Information | standard || 1.0 || Microsoft Teams user profile and sync data |``*/mobile/Containers/Shared/AppGroup/*/SkypeSpacesDogfood/*/Skype*.sqlite*``|
0 commit comments