RLEAPP v2026.4.3

RLEAPP v2026.4.3

• Reading acquisitions with -t raw: qnxprobe is updated to 1.57. On NTFS, a cloud provider's online-only placeholder (OneDrive Files On-Demand) is no longer staged as zeros, a file the Windows Overlay Filter compressed with XPRESS is staged as its content, and an NTFS-compressed file with a compression unit that ends early is staged at its full length.
• The README now says raw input is for an image that holds a return.
• Fixes: checked module boxes are visible in the window on Windows, and the macOS disk image has a new background with the icons centred on its arrow.

Full Changelog: v2026.4.2...v2026.4.3

---

Which file to download

Platform	File
Windows 10 or 11, 64-bit Intel or AMD	-windows-x64-setup.exe (installer), or -windows-x64-portable.zip to run without installing
Windows 11 on ARM	-windows-arm64-setup.exe, or -windows-arm64-portable.zip
macOS, Apple silicon	-macos-arm64.dmg
macOS, Intel	-macos-x64.dmg
Linux, 64-bit Intel or AMD	-linux-x64.AppImage
Linux on ARM	-linux-arm64.AppImage

Every download holds one program, rleapp. Started without arguments, from the Start
menu, the Applications folder or a double-click, it opens the window. Given arguments in a
terminal, it is the command line. On macOS the command line is inside the app:

/Applications/RLEAPP.app/Contents/MacOS/rleapp --help

For tools that run RLEAPP themselves. The options, output and exit codes of rleapp
are those of earlier releases, but the downloads changed shape: there is no rleappGUI
any more, since rleapp without arguments opens the window. On Windows and macOS,
rleapp needs the folder it came in, so run it from there rather than copying the
executable elsewhere on its own; on Linux the AppImage is the whole program.

First launch

The macOS disk images are signed with a Developer ID and notarised by Apple, so they open
without a warning.

The Windows binaries are not signed yet, so SmartScreen says "Windows protected your PC"
the first time. Choose More info, then Run anyway.

On Linux, make the AppImage executable once (chmod +x RLEAPP-*.AppImage). It needs FUSE
to start; where FUSE is not available, run it with --appimage-extract-and-run.

If you would rather not clear a warning, run from source instead; the README has the steps.

Verify what you downloaded

SHA256SUMS.txt covers every file in this release. On macOS or Linux, from the folder you
downloaded into:

grep <the file you downloaded> SHA256SUMS.txt | shasum -a 256 -c -

Use sha256sum in place of shasum -a 256 on Linux. On Windows, in PowerShell:

(Get-FileHash -Algorithm SHA256 .\<the file you downloaded>).Hash

and compare it with the line in SHA256SUMS.txt, which is lower case.

Linux

The build is made on Ubuntu 22.04, so it needs glibc 2.35 or newer and will not start on
an older distribution.

Code signing policy

The code signing policy covers
Windows signing, team roles and privacy.

RLEAPP v2026.4.2

RLEAPP v2026.4.2

• New downloads: RLEAPP is now built by one packaging driver on every platform. Windows gets an installer and a portable zip, macOS gets a signed and notarised disk image, and Linux gets an AppImage, for both Intel/AMD and ARM. There is one program, rleapp: started without arguments it opens the window, and given arguments it is the command line. There is no separate rleappGUI any more, and the download names changed. See "Which file to download" below.
• Meta returns work in the downloads again. The 2026.4.1 builds failed the Meta return artifacts because they asked for lxml, which those builds did not carry. The pages are now read with Python's own HTML parser.
• New returns: Facebook Download Your Information archives (17 artifacts), Coinbase compliance reports (14), Robinhood returns (9) and the PDF layout of TikTok law enforcement returns (12). Thanks to @CyberMike81 for Coinbase and Robinhood and @OneSixForensics for TikTok. The Instagram login activity, profile changes and followers artifacts also match the current export layout, and Instagram messages no longer report threads from a Facebook archive.
• More ways to read acquisitions with -t raw: Ex01, SMART, AFF, AFD, AFF4 and AFM images, VHD, VHDX, VMDK and QCOW virtual disks, Apple disk images (.dmg, .sparseimage, sparse bundles and segmented sets), and logical evidence (EnCase L01, FTK Imager AD1) read as the files it holds. Encrypted Apple disk images, FTK Imager AD-encrypted images, encrypted APFS volumes and BitLocker volumes open with the password or key you give, and an image sealed to a certificate opens with its private key. The raw image seeker lists NTFS alternate data streams, and qnxprobe is updated to 1.55.
• No network requests while a case is processed: the Discord Online artifacts, which downloaded attachments from Discord's CDN, are removed. The offline Discord return artifacts are unchanged. The TikTok subscriber artifact reads PDFs with pypdf instead of PyMuPDF.
• Archive input: zip archives no longer walk every member to look for repeated names, a compressed tar is decompressed once before it is read, and the window accepts .tar.xz.
• Reporting accuracy: the LAVA database and media items are recorded by their evidence path rather than the examiner's own folder, Python text is stored for floats and booleans, test case zips keep each member's recorded times, and archive members named like Windows devices are renamed when staged.
• Fixes: a folder input no longer stages the examiner's files for links that point outside it, and a socket or block device is no longer walked as a directory.
• A new RLEAPP logo, by Kevin Pagano.

New Contributors

• @CyberMike81 made their first contribution in #511

Full Changelog: v2026.4.1...v2026.4.2

---

Which file to download

Platform	File
Windows 10 or 11, 64-bit Intel or AMD	-windows-x64-setup.exe (installer), or -windows-x64-portable.zip to run without installing
Windows 11 on ARM	-windows-arm64-setup.exe, or -windows-arm64-portable.zip
macOS, Apple silicon	-macos-arm64.dmg
macOS, Intel	-macos-x64.dmg
Linux, 64-bit Intel or AMD	-linux-x64.AppImage
Linux on ARM	-linux-arm64.AppImage

Every download holds one program, rleapp. Started without arguments, from the Start
menu, the Applications folder or a double-click, it opens the window. Given arguments in a
terminal, it is the command line. On macOS the command line is inside the app:

/Applications/RLEAPP.app/Contents/MacOS/rleapp --help

For tools that run RLEAPP themselves. The options, output and exit codes of rleapp
are those of earlier releases, but the downloads changed shape: there is no rleappGUI
any more, since rleapp without arguments opens the window. On Windows and macOS,
rleapp needs the folder it came in, so run it from there rather than copying the
executable elsewhere on its own; on Linux the AppImage is the whole program.

First launch

The macOS disk images are signed with a Developer ID and notarised by Apple, so they open
without a warning.

The Windows binaries are not signed yet, so SmartScreen says "Windows protected your PC"
the first time. Choose More info, then Run anyway.

On Linux, make the AppImage executable once (chmod +x RLEAPP-*.AppImage). It needs FUSE
to start; where FUSE is not available, run it with --appimage-extract-and-run.

If you would rather not clear a warning, run from source instead; the README has the steps.

Verify what you downloaded

SHA256SUMS.txt covers every file in this release. On macOS or Linux, from the folder you
downloaded into:

grep <the file you downloaded> SHA256SUMS.txt | shasum -a 256 -c -

Use sha256sum in place of shasum -a 256 on Linux. On Windows, in PowerShell:

(Get-FileHash -Algorithm SHA256 .\<the file you downloaded>).Hash

and compare it with the line in SHA256SUMS.txt, which is lower case.

Linux

The build is made on Ubuntu 22.04, so it needs glibc 2.35 or newer and will not start on
an older distribution.

v2026.4.1

RLEAPP v2026.4.1

• Meta/Instagram returns rebuilt on the current archive format, with conversation direction and ordering corrected so Instagram return conversations now display the right way round in LAVA.
• Forensic input and performance improvements: NTFS and APFS images now read in one pass with qnxprobe 1.30, the LAVA database now commits once per artifact instead of once per staged file, and a new ArtifactResult streaming path added for handling large artifacts more efficiently.
• Legacy code cleanup: media_to_html fully removed (with check_report_local_paths updated to follow paths through it first), and conversation views now preserve data values exactly as artifacts wrote them.
• Reporting and reliability fixes: duplicate zip/tar member names now staged as a single file, oversized HTML report tables held back with a summarized view, database errors in validate_sample_data now reported using SQLite's own wording, and evidence-relative source paths recorded for directory and single-file inputs.

Full Changelog: v2026.4.0...v2026.4.1

v2026.4.0

RLEAPP v2026.4.0

• Forensic input expansion: raw disk images and E01 acquisitions now readable directly via a new -t raw flag, with qnxprobe re-vendored to add F2FS filesystem support and fix a NAT copy-selection bug.
• GUI responsiveness fix: artifact crunching now runs on a worker thread so the interface no longer freezes during processing, with a follow-up fix resetting stdout and guarding the close button.
• Synchronoss enhancements: workbook-form DV access log now parsed, and quarantined CyberTip media surfaced for examiner review.
• Data-quality and reporting fixes: date/datetime values now bound as text in SQLite writers, Tasks.json parsing now keeps tasks from every file (not just one) and reads note bodies regardless of output folder naming, and evidence-relative paths shown consistently in the processed files log.

Full Changelog: v2026.3.1...v2026.4.0

v2026.3.1

RLEAPP v2026.3.1

• New parser: Roblox law enforcement return artifacts.
• Timestamp accuracy fixes: corrected Unix timestamp conversion for pre-1970/pre-2001 values, deprecated utcfromtimestamp replaced in Chrome, and plist date helpers made compatible with Python 3.10.
• Source-path and reporting integrity: real device paths now returned as source_path instead of prose, a new check flags local filesystem paths leaking into report output, only the image file name recorded in case files, and case-variant evidence files preserved when the report volume folds case.
• Conversation artifact columns now ordered by their declared roles for consistency across reports.

New Contributors

• @forest-savage1234 made their first contribution in #430

Full Changelog: v2026.3.0...v2026.3.1

v2026.3.0

RLEAPP v2026.3.0

• New parser: Fritz!Box Supportdata, expanding RLEAPP's returns/legal-data coverage.
• Cross-version schema resilience: new null_absent_columns() helper tolerates missing columns across schema versions, with SQLite now naming the specific missing column when it happens.
• Security and stability hardening: HTML report injection fixes (escaped evidence media names, removed remote destinations, new CI guard), a MemoryError fix during HTML report generation, hardened zip extraction against Windows-incompatible member names, and a fix for concurrent runs corrupting history.json.
• GUI and reporting polish: Select All/Deselect All now act on the filtered list, restored module checkbox indicators on Windows, fixed macOS checkbox color inconsistencies, and additional run information included in LAVA output.
• Expanded CI coverage: runtime contract now runs across every supported Python version and entry point, a diff-aware pylint check, sample_data validation ported from DLEAPP, Windows import smoke tests, and manual PyInstaller test builds (including an unblocked Windows ARM64 build).

Full Changelog: v2026.2.0...v2026.3.0

v2026.2.0

RLEAPP v2026.2.0

• Massive LAVA migration achieving 100% coverage: nearly the entire codebase converted to the @artifact_processor decorator, spanning Instagram Archive/Ads, Google Takeout (Chrome, location history, mail, profile, chat), Facebook-Instagram Returns, Snapchat Returns/Archive, Discord, TikTok Returns and JSON export (40 artifacts), Google Returns, iCloud Returns, Pinger, Kik, Cash App Returns, Twitter, Chase, Coinbase, Netflix, Gab, Reddit, and Synchronoss/Verizon Cloud (new, 9 artifacts).
• New parsers: Facebook Messenger, ChatGPT (data export + user info), MeWe (10 artifacts), Omega Chat, and a Synchronoss/Verizon Cloud legal return parser.
• Snapchat overhaul: CSV artifacts now mapped by header name instead of position, fixed conversation parsing with new Conversation List/My AI Conversations/Call Logs artifacts, added conversation view with direction columns, and improved media linking for Chat History.
• Visual identity and reporting: migration to native Tabler icons, updated HTML report sidebar colors, extraction-relative source paths reported project-wide, and a security fix escaping evidence in HTML report cells.
• Platform fixes: resolved a Python 3.10 datetime.UTC import crash, custom output folder naming support, and cleanup of remaining legacy artifact references to finalize the LAVA transition. Now works on Python from 3.10 to 3.14.

New Contributors

• @prosch88 made their first contribution in #270
• @JamieSharpe made their first contribution in #272

Full Changelog: v2.2.0...v2026.2.0

v2.2.0

RLEAPP v2.2.0

• New features: LAVA output support
• GUI updated, media file lookup speed (~20x faster), JPEG XL and DDS image type matcher added
• New modules: Twitter, Snapchat conversations, Kik parser
• Modules updated: takeoutSemanticLocationHistory, add support for TikTok Archive JSON
• Fix file timestamps preservation issue

What's Changed

• RLEAPP v2.0.0 - Lava output support & iLEAPP improvements by @Johann-PLW in #241
• Adding new icon and logo to GUI by @Johann-PLW in #242
• Update README.md by @stark4n6 in #243
• Update assets by @Johann-PLW in #244
• Update ilapfuncs.py by @abrignoni in #245
• Update takeoutSemanticLocationHistory.py by @stark4n6 in #246
• Update takeoutSemanticLocationHistory by @stark4n6 in #247
• Updated for LAVA with media-manager by @Johann-PLW in #249
• Update media manager and add Agency Logo by @Johann-PLW in #251
• Twitter Returns by @abrignoni in #252
• Update twitterReturns.py by @abrignoni in #253
• Add support for TikTok Archive JSONs by @Jadoo4QFan in #250
• Create frameCounter.py by @abrignoni in #256
• Revert "Create frameCounter.py" by @abrignoni in #257
• Snapchat conversations from returns by @abrignoni in #258
• Update README.md by @derekeiri in #260
• Kik parser by @OneSixForensics in #263
• Fix file timestamps preservation issue by @Johann-PLW in #266
• Update filetype package by @Johann-PLW in #267

New Contributors

• @Jadoo4QFan made their first contribution in #250
• @derekeiri made their first contribution in #260
• @OneSixForensics made their first contribution in #263

Full Changelog: v1.1.2...v2.2.0

v1.1.2

What's Changed

• MeWe Returns Artifact by @TroySchnack in #229
• Discord Returns by @abrignoni in #230
• Updated Snapchat Returns by @abrignoni in #231
• Update Snapchat Returns by @abrignoni in #232
• Update Snapchat Returns by @abrignoni in #233
• Changed serialization to json in tl.db by @Johann-PLW in #234
• Updated ChatGPT by @theAtropos4n6 in #235
• Meta Parsers updated by @abrignoni in #237
• Update snapGeo.py by @ramseys1990 in #236
• Update to Discord returns by @abrignoni in #239

New Contributors

• @TroySchnack made their first contribution in #229

Full Changelog: v1.1.1...v1.1.2

v1.1.1

What's Changed

• Update rleappGUI.py - Fix checkbox color on Windows by @Johann-PLW in #217
• Discord pull data from URLs by @abrignoni in #218
• Update takeoutLocationHistorySettings.py by @MetadataForensics in #220
• Update takeoutRecords.py by @MetadataForensics in #221
• Discord - SW Online attachments by @thekatecain in #219
• Update gooReturnsrec.py by @MetadataForensics in #222
• Update takeoutLocationHistorySettings.py by @MetadataForensics in #223
• Update semanticLocbymonth.py by @MetadataForensics in #224
• Add local to UTC conversion function by @stark4n6 in #225
• Poogress bar changes. by @abrignoni in #226
• Update airdropNumbers.py by @abrignoni in #227

New Contributors

• @thekatecain made their first contribution in #219

Full Changelog: v1.1.0...v1.1.1