Introduction

iLEAPP AI extends the capabilities of the standard iLEAPP tool with advanced artificial intelligence features that enhance digital forensic investigations. This document provides detailed information about these enhanced features and how they can be used to improve your forensic workflow.

Artifact-Specific Analyzers

iLEAPP AI includes specialized analyzers for different types of iOS artifacts. These analyzers use artificial intelligence to extract insights and patterns that might not be immediately apparent through manual analysis.

from ileapp_ai.analyzers import MessageAnalyzer
from ileapp_ai import LLMClient

llm_client = LLMClient(provider="openrouter", api_key="your_api_key")
message_analyzer = MessageAnalyzer(llm_client)

results = message_analyzer.analyze("/path/to/sms.db")
print(f"Found {len(results.conversations)} conversations")
print(f"Top topics: {results.top_topics}")
print(f"Overall sentiment: {results.overall_sentiment}")

from ileapp_ai.analyzers import AppUsageAnalyzer
from ileapp_ai import LLMClient

llm_client = LLMClient(provider="openrouter", api_key="your_api_key")
app_usage_analyzer = AppUsageAnalyzer(llm_client)

results = app_usage_analyzer.analyze("/path/to/app_usage.db")
print(f"Most used apps: {results.most_used_apps}")
print(f"Daily usage pattern: {results.daily_pattern}")
print(f"Unusual activity detected: {results.anomalies}")

from ileapp_ai.analyzers import iTunesMusicAnalyzer
from ileapp_ai import LLMClient

llm_client = LLMClient(provider="openrouter", api_key="your_api_key")
itunes_analyzer = iTunesMusicAnalyzer(llm_client)

results = itunes_analyzer.analyze("/path/to/itunes_library.db")
print(f"Top genres: {results.top_genres}")
print(f"Favorite artists: {results.favorite_artists}")
print(f"Listening schedule: {results.listening_schedule}")

from ileapp_ai.analyzers import ChromeHistoryAnalyzer
from ileapp_ai import LLMClient

llm_client = LLMClient(provider="openrouter", api_key="your_api_key")
chrome_analyzer = ChromeHistoryAnalyzer(llm_client)

results = chrome_analyzer.analyze("/path/to/chrome_history.db")
print(f"Top domains: {results.top_domains}")
print(f"Search interests: {results.search_interests}")
print(f"Browsing schedule: {results.browsing_schedule}")

Timeline Visualization

iLEAPP AI includes advanced timeline visualization capabilities that help investigators understand the chronological sequence of events across different artifact types.

from ileapp_ai.visualization import TimelineGenerator
from ileapp_ai import Analyzer, LLMClient

llm_client = LLMClient(provider="openrouter", api_key="your_api_key")
analyzer = Analyzer(llm_client)

# Analyze multiple artifacts
message_results = analyzer.analyze_artifact("/path/to/sms.db", "messages")
app_results = analyzer.analyze_artifact("/path/to/app_usage.db", "app_usage")
browser_results = analyzer.analyze_artifact("/path/to/chrome_history.db", "browser_history")

# Combine events from all artifacts
all_events = message_results.events + app_results.events + browser_results.events

# Generate timeline
timeline_generator = TimelineGenerator()
timeline = timeline_generator.generate_timeline(
    events=all_events,
    output_path="/path/to/output/timeline.html"
)

print(f"Timeline generated at: {timeline.path}")

Automated Report Generation

iLEAPP AI includes advanced report generation capabilities that create comprehensive forensic reports from analysis results.

from ileapp_ai import Analyzer, LLMClient
from ileapp_ai.reporting import ReportGenerator

llm_client = LLMClient(provider="openrouter", api_key="your_api_key")
analyzer = Analyzer(llm_client)

# Analyze case with multiple artifacts
case_results = analyzer.analyze_case(
    case_path="/path/to/case_directory",
    artifacts=["messages", "app_usage", "browser_history"],
    analysis_depth="comprehensive"
)

# Generate report
report_generator = ReportGenerator()
report = report_generator.generate_report(
    analysis_results=case_results,
    output_format="pdf",
    output_path="/path/to/output/report.pdf",
    options={
        "include_executive_summary": True,
        "include_visualizations": True,
        "include_raw_data": False,
        "include_chain_of_custody": True
    }
)

print(f"Report generated at: {report.path}")

Appendices Generation

iLEAPP AI can automatically generate comprehensive appendices that provide additional context and reference materials for forensic reports.

from ileapp_ai.reporting import AppendicesGenerator
from ileapp_ai import Analyzer, LLMClient

llm_client = LLMClient(provider="openrouter", api_key="your_api_key")
analyzer = Analyzer(llm_client)

# Analyze case
case_results = analyzer.analyze_case(
    case_path="/path/to/case_directory",
    artifacts=["messages", "app_usage", "browser_history"]
)

# Generate appendices
appendices_generator = AppendicesGenerator()
appendices = appendices_generator.generate_appendices(
    analysis_results=case_results,
    output_path="/path/to/output/appendices.pdf",
    options={
        "include_statistics": True,
        "include_entity_indexes": True,
        "include_timeline_references": True,
        "include_technical_details": True,
        "include_glossary": True,
        "include_methodology": True
    }
)

print(f"Appendices generated at: {appendices.path}")

Security Features

iLEAPP AI includes advanced security features to maintain forensic integrity and protect sensitive data.

from ileapp_ai.security import ChainOfCustody, enable_audit_logging, encrypt_data
from ileapp_ai import Analyzer, LLMClient

# Enable audit logging
enable_audit_logging(log_path="/path/to/audit.log")

# Initialize chain of custody
chain_of_custody = ChainOfCustody(
    case_id="CASE-2025-001",
    investigator="John Doe"
)

# Initialize client with local model for sensitive data
llm_client = LLMClient(
    provider="local",
    model="llama-3-70b"
)

# Initialize analyzer
analyzer = Analyzer(llm_client)

# Log the analysis action
action_id = chain_of_custody.log_action(
    action="Analyzing messages",
    artifact="/path/to/sms.db"
)

# Encrypt sensitive data
encrypted_path = encrypt_data(
    file_path="/path/to/sms.db",
    password="secure_password",
    output_path="/path/to/encrypted_sms.db"
)

# Perform the analysis
results = analyzer.analyze_artifact(
    artifact_path=encrypted_path,
    artifact_type="messages",
    options={"encrypted": True, "password": "secure_password"}
)

# Log the completion of the analysis
chain_of_custody.log_action(
    action="Analysis completed",
    artifact="/path/to/sms.db",
    details={"action_id": action_id, "findings": len(results.findings)}
)

User Dashboard

iLEAPP AI includes a user dashboard for tracking analysis progress and managing forensic cases.

from ileapp_ai.dashboard import Dashboard

# Initialize the dashboard
dashboard = Dashboard(port=8080)

# Start the dashboard server
dashboard.start()

print(f"Dashboard running at: http://localhost:8080")

# The dashboard can also be accessed programmatically
dashboard.add_case(
    case_id="CASE-2025-001",
    case_name="John Doe Investigation",
    description="Investigation of suspicious activity on John Doe's iPhone"
)

dashboard.add_analysis_task(
    case_id="CASE-2025-001",
    task_name="Message Analysis",
    artifact_path="/path/to/sms.db",
    artifact_type="messages",
    analysis_depth="comprehensive"
)

# Check task status
status = dashboard.get_task_status(
    case_id="CASE-2025-001",
    task_name="Message Analysis"
)

print(f"Task status: {status}")

Integration Options

iLEAPP AI supports multiple integration options to fit different forensic workflows and requirements.

# Using different LLM providers
from ileapp_ai import LLMClient, Analyzer

# OpenRouter
openrouter_client = LLMClient(
    provider="openrouter",
    api_key="your_openrouter_api_key",
    model="anthropic/claude-3-opus-20240229"
)

# Anthropic
anthropic_client = LLMClient(
    provider="anthropic",
    api_key="your_anthropic_api_key",
    model="claude-3-opus-20240229"
)

# OpenAI
openai_client = LLMClient(
    provider="openai",
    api_key="your_openai_api_key",
    model="gpt-4"
)

# Local model
local_client = LLMClient(
    provider="local",
    model="llama-3-70b"
)

# Create analyzers with different clients
openrouter_analyzer = Analyzer(openrouter_client)
anthropic_analyzer = Analyzer(anthropic_client)
openai_analyzer = Analyzer(openai_client)
local_analyzer = Analyzer(local_client)