Introduction

This guide provides detailed instructions for integrating iLEAPP AI with your existing digital forensics workflow. Whether you're looking to enhance the standard iLEAPP tool, integrate with other forensic platforms, or build custom solutions using our API, this guide will help you get started.

Integration Options

iLEAPP AI offers several integration options to suit different needs:

1. Direct iLEAPP Integration: Enhance the standard iLEAPP tool with AI capabilities through our GUI and CLI integrations.
2. Standalone Mode: Use iLEAPP AI as a standalone tool to analyze artifacts extracted by other forensic tools.
3. API Integration: Integrate iLEAPP AI's capabilities into your own forensic tools or workflows using our comprehensive API.
4. Custom Analyzers: Extend iLEAPP AI with your own specialized analyzers for specific artifact types or investigation needs.

Choose the integration option that best fits your workflow and requirements.

iLEAPP Integration

iLEAPP AI seamlessly integrates with the standard iLEAPP tool, enhancing its capabilities with AI-powered analysis. This integration is available for both the GUI and CLI versions of iLEAPP.

GUI Integration

The GUI integration adds an "AI Analysis" tab to the standard iLEAPP interface, allowing you to apply AI analysis to extracted artifacts with just a few clicks.

Installation

To install the GUI integration:

cd /path/to/ileapp
pip install ileapp-ai
python -m ileapp_ai.setup --gui

This will install the necessary components and update the iLEAPP GUI to include AI capabilities.

Usage

To use the AI capabilities in the iLEAPP GUI:

1. Launch iLEAPP as usual.
2. Process an iOS extraction as you normally would.
3. After processing is complete, navigate to the new "AI Analysis" tab.
4. Select the artifacts you want to analyze with AI.
5. Choose your analysis options (depth, model, etc.).
6. Click "Run AI Analysis" to begin the analysis.
7. Once complete, you can view the AI-enhanced reports and insights.

CLI Integration

The CLI integration extends the standard iLEAPP command-line interface with additional options for AI analysis.

Installation

To install the CLI integration:

cd /path/to/ileapp
pip install ileapp-ai
python -m ileapp_ai.setup --cli

Usage

To use the AI capabilities from the command line:

python ileapp.py -i /path/to/extraction -o /path/to/output --ai-analyze --ai-provider openrouter --ai-key YOUR_API_KEY --ai-depth comprehensive

Available AI-specific command-line options:

• --ai-analyze: Enable AI analysis
• --ai-provider: LLM provider (openrouter, anthropic, openai, local)
• --ai-key: API key for the selected provider
• --ai-model: Specific model to use (optional)
• --ai-depth: Analysis depth (basic, standard, comprehensive)
• --ai-artifacts: Comma-separated list of artifacts to analyze (default: all)
• --ai-output: Output format for AI reports (html, pdf, json)

You can also store your API key and default settings in a configuration file to avoid entering them each time:

python -m ileapp_ai.config --set-provider openrouter --set-key YOUR_API_KEY --set-depth comprehensive

Creating Custom Analyzers

iLEAPP AI allows you to create custom analyzers for specific artifact types or investigation needs. Custom analyzers extend the base Analyzer class and implement specialized analysis logic.

Basic Structure

A custom analyzer typically has the following structure:

from ileapp_ai import Analyzer

class CustomAnalyzer(Analyzer):
    """Custom analyzer for specific artifact type."""
    
    def __init__(self, llm_client, config=None):
        super().__init__(llm_client, config)
        # Initialize analyzer-specific properties
        
    def analyze(self, data, options=None):
        """Analyze the artifact data."""
        # Preprocess data if needed
        # Send data to LLM for analysis
        # Process and structure the results
        # Return analysis results
        
    def generate_report(self, results, output_format="html", output_path=None):
        """Generate a specialized report for this analyzer."""
        # Generate a report based on the analysis results
        # Return report information

Example: Custom Location Analyzer

Here's an example of a custom analyzer for iOS location data:

from ileapp_ai import Analyzer
from ileapp_ai.processors import get_processor

class LocationAnalyzer(Analyzer):
    """Analyzer for iOS location data with geofencing capabilities."""
    
    def __init__(self, llm_client, config=None):
        super().__init__(llm_client, config)
        self.geofences = config.get('geofences', []) if config else []
        
    def analyze(self, data_path, options=None):
        # Get the appropriate processor for location data
        processor = get_processor("location")
        location_data = processor.process(data_path)
        
        # Apply geofencing if configured
        if self.geofences:
            location_data = self._apply_geofencing(location_data)
        
        # Prepare prompt for the LLM
        prompt = """
        Analyze this iOS location data to identify:
        1. Frequently visited locations
        2. Travel patterns and routines
        3. Anomalous location activity
        4. Timeline of movements
        
        For each insight, provide the supporting evidence from the data.
        """
        
        # Send to LLM for analysis
        analysis_result = self.llm_client.analyze_structured_data(
            data=location_data,
            prompt=prompt,
            options=options
        )
        
        # Process and structure the results
        return self._structure_results(analysis_result, location_data)
    
    def _apply_geofencing(self, location_data):
        """Apply geofencing to the location data."""
        # Implementation of geofencing logic
        # ...
        return filtered_data
    
    def _structure_results(self, analysis_result, raw_data):
        """Structure the analysis results."""
        # Implementation of result structuring
        # ...
        return structured_results

Registering Custom Analyzers

To make your custom analyzer available in iLEAPP AI, you need to register it:

from ileapp_ai.registry import register_analyzer

# Register your custom analyzer
register_analyzer("location", LocationAnalyzer)

Once registered, your custom analyzer can be used like any built-in analyzer:

from ileapp_ai import LLMClient
from your_module import LocationAnalyzer

llm_client = LLMClient(provider="openrouter", api_key="your_api_key")
location_analyzer = LocationAnalyzer(llm_client, config={"geofences": [...]})
results = location_analyzer.analyze("/path/to/location_data")

Custom Report Templates

iLEAPP AI uses Jinja2 templates for report generation. You can create custom report templates to customize the appearance and content of your reports.

Template Structure

Report templates are HTML files with Jinja2 template syntax. Here's a basic example:

<!DOCTYPE html>
<html>
<head>
    <title>{{ report.title }}</title>
    <style>
        /* Your custom CSS styles */
    </style>
</head>
<body>
    <header>
        <h1>{{ report.title }}</h1>
        <p>Generated on: {{ report.timestamp }}</p>
        <p>Case ID: {{ report.case_id }}</p>
    </header>
    
    <section class="summary">
        <h2>Executive Summary</h2>
        <p>{{ report.summary }}</p>
    </section>
    
    <section class="artifacts">
        <h2>Analyzed Artifacts</h2>
        {% for artifact in report.artifacts %}
        <div class="artifact">
            <h3>{{ artifact.name }}</h3>
            <p>{{ artifact.description }}</p>
            
            <h4>Key Findings</h4>
            <ul>
                {% for finding in artifact.findings %}
                <li>{{ finding }}</li>
                {% endfor %}
            </ul>
            
            {% if artifact.visualizations %}
            <h4>Visualizations</h4>
            {% for viz in artifact.visualizations %}
            <div class="visualization">
                <img src="{{ viz.path }}" alt="{{ viz.description }}">
                <p>{{ viz.description }}</p>
            </div>
            {% endfor %}
            {% endif %}
        </div>
        {% endfor %}
    </section>
    
    <section class="timeline">
        <h2>Event Timeline</h2>
        {% if report.timeline %}
        <div class="timeline-container">
            {% for event in report.timeline %}
            <div class="timeline-event">
                <div class="timeline-date">{{ event.timestamp }}</div>
                <div class="timeline-content">
                    <h4>{{ event.title }}</h4>
                    <p>{{ event.description }}</p>
                </div>
            </div>
            {% endfor %}
        </div>
        {% else %}
        <p>No timeline data available.</p>
        {% endif %}
    </section>
    
    <footer>
        <p>Generated by iLEAPP AI v{{ report.version }}</p>
    </footer>
</body>
</html>

Using Custom Templates

To use a custom template for report generation:

from ileapp_ai import Analyzer, LLMClient
from ileapp_ai.reporting import ReportGenerator

llm_client = LLMClient(provider="openrouter", api_key="your_api_key")
analyzer = Analyzer(llm_client)
results = analyzer.analyze_artifact("/path/to/sms.db", "messages")

report_generator = ReportGenerator()
report = report_generator.generate_report(
    analysis_results=results,
    template="/path/to/your/custom_template.html",
    output_format="html",
    output_path="/path/to/output/report.html"
)

API Integration

iLEAPP AI provides a comprehensive API that you can integrate into your own forensic tools or workflows. This section provides examples of common API integration scenarios.

Basic API Usage

Here's a basic example of using the iLEAPP AI API in a Python script:

from ileapp_ai import Analyzer, LLMClient
from ileapp_ai.analyzers import MessageAnalyzer
from ileapp_ai.visualization import TimelineGenerator

# Initialize the LLM client
llm_client = LLMClient(
    provider="openrouter",
    api_key="your_api_key",
    model="anthropic/claude-3-opus-20240229"
)

# Create an analyzer instance
analyzer = Analyzer(llm_client)

# Analyze iOS messages
message_results = analyzer.analyze_artifact(
    artifact_path="/path/to/sms.db",
    artifact_type="messages",
    analysis_depth="comprehensive"
)

# Generate a timeline of events
timeline_generator = TimelineGenerator()
timeline = timeline_generator.generate_timeline(
    events=message_results.events,
    output_path="/path/to/output/timeline.html"
)

# Generate a report
report = analyzer.generate_report(
    analysis_result=message_results,
    output_format="pdf",
    output_path="/path/to/output/report.pdf"
)

print(f"Analysis complete. Report saved to: {report.path}")
print(f"Timeline saved to: {timeline.path}")

Integration with Other Forensic Tools

You can integrate iLEAPP AI with other forensic tools by using their output as input for iLEAPP AI analysis:

import subprocess
from ileapp_ai import Analyzer, LLMClient

# Run another forensic tool to extract data
subprocess.run([
    "other_forensic_tool",
    "--extract",
    "/path/to/ios_backup",
    "--output",
    "/path/to/extraction"
])

# Initialize iLEAPP AI
llm_client = LLMClient(provider="openrouter", api_key="your_api_key")
analyzer = Analyzer(llm_client)

# Analyze the extracted data
results = analyzer.analyze_case(
    case_path="/path/to/extraction",
    artifacts=["messages", "app_usage", "browser_history"],
    analysis_depth="comprehensive"
)

# Generate a report
report = analyzer.generate_report(results)
print(f"Analysis complete. Report saved to: {report.path}")

Web Application Integration

Here's an example of integrating iLEAPP AI into a Flask web application:

from flask import Flask, request, render_template, jsonify
from ileapp_ai import Analyzer, LLMClient
import os

app = Flask(__name__)
upload_folder = "/path/to/uploads"
output_folder = "/path/to/outputs"

# Initialize iLEAPP AI
llm_client = LLMClient(provider="openrouter", api_key="your_api_key")
analyzer = Analyzer(llm_client)

@app.route('/')
def index():
    return render_template('index.html')

@app.route('/upload', methods=['POST'])
def upload_file():
    if 'file' not in request.files:
        return jsonify({"error": "No file part"}), 400
    
    file = request.files['file']
    if file.filename == '':
        return jsonify({"error": "No selected file"}), 400
    
    # Save the uploaded file
    file_path = os.path.join(upload_folder, file.filename)
    file.save(file_path)
    
    # Get analysis options from the form
    artifact_type = request.form.get('artifact_type', 'messages')
    analysis_depth = request.form.get('analysis_depth', 'standard')
    
    # Analyze the artifact
    try:
        results = analyzer.analyze_artifact(
            artifact_path=file_path,
            artifact_type=artifact_type,
            analysis_depth=analysis_depth
        )
        
        # Generate a report
        report = analyzer.generate_report(
            analysis_result=results,
            output_format="html",
            output_path=os.path.join(output_folder, f"{file.filename}_report.html")
        )
        
        return jsonify({
            "success": True,
            "report_url": f"/reports/{os.path.basename(report.path)}",
            "summary": results.summary
        })
    except Exception as e:
        return jsonify({"error": str(e)}), 500

@app.route('/reports/')
def get_report(filename):
    return send_from_directory(output_folder, filename)

if __name__ == '__main__':
    app.run(debug=True)

Security Considerations

When integrating iLEAPP AI into your forensic workflow, consider the following security best practices:

Data Privacy

• Use local LLM models for sensitive investigations to avoid sending data to external APIs.
• If using external APIs, ensure data is properly anonymized or redacted before sending.
• Be aware of the data retention policies of your chosen LLM provider.

Chain of Custody

• Use the built-in ChainOfCustody class to track all actions performed on forensic data.
• Enable audit logging to maintain a record of all analysis activities.
• Include hash verification in your workflow to ensure data integrity.

API Key Security

• Store API keys securely, preferably in environment variables or a secure credential store.
• Never hardcode API keys in your scripts or applications.
• Use API keys with appropriate permission scopes and restrictions.

Example: Secure API Key Storage

import os
from ileapp_ai import LLMClient

# Get API key from environment variable
api_key = os.environ.get('OPENROUTER_API_KEY')
if not api_key:
    raise ValueError("API key not found in environment variables")

# Initialize client with the API key
llm_client = LLMClient(provider="openrouter", api_key=api_key)

Example: Enabling Audit Logging

from ileapp_ai import Analyzer, LLMClient
from ileapp_ai.security import ChainOfCustody, enable_audit_logging

# Enable audit logging
enable_audit_logging(log_path="/path/to/audit.log")

# Initialize chain of custody
chain_of_custody = ChainOfCustody(
    case_id="CASE-2025-001",
    investigator="John Doe"
)

# Initialize client and analyzer
llm_client = LLMClient(provider="openrouter", api_key="your_api_key")
analyzer = Analyzer(llm_client)

# Log the analysis action
action_id = chain_of_custody.log_action(
    action="Analyzing messages",
    artifact="/path/to/sms.db"
)

# Perform the analysis
results = analyzer.analyze_artifact(
    artifact_path="/path/to/sms.db",
    artifact_type="messages"
)

# Log the completion of the analysis
chain_of_custody.log_action(
    action="Analysis completed",
    artifact="/path/to/sms.db",
    details={"action_id": action_id, "findings": len(results.findings)}
)

Troubleshooting

This section covers common issues you might encounter when integrating iLEAPP AI and how to resolve them.

API Connection Issues

If you're having trouble connecting to the LLM provider's API:

• Verify that your API key is correct and has not expired.
• Check your internet connection and firewall settings.
• Ensure the LLM provider's services are operational.
• Try using a different provider or model to isolate the issue.

Integration Errors

If you encounter errors when integrating with iLEAPP:

• Ensure you're using compatible versions of iLEAPP and iLEAPP AI.
• Check that all required dependencies are installed.
• Verify that the integration setup was completed successfully.
• Check the iLEAPP log files for specific error messages.

Analysis Quality Issues

If the AI analysis results are not meeting your expectations:

• Try using a more advanced model (e.g., Claude 3 Opus instead of Claude 3 Sonnet).
• Increase the analysis depth to "comprehensive" for more detailed results.
• Check that the artifact data is in the expected format and contains sufficient information.
• Consider creating a custom analyzer with more specific prompts for your use case.

Performance Issues

If you're experiencing slow performance:

• For large datasets, consider processing artifacts in smaller batches.
• Use a local LLM model for faster processing if API latency is an issue.
• Optimize your custom code to reduce unnecessary processing or API calls.
• Check system resources (CPU, memory, disk I/O) for bottlenecks.

Getting Help

If you continue to experience issues:

• Check the iLEAPP GitHub repository for known issues and solutions.
• Join the iLEAPP community forums for peer support.
• Contact our support team at support@ileapp-ai.com.