Let's now look at iLEAPP.
iLEAPP is going to do very similar things as Apollo,
but it additionally parses plist files.
Apollo only parses You will also find
that the way Sarah has the open source license in Apollo,
it will do things that iLEAPP can't, because iLEAPP leap is
now inside of Autopsy, and Autopsy is also
sold to the government.
So because of that, you will see some differences.
Alexis is constantly updating iLEAPP.
I recommend you always download the latest version.
We are going to go into your VM, and over here
on their mobile device tools, you're going to see iLEAPP GUI.
Just click on that if you don't want to run it
from the command line.
The GUI is going to appear, and it's going
to say, what do you want to do?
We're going to browse out to that TAR file.
And then where do we want to save it?
I'm going to create a directory in Cases called iLEAPP.
And I'm going to say Go.
Process All.
Everything on the left-hand side is
going to tell you what it can process.
I'm going to let that process, but I'm
going to show you what the output looks like.
So if we go into script results, iLEAPP results,
you're going to see a lot of directories and a lot of HTMLs.
If you go to index, HTML, that is the primary report.
Now, in here, as you click on the left-hand side,
it will turn blue and you can actually
see the information that you're looking at on the right.
So address book, your TCC.DB, different calendar items,
note sharing, connected devices.
So here, we can see the different laptops
that the user is connected to.
We have maps, we have build information, snapshots,
Apple Maps, contacts, media library,
mobile activation logs.
All of these things are tracked in here.
It is really helpful to look at this information.
We have network information.
Here, we see Wine Love.
It was added by Heather Mahalik's iPhone.
The date it was added to the device.
So definitely leverage these free,
open source tools to look at this information.
And processing shouldn't take extremely long,
but it will take a little bit of time for iLEAPP.