{"id":285,"date":"2025-08-28T22:24:05","date_gmt":"2025-08-29T05:24:05","guid":{"rendered":"https:\/\/forrestcook.net\/?p=285"},"modified":"2025-08-28T22:24:05","modified_gmt":"2025-08-29T05:24:05","slug":"ileapp-uleapp-weallleapp-for-theleapps","status":"publish","type":"post","link":"https:\/\/forrestcook.net\/?p=285","title":{"rendered":"iLEAPP, uLEAPP, weallLEAPP for theLEAPPs"},"content":{"rendered":"\n

Alexis Brignoni brought us the LEAPP projects; community driven, open source, up-to-date parsers for DFIR practitioners at a price we can all afford. If you haven’t heard of the LEAPPs by this point, I have absolutely no idea how you came across *this* blog… I won’t have much new to say about the tools, but I can’t exactly write up a “Resources” section to the site without mentioning them. <\/p>\n\n\n\n

I have far more experience running iLEAPP vs the other three, but the concept is the same. Community developed parsers aggregated into a format that is accessible and effective. Earlier on in the project, there was a bit of a learning curve for those new to command line as certain dependencies needed to be installed, which could get a bit tricky at times. I recall staring blankly at my screen when things refused to launch, only to find that I had a version of Python that was too new at the time to run the tool. You see, kids, when programs start to work *too well*, a new version of Python comes out that wrecks things in the name of progress!<\/p>\n\n\n\n

Now, however, the LEAPPs are available as executable releases, removing even that low bar from impeding new examiners as they dip their toes into open source utilities. Whenever I am fortunate enough to lead a class of examiners, these packaged executables find their way into the “goodies” folder. <\/p>\n\n\n\n

The way I imagine the LEAPP projects keeping up to date is akin to a large cargo ship vs a bunch of little tug boats. Some of the big tools, with their containers full of excellent paid-for goods, are slow to turn the ship when major updates start harshing the mellow around the DFIR office. The little tug-boats who can, the open source community, can be faster to react at times. I have found on several occasions apps that are better (or differently) supported than what is observed in some major tools. <\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

I would never tell someone to depend entirely on one tool for their work. The great thing about the LEAPP project is that it represents a large number of dedicated examiners, adding their individual expertise into one place to benefit the community as a whole. They are absolutely worth your time to check out.<\/p>\n\n\n\n

\n
\"\"<\/a><\/figure>\n\n\n\n
\"\"<\/a><\/figure>\n\n\n\n
\"\"<\/a><\/figure>\n\n\n\n
\"\"<\/a><\/figure>\n<\/blockquote>\n\n\n\n

<\/p>\n","protected":false},"excerpt":{"rendered":"

Alexis Brignoni brought us the LEAPP projects; community driven, open source, up-to-date parsers for DFIR practitioners at a price we can all afford. If you haven’t heard of the LEAPPs by this point, I have absolutely no idea how you came across *this* blog… I won’t have much new to say about the tools, but […]<\/p>\n","protected":false},"author":1,"featured_media":286,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[23],"tags":[8,9,25,24,13],"class_list":["post-285","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-resources","tag-coding","tag-dfir","tag-github","tag-open-source","tag-python"],"_links":{"self":[{"href":"https:\/\/forrestcook.net\/index.php?rest_route=\/wp\/v2\/posts\/285","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/forrestcook.net\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/forrestcook.net\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/forrestcook.net\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/forrestcook.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=285"}],"version-history":[{"count":1,"href":"https:\/\/forrestcook.net\/index.php?rest_route=\/wp\/v2\/posts\/285\/revisions"}],"predecessor-version":[{"id":292,"href":"https:\/\/forrestcook.net\/index.php?rest_route=\/wp\/v2\/posts\/285\/revisions\/292"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/forrestcook.net\/index.php?rest_route=\/wp\/v2\/media\/286"}],"wp:attachment":[{"href":"https:\/\/forrestcook.net\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=285"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/forrestcook.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=285"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/forrestcook.net\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=285"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}