• ran on Python 3.8.2 on macOS 10.15.4
• iLEAPP commit d53c9fbd8b57f0ad72361682e96605cabd991a61
• image from https://champdfa-ccsc-sp20.ctfd.io
  • direct download https://drive.google.com/file/d/1-Uy4RZIGsLzlulir4fLxTNG7IeoDiCvh

$ python ileapp.py /path/to/image
Procesing started. Please wait. This may take a few minutes...
--------------------------------------------------------------------------------------
iLEAPP: iOS Logs, Events, and Preferences Parser
Objective: Triage iOS Full System Extractions.
By: Agam Dua | @loopbackdev | loopback.dev
By: Alexis Brignoni | @AlexisBrignoni | abrignoni.com
Artifact categories to parse: 41
File/Directory selected: /path/to/image
--------------------------------------------------------------------------------------
Mobile Installation Logs function executing
Logs processed: 1
Lines processed: 595
Total apps: 133
Total installed apps: 123
Total uninstalled apps: 10
Total historical app reports: 133
Total system state events: 2
Mobile Installation Logs function completed.
Iconstate function executing
Screens: 2
Icons in bottom bar: 4
Iconstate function completed.
Webclips function executing
Webclips found: 1
Webclips function completed
Lastbuild function executing
iOS version is: 9.3.5
Lastbuild function completed.
iOSNotifications 11 function executing
Total notification directories processed:0
Total exported bplists from notifications:0
No notifications located.
iOS 11 Notifications function completed.
No files found for iOSNotifications12 -> *private/var/mobile/Library/UserNotifications/.
Cellular Wireless files function executing
Cellular Wireless files function completed
Incepted bplist extractions in KnowledgeC.db executing
Unsupported version9.3.5
ApplicationState.db queries executing
Installed app GUIDs and app locations processed: 42
ApplicationState.db queries completed.
Connected devices function executing
Data being interpreted for FRPD is of type: <class 'bytes'>
Found magic bytes in iTunes Prefs FRPD... Finding Usernames and Desktop names now
test - DESKTOP-T00FUVO
test - DESKTOP-T00FUVO
test - DESKTOP-T00FUVO
Connected devices function completed.
Traceback (most recent call last):
  File "ileapp.py", line 37, in <module>
    extract_and_process(image_fpath, extracttype, tosearch, log)
  File "/iLEAPP/extraction.py", line 113, in extract_and_process
    process_file_found(filefound, key, val, log, gui_window)
  File "/iLEAPP/extraction.py", line 169, in process_file_found
    globals()[key](filefound)
  File "/iLEAPP/contrib/call_history/main.py", line 12, in calhist
    cursor.execute(
sqlite3.OperationalError: no such column: ZSERVICE_PROVIDER

I receiving the following error when attempting to analyze a GrayKey full filesystem extraction with the latest commits. I ran an analysis a couple of days ago with a previous version and it completed without error. Here's the traceback:

Traceback (most recent call last):
  File "ileappGUI.py", line 115, in <module>
    extract_and_process(pathto, extracttype, tosearch, log, gui_window=window)
  File "[redacted]\extraction.py", line 71, in extract_and_process
    process_file_found(filefound, key, val, log, gui_window)
  File "[redacted]\extraction.py", line 127, in process_file_found
    globals()[key](filefound)
  File "[redacted]\ilapfuncs.py", line 1124, in mib
    file = open(filename, "r", encoding="utf8")
FileNotFoundError: [Errno 2] No such file or directory: '\\private\\var\\installd\\Library\\Logs\\MobileInstallation\\moile_installation.log.0'

Not sure if something changed but it shuts down the GUI and stops parsing.

Hi Alexis, amazing work!

I cant get the info because it says:

Extraction/Path selected: /Users/j*****/Desktop/1175b82c51eb8e0c31d4e3b2ee6748f96a0d6313

No files found for lastbuild -> *LastBuildInfo.plist

No files found for accs -> **/Accounts3.sqlite

No files found for tileAppDisc -> /private/var/mobile/Containers/Shared/AppGroup//com.thetileapp.tile-DiscoveredTileDB.sqlite*

No files found for tileAppNetDb -> /private/var/mobile/Containers/Shared/AppGroup//com.thetileapp.tile-TileNetworkDB.sqlite*

No files found for confaccts -> **/com.apple.accounts.exists.plist

No files found for addressbook -> */AddressBook.sqlitedb

No files found for airtags -> */Caches/com.apple.findmy.fmipcore/Items.data

No files found for alarms -> *private/var/mobile/Library/Preferences/com.apple.mobiletimerd.plist

No files found for alltrails -> */Documents/AllTrails.sqlite

No files found for appconduit -> */AppConduit.log.

No files found for tcc -> TCC.db

No files found for applepodcasts -> */MTLibrary.sqlite

No files found for applewalletpasses -> */nanopasses.sqlite3

No files found for applewalletpasses -> **/Cards/*.pkpass/pass.json

No files found for applewallettransactions -> **/passes23.sqlite

No files found for applewalletcards -> /private/var/mobile/Containers/Data/Application//Library/Caches/com.apple.Passbook/Cache.db*

No files found for ooklaSpeedtestData -> */speedtest.sqlite

No files found for biomeAppinstall -> /Biome/streams/restricted/_DKEvent.App.Install/local/

No files found for biomeBluetooth -> /Biome/streams/restricted/Device.Wireless.Bluetooth/local/

No files found for biomeBattperc -> /Biome/streams/restricted/_DKEvent.Device.BatteryPercentage/local/

No files found for biomeDevplugin -> /Biome/streams/restricted/_DKEvent.Device.IsPluggedIn/local/

No files found for biomeUseractmeta -> /Biome/streams/restricted/UserActivityMetadata/local

No files found for biomeCarplayisconnected -> /Biome/streams/restricted/_DKEvent.Carplay.IsConnected/local/

No files found for biomeSafari -> /Biome/streams/restricted/_DKEvent.Safari.History/local/

No files found for biomeBacklight -> /Biome/streams/public/Backlight/local/

No files found for biomeWifi -> /Biome/streams/restricted/_DKEvent.Wifi.Connection/local/

No files found for biomeNotificationsPub -> /biome/streams/public/Notification/local/

No files found for biomeHardware -> /Biome/streams/restricted/OSAnalytics.Hardware.Reliability/local/

No files found for biomeLocationactivity -> /Biome/streams/restricted/_DKEvent.App.LocationActivity/local/

No files found for biomeInFocus -> /Biome/streams/restricted/_DKEvent.App.InFocus/local/

No files found for biomeNowplaying -> /Biome/streams/public/NowPlaying/local/

No files found for biomeNotes -> /Biome/streams/restricted/NotesContent/local/

No files found for bluetooth -> */com.apple.MobileBluetooth.

No files found for bumble -> */Library/Caches/Chat.sqlite

No files found for bumble -> */Documents/yap-database.sqlite

No files found for calendarall -> **/Calendar.sqlitedb

No files found for callhistory -> */CallHistory.storedata

No files found for recentApphistory -> */com.apple.CarPlayApp.plist

No files found for cashapp -> **private/var/mobile/Containers/Shared/AppGroup//CCEntitySync-api.squareup.com.sqlite

No files found for cashapp -> **private/var/mobile/Containers/Shared/AppGroup//CCEntitySync-internal.cashappapi.com.sqlite

No files found for celwireless -> wireless/Library/Preferences/com.apple.

No files found for cloudkitparticipants -> NoteStore.sqlite

No files found for cloudkitsharing -> NoteStore.sqlite

No files found for condev -> **/iTunes_Control/iTunes/iTunesPrefs

No files found for controlcenter -> **private/var/mobile/Library/ControlCenter/ModuleConfiguration.plist

No files found for dhcphp -> */private/var/db/dhcpd_leases

No files found for dhcpl -> */private/var/db/dhcpclient/leases/en

No files found for discordacct -> /var/mobile/Containers/Data/Application//Documents/mmkv/mmkv.default

No files found for discordjson -> /com.hammerandchisel.discord/fsCachedData/

No files found for discordmanifest -> /private/var/mobile/Containers/Data/Application//Documents/RCTAsyncLocalStorage_V1/manifest.json

No files found for draftmessage -> /SMS/Drafts//composition.plist

No files found for facebookmessenger -> **/lightspeed-.db

No files found for filesappsclient -> private/var/mobile/Library/Application Support/CloudDocs/session/db/client.db

No files found for filesAppsm -> private/var/mobile/Containers/Shared/AppGroup//smartfolders.db*

No files found for filesappsdb -> private/var/mobile/Library/Application Support/CloudDocs/session/db/server.db

No files found for geodapplications -> */AP.db

No files found for geodmaptiles -> */MapTiles.sqlitedb

No files found for geodpdplacecache -> */PDPlaceCache.db

No files found for mapsSync -> /MapsSync_0.0.1

No files found for gmail -> */private/var/mobile/Containers/Data/Application//Library/Application Support/data//searchsqlitedb

No files found for gmail -> */private/var/mobile/Containers/Data/Application//Library/Application Support/data//sqlitedb

No files found for googleduo -> /Application Support/DataStore

No files found for googleduo -> /Application Support/ClipsCache/.png

No files found for health -> /Health/healthdb_secure.sqlite

No files found for health -> /Health/healthdb.sqlite

No files found for quickLook -> /Quick Look/cloudthumbnails.db

No files found for icloudmeta -> */iclouddrive/Metadata.txt

No files found for aicloudphotometa -> */cloudphotolibrary/Metadata.txt

No files found for icloudSharedalbums -> /private/var/mobile/Media/PhotoData/PhotoCloudSharingData/

No files found for imoHD_Chat -> */IMODb2.sqlite

No files found for imoHD_Chat -> private/var/mobile/Containers/Data/Application//Library/Caches/videos/.webp

No files found for instagramThreads -> /mobile/Containers/Data/Application//Library/Application Support/DirectSQLiteDatabase/.db

No files found for appgrouplisting -> /Containers/Shared/AppGroup//.com.apple.mobile_container_manager.metadata.plist

No files found for appgrouplisting -> **/PluginKitPlugin/*.metadata.plist

No files found for applicationstate -> **/applicationState.db

No files found for applicationsnapshots -> */Library/Caches/Snapshots/

No files found for applicationsnapshots -> */SplashBoard/Snapshots/

No files found for appitunesmeta -> **/iTunesMetadata.plist

No files found for appitunesmeta -> **/BundleMetadata.plist

No files found for Intents -> /private/var/mobile/Library/Biome/streams/public/AppIntent/local/

No files found for Intents -> /AppIntent/local/

No files found for interactionCcontacts -> */interactionC.db

No files found for deviceactivator -> *private/var/mobile/Library/Logs/mobileactivationd/ucrt_oob_request.txt

No files found for mailprotect -> /private/var/mobile/Library/Mail/ Index

No files found for iconsScreen -> **/SpringBoard/IconState.plist

No files found for webClips -> WebClips/.webclip/*

No files found for keyboardLexicon -> /private/var/mobile/Library/Keyboard/-dynamic.lm/dynamic-lexicon.dat

No files found for keyboardAppUsage -> */private/var/mobile/Library/Keyboard/app_usage_database.plist

No files found for kijijiConversations -> */Library/Caches/conversation_cache

No files found for kikBplistmeta -> /mobile/Containers/Shared/AppGroup//cores/private//attachments/

No files found for kikLocaladmin -> /kik.sqlite

No files found for kikUsersgroups -> /kik.sqlite

No files found for kikPendingUploads -> /mobile/Containers/Shared/AppGroup//cores/private/*/chunked_upload_storage/pending_uploads

No files found for kikPendingUploads -> /mobile/Containers/Shared/AppGroup//cores/private//chunked_upload_storage/data_cache/

No files found for kikMessages -> */kik.sqlite

No files found for kikMessages -> /mobile/Containers/Shared/AppGroup//cores/private//content_manager/data_cache/

No files found for kikGroupadmins -> /kik.sqlite

No files found for locServicesconfig -> */Library/Preferences/com.apple.locationd.plist

No files found for locServicesconfig -> */Library/Caches/locationd/clients.plist

No files found for locServicesconfig -> */Library/Preferences/com.apple.routined.plist

No files found for tileApp -> private/var/mobile/Containers/Data/Application//Library/log/com.thetileapp.tile*

No files found for weatherAppLocations -> /private/var/mobile/Containers/Shared/AppGroup//Library/Preferences/group.com.apple.weather.plist

No files found for applemapsgroup -> **/Shared/AppGroup/*/Library/Preferences/group.com.apple.Maps.plist

No files found for cacheroutesgmap -> **/Library/Application Support/CachedRoutes/*.plist

No files found for tileAppDb -> private/var/mobile/Containers/Shared/AppGroup//com.thetileapp.tile-TileNetworkDB.sqlite*

No files found for applemapssearchhistory -> private/var/mobile/Containers/Data/Application//Library/Maps/GeoHistory.mapsdata

No files found for applemapssearchhistory -> */GeoHistory.mapsdata

No files found for applemapsapplication -> **/Data/Application/*/Library/Preferences/com.apple.Maps.plist

No files found for mediaLibrary -> **/Medialibrary.sqlitedb

No files found for medicalID -> */private/var/mobile/Library/MedicalID/MedicalIDData.archive

No files found for teams -> /var/mobile/Containers/Shared/AppGroup//SkypeSpacesDogfood//Skype.sqlite*

No files found for teams -> /var/mobile/Containers/Shared/AppGroup//SkypeSpacesDogfood/Downloads//Images/

No files found for teamsSegment -> /var/mobile/Containers/Data/Application//Library/DriveIQ/segments/current/.

No files found for mobileActivationLogs -> */mobileactivationd.log

No files found for mobileBackup -> */Preferences/com.apple.MobileBackup.plist

No files found for mobileContainerManager -> */containermanagerd.log.

No files found for mobileInstall -> */mobile_installation.log.

No files found for restoreLog -> **/private/var/mobile/MobileSoftwareUpdate/restore.log

No files found for notes -> /NoteStore.sqlite

No files found for notificationsXII -> private/var/mobile/Library/UserNotifications

No files found for notificationsDuet -> /DuetExpertCenter/streams/userNotificationEvents/local/

No files found for notificationsDuet -> /userNotificationEvents/local/

No files found for notificationsXI -> PushStore

No files found for reminders -> **/Reminders/Container_v1/Stores/.sqlite

No files found for safariFavicons -> /Containers/Data/Application//Library/Image Cache/Favicons/Favicons.db*

No files found for safariTabs -> */Safari/BrowserState.db

No files found for safariBookmarks -> */Safari/Bookmarks.db

No files found for safariWebsearch -> */Safari/History.db

No files found for safariRecentWebSearches -> **/Library/Preferences/com.apple.mobilesafari.plist

No files found for slack -> /var/mobile/Containers/Data/Application//Library/Application Support/Slack//Database/main_db

No files found for queryPredictions -> **/query_predictions.db

No files found for textinputTyping -> /DES/Records/com.apple.TextInput.TypingDESPlugin/.desdata

No files found for tikTok -> /Application//Library/Application Support/ChatFiles//db.sqlite

No files found for tikTok -> AwemeIM.db

No files found for venmo -> *PrivateFeed

No files found for venmo -> *PublicFeed

No files found for venmo -> *FriendsFeed

No files found for viber -> **/com.viber/settings/Settings.data

No files found for viber -> **/com.viber/database/Contacts.data

No files found for viber -> */Containers/Data/Application//Documents/Attachments/.

No files found for viber -> **/com.viber/ViberIcons/.

No files found for vippsContacts -> /Vipps.sqlite

No files found for vipps -> /Vipps.sqlite

No files found for voiceRecordings -> **/Recordings/*.composition/manifest.plist

No files found for voiceRecordings -> **/Recordings/*.m4a

No files found for voiceTriggers -> **/td/audio/*.json

No files found for voiceTriggers -> **/td/audio/*.wav

No files found for whatsappMessages -> /var/mobile/Containers/Shared/AppGroup//ChatStorage.sqlite*

No files found for whatsappMessages -> /var/mobile/Containers/Shared/AppGroup//Message/Media////.*

No files found for whatsappContacts -> /var/mobile/Containers/Shared/AppGroup//ContactsV2.sqlite*

No files found for iCloudWifi -> **/com.apple.wifid.plist

No files found for applewifiplist -> **/com.apple.wifi.plist

No files found for applewifiplist -> **/com.apple.wifi-networks.plist.backup

No files found for applewifiplist -> **/com.apple.wifi.known-networks.plist

No files found for applewifiplist -> **/com.apple.wifi-private-mac-networks.plist

No files found for wifiNetworkStoreModel -> */private/var/root/Library/Application Support/WiFiNetworkStoreModel.sqlite

No files found for wiloc ->

Any idea to slve this?

Best!

Jonathan

I do most of my research using a phone connected to a Mac, syncing via finder and SSH'ing the results over to the real development box. I noticed that iLEAPP didn't handle iTunes/Finder backups and wanted to see its output for something, so I added that in. This currently only handles the CLI-version, I haven't looked at the GUI yet.

I have to say, I generally dislike python, but you have some very easy to read code! Nice work.

I installed this on a Win11 laptop via WSL2->Ubuntu->Homebrew->Python3->git clone ileapp->brew install requirements.txt Runs fine. No issues.

I repeated the exact process on a Windows 10 workstation and have had nothing but issues:

anvil@acme:~/iLEAPP$ python3 ileappGUI.py
Traceback (most recent call last):
  File "/home/vflab/iLEAPP/ileappGUI.py", line 1, in <module>
    import ileapp
  File "/home/vflab/iLEAPP/ileapp.py", line 4, in <module>
    import scripts.report as report
  File "/home/vflab/iLEAPP/scripts/report.py", line 10, in <module>
    from scripts.ilapfuncs import logfunc
  File "/home/vflab/iLEAPP/scripts/ilapfuncs.py", line 16, in <module>
    from bs4 import BeautifulSoup
ModuleNotFoundError: No module named 'bs4'
anvil@acme:~/iLEAPP$ pip3 install bs4
DEPRECATION: Configuring installation scheme with distutils config files is deprecated and will no longer work in the near future. If you are using a Homebrew or Linuxbrew Python, please see discussion at https://github.com/Homebrew/homebrew-core/issues/76621
Collecting bs4
  Using cached bs4-0.0.1-py3-none-any.whl
Collecting beautifulsoup4
  Using cached beautifulsoup4-4.10.0-py3-none-any.whl (97 kB)
Collecting soupsieve>1.2
  Using cached soupsieve-2.3.1-py3-none-any.whl (37 kB)
Installing collected packages: soupsieve, beautifulsoup4, bs4
  DEPRECATION: Configuring installation scheme with distutils config files is deprecated and will no longer work in the near future. If you are using a Homebrew or Linuxbrew Python, please see discussion at https://github.com/Homebrew/homebrew-core/issues/76621
  DEPRECATION: Configuring installation scheme with distutils config files is deprecated and will no longer work in the near future. If you are using a Homebrew or Linuxbrew Python, please see discussion at https://github.com/Homebrew/homebrew-core/issues/76621
  DEPRECATION: Configuring installation scheme with distutils config files is deprecated and will no longer work in the near future. If you are using a Homebrew or Linuxbrew Python, please see discussion at https://github.com/Homebrew/homebrew-core/issues/76621
DEPRECATION: Configuring installation scheme with distutils config files is deprecated and will no longer work in the near future. If you are using a Homebrew or Linuxbrew Python, please see discussion at https://github.com/Homebrew/homebrew-core/issues/76621
Successfully installed beautifulsoup4-4.10.0 bs4-0.0.1 soupsieve-2.3.1
anvil@acme:~/iLEAPP$ python3 ileappGUI.py
Traceback (most recent call last):
  File "/home/vflab/iLEAPP/ileappGUI.py", line 1, in <module>
    import ileapp
  File "/home/vflab/iLEAPP/ileapp.py", line 4, in <module>
    import scripts.report as report
  File "/home/vflab/iLEAPP/scripts/report.py", line 10, in <module>
    from scripts.ilapfuncs import logfunc
  File "/home/vflab/iLEAPP/scripts/ilapfuncs.py", line 17, in <module>
    from PIL import Image
ModuleNotFoundError: No module named 'PIL'

Added support for photo metadata artefact for iOS 12 (tested on iOS 12.1.4) Added thumbnails to the report table (only for ios12 for now - will test on other when I process dumps)

I was using iLEAPP command line and .exe and receiving this message.. Wondered if it was an error... ios 13.3. I also received the same error when i was running a ios 13.4 image.

--------------------------------------------------------------------------------------
iLEAPP: iOS Logs, Events, and Preferences Parser
Objective: Triage iOS Full System Extractions.
By: Alexis Brignoni | @AlexisBrignoni | abrignoni.com
Artifact categories to parse: 38
File/Directory selected: /Volumes/davids_iphone

--------------------------------------------------------------------------------------


Mobile Installation Logs function executing
Logs processed: 2
Lines processed: 2171

Total apps: 326
Total installed apps: 326
Total uninstalled apps: 0
Total historical app reports: 326
Total system state events: 5
Mobile Installation Logs function completed.

Iconstate function executing
Screens: 2
Icons in bottom bar: 4
Iconstate function completed.

No files found for webclips -> *WebClips/*.webclip/*.

Lastbuild function executing
Traceback (most recent call last):
  File "./ileapp.py", line 101, in <module>
    globals()[key](filefound)
  File "/Users/hadar0x/Desktop/iLEAPP/ilapfuncs.py", line 2055, in lastbuild
    deviceinfoin(ordes, kas, vas, sources)
  File "/Users/hadar0x/Desktop/iLEAPP/ilapfuncs.py", line 4603, in deviceinfoin
    cursor.execute('INSERT INTO devinf (ord, ka, va, source)  VALUES(?,?,?,?)', datainsert)
sqlite3.InterfaceError: Error binding parameter 3 - probably unsupported type.

Fixes #266 and #257 by bumping the numpy version to be compatible with python 3.10 and ensuring that Linux users still fall back on python-magic, not the python-magic-bin package. I haven't been able to extensively test this, it would be worthwhile to make sure it works appropriately on Mac since I think you use them more than me. I've just tried it on Linux and it fixed the issues immediately.

On a fresh install of Ubuntu with Python 3.10 installed. Clone iLEAPP main.

pip3 install -r requirements.txt

Resulted in:

ERROR: Could not find a version that satisfies the requirement python-magic-bin (from versions: none) ERROR: No matching distribution found for python-magic-bin

Package "python-magic" was installed via pip3. Seems to work instead of python-magic-bin.

This PR was generated from seeing errors in the scripts/artifacts/appleWifiPlist.py script when the object did not contain a 'List of known networks' key. In fixing that, I also combined the information which was in scripts/artifacts/wifi.py into this script, per #88. I added support to scripts/artifacts/appleWifiPlist.py for a newer object wherein Apple records the networks the phone scans while using a "private" MAC address. Finally, I added three files to the file list for this script as the backup files were present on one of my test devices when the expected file was not.

One question, scripts/artifacts/appleWifiPlist.py would shove the entire object into the output array. This leads to some very tall rows in Hickman test images, I'd personally lean towards ripping that out, but wanted to check before doing so.

Fixes #88.

Recommend for deletion. They don't seem to point to anything anymore.

         'appUpdates':('App Updates', '**/AppUpdates.sqlitedb'),
         'systemVersion':('Device Info', '**/SystemVersion.plist'),

Artifacts take long to run. Useful in specific situations only.
'aggDict':('Aggregate Dictionary', '*/AggregateDictionary/ADDataStore.sqlitedb')

'aggDictScalars':('Aggregate Dictionary', '*/AggregateDictionary/ADDataStore.sqlitedb')

Module cloudkitParticipants has no ilap_artifacts entry and does not seem to be referenced anywhere else. https://github.com/abrignoni/iLEAPP/blob/master/scripts/artifacts/cloudkitParticipants.py

Bumps numpy from 1.21.4 to 1.22.0.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

I am getting the following error when I'm setting up iLEAPP. It's happening on all of my computers so I am sure its a user error, but I am so new to this, I have no idea what its saying. Can anyone help, please?

Building wheel for astc_decomp (setup.py) ... error error: subprocess-exited-with-error

× python setup.py bdist_wheel did not run successfully. │ exit code: 1 ╰─> [9 lines of output] C:\Python\lib\site-packages\setuptools\dist.py:717: UserWarning: Usage of dash-separated 'description-file' will not be supported in future versions. Please use the underscore name 'description_file' instead warnings.warn( C:\Python\lib\site-packages\setuptools\dist.py:717: UserWarning: Usage of dash-separated 'long-description' will not be supported in future versions. Please use the underscore name 'long_description' instead warnings.warn( running bdist_wheel running build running build_ext building 'astc_decomp' extension error: Microsoft Visual C++ 14.0 or greater is required. Get it with "Microsoft C++ Build Tools": https://visualstudio.microsoft.com/visual-cpp-build-tools/ [end of output]

note: This error originates from a subprocess, and is likely not a problem with pip. ERROR: Failed building wheel for astc_decomp Running setup.py clean for astc_decomp Building wheel for pyliblzfse (setup.py) ... error error: subprocess-exited-with-error

× python setup.py bdist_wheel did not run successfully. │ exit code: 1 ╰─> [5 lines of output] running bdist_wheel running build running build_ext building 'liblzfse' extension error: Microsoft Visual C++ 14.0 or greater is required. Get it with "Microsoft C++ Build Tools": https://visualstudio.microsoft.com/visual-cpp-build-tools/ [end of output]

note: This error originates from a subprocess, and is likely not a problem with pip. ERROR: Failed building wheel for pyliblzfse Running setup.py clean for pyliblzfse Failed to build astc_decomp pyliblzfse Installing collected packages: pyliblzfse, pyasn1, biplist, astc_decomp, python-dateutil, pathlib2, numpy, nska-deserialize, pandas, cryptography, bs4, PGPy Running setup.py install for pyliblzfse ... error error: subprocess-exited-with-error

× Running setup.py install for pyliblzfse did not run successfully. │ exit code: 1 ╰─> [5 lines of output] running install running build running build_ext building 'liblzfse' extension error: Microsoft Visual C++ 14.0 or greater is required. Get it with "Microsoft C++ Build Tools": https://visualstudio.microsoft.com/visual-cpp-build-tools/ [end of output]

note: This error originates from a subprocess, and is likely not a problem with pip. error: legacy-install-failure

× Encountered error while trying to install package. ╰─> pyliblzfse

note: This is an issue with the package mentioned above, not pip. hint: See above for output from the failure.

Regex on the root directory listing is one of the slowest to execute (especially when input is folder), but it has to execute once per module listing. There are many modules that operate on the same file(s). These can be merged into a single module, to reduce the loop iterations and make this faster. For example:

'aggDictpasscode': ('Aggregate Dictionary', '*/AggregateDictionary/ADDataStore.sqlitedb'),
'aggDictpasscodetype': ('Aggregate Dictionary', '*/AggregateDictionary/ADDataStore.sqlitedb'),
'cloudkitNoteSharing': ('Cloudkit', '*NoteStore.sqlite*'),
'cloudkitParticipants': ('Cloudkit', '*NoteStore.sqlite*'),
'safariHistory': ('Safari Browser', '**/Safari/History.db'),
'safariWebsearch': ('Safari Browser', '**/Safari/History.db'),

There are few others too.