ALEAPP v2026.4.3 reads raw images without mounting them
ALEAPP takes an Android extraction and turns scattered application databases, logs, XML, and protobuf data into HTML, TSV, and timeline output. Version v2026.4.3 can also work directly against supported raw and forensic image formats without mounting them or asking for administrator rights. That is the useful distinction: an examiner can point one tool at an archive, file-system folder, or image and let individual artifact plugins request only the files they understand.
The input list is broad enough for real lab work. It includes split raw images, EnCase and AFF families, Android-friendly file systems such as ext4 and F2FS, APFS and NTFS, plus VHD, VMDK, and QCOW2 virtual disks. Encrypted images can receive passwords through a file or environment variable, and BitLocker or APFS volumes have dedicated credential options. ALEAPP reports volumes it cannot open instead of pretending they were searched. That behavior matters more than a flashy interface when an omitted volume could change a finding.
The source path installed 65 packages in 21 seconds
Our run installed commit 4381852 in 21 seconds, pulling 65 packages and occupying 161 MB. Python 3.10 or newer is the documented base. Linux source users must add tkinter separately, a small requirement that is easy to miss if they only copy the pip command. The repository also supplies a pinned dependency chain used for releases, which is the better starting point when a lab wants to reproduce the packaged build.
Most users do not need that build path. Release v2026.4.3 provides Windows installers and portable archives for x64 and ARM64, signed and notarized macOS images for Intel and Apple silicon, and Linux AppImages for both architectures. SHA256SUMS.txt covers the downloads. Windows is the exception in trust presentation: its binaries are not signed yet, so SmartScreen warns on first launch. That may be unacceptable on a managed examination workstation even when the published hash matches.
What happened when we ran it
Our sandbox installed the 68.3 MB checkout in 21 seconds and completed the build in 2 seconds. The clone held 1,248 files and about 221,354 lines of source. Our test method used a fresh unprivileged Debian container with 3 CPUs, 8 GB of RAM, Python 3.12, and no secrets. Pip-audit reported 0 known vulnerabilities. Those measurements cover repository setup and supplied checks, not parsing accuracy against every Android version.
Pytest completed in 55 seconds with 1,130 passed, 0 failed, and 12 skipped. Nine CI workflow files and a dedicated tests directory back up that local result, although the repository has no Dockerfile. The clean run is meaningful for maintainers changing shared parser code. It does not establish evidentiary correctness for an artifact whose upstream app schema changed yesterday, so casework still needs spot checks against the source database and known device behavior.
Linux packages require glibc 2.35 or newer
The v2026.4.3 Linux AppImage was built on Ubuntu 22.04 and requires glibc 2.35 or newer. It also needs FUSE unless you use the documented extract-and-run option. Building locally adds PyInstaller, and the smoke command needs a display supplied by xvfb-run. These are ordinary desktop-packaging constraints, but they make a container-only deployment less direct than the passing 2-second build might suggest.
Input choice also affects disk use. A compressed tar, including .tar.gz or .tar.xz, is expanded once into the report folder before parsing and removed when the run ends. You need free space for that uncompressed copy. The output directory must already exist for command-line runs. Neither detail is difficult, though both can stop a large examination late if the analyst budgets only for the original acquisition.
Forty open issues and PRs include evidence-handling gaps
GitHub listed 40 open issues and pull requests on October 8, 2026, the same day the repository was pushed. Release v2026.4.3 had shipped six days earlier with new SwiftKey artifacts, Telegram layer 227 handling, and raw-image fixes. Three fresh October pull requests added or proposed DJI flight records, WhatsApp Business, and Google Pay parsers. The dates point to active maintenance rather than a parser catalog left to age.
The open queue still contains boundaries worth putting in a lab procedure. Issue 14 says zip and tar modes generally ignore a SQLite database's matching -wal and -journal files, which can mean missed records. Issue 919 reports the 3.6 AppImage crashing when file-picker buttons are used on AlmaLinux 10. These are user reports, not failures from our run, but both concern a practical analysis path. Test your chosen package and acquisition mode before a live case depends on it.
ALEAPP is strongest as a transparent Android parsing workbench. A plugin starts with declared paths and an entry function, and the contribution flow asks authors to cut a shareable fixture, record expected output, run the comparison, and generate sample data. Files under 10 MB can travel with the pull request; larger fixtures follow a documented handoff. That discipline is why the 1,130-test result carries weight. The tool earns a place in a mobile lab, provided the examiner treats its report as derived evidence that must remain traceable to the original files.