# aLEAPP not works

**URL:** <https://sleuthkit.discourse.group/t/aleapp-not-works/3203>\
**Category:** Autopsy Help\
**Created:** [April 25, 2022, 12:33pm UTC](https://sleuthkit.discourse.group/t/aleapp-not-works/3203 "2022-04-25T12:33:52Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![giandega](https://avatars.discourse-cdn.com/v4/letter/g/7c8e57/32.png) [@giandega](https://sleuthkit.discourse.group/u/giandega)\
**Post date:** [April 25, 2022, 12:33pm UTC](https://sleuthkit.discourse.group/t/aleapp-not-works/3203/1 "2022-04-25T12:33:52Z")

</div>

dear all,  
I am testing aLEAPP.  
First I had an acquisition of an android smartphone. I used ADB backup. The file is names backup.ab  
Second I create a new project on autopsy choosing logical file and selecting the backup.  
In the ingest I choosed aLEAPP but nothing appens I only in the tree logicalfileset1(1)  
What I have to do?  
Thanks all

---

<div class="post-metadata">

**Author:** ![Mark\_McKinnon](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/mark_mckinnon/32/42_2.png) [@Mark\_McKinnon](https://sleuthkit.discourse.group/u/Mark_McKinnon)\
**Post date:** [April 25, 2022, 12:57pm UTC](https://sleuthkit.discourse.group/t/aleapp-not-works/3203/2 "2022-04-25T12:57:24Z")

</div>

In order to use aLeapp in Autopsy you will need either a Image file source (E01, vhd, vmdk or raw image) or add the zip, tar or gz or the actual file system to a logical image source. Once you do that aLeapp should work fine.

---

<div class="post-metadata">

**Author:** ![giandega](https://avatars.discourse-cdn.com/v4/letter/g/7c8e57/32.png) [@giandega](https://sleuthkit.discourse.group/u/giandega)\
**Post date:** [April 25, 2022, 1:36pm UTC](https://sleuthkit.discourse.group/t/aleapp-not-works/3203/3 "2022-04-25T13:36:14Z")

</div>

Mark thanks for answering me. I zipped the \*.ab file, then added to autopsy with the same result

---

<div class="post-metadata">

**Author:** ![Mark\_McKinnon](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/mark_mckinnon/32/42_2.png) [@Mark\_McKinnon](https://sleuthkit.discourse.group/u/Mark_McKinnon)\
**Post date:** [April 25, 2022, 3:02pm UTC](https://sleuthkit.discourse.group/t/aleapp-not-works/3203/4 "2022-04-25T15:02:49Z")

</div>

It will not read a ADB backup, zipped or unzipped. You will have to convert the ADB backup to something that aLeapp can actually read.

---

<div class="post-metadata">

**Author:** ![giandega](https://avatars.discourse-cdn.com/v4/letter/g/7c8e57/32.png) [@giandega](https://sleuthkit.discourse.group/u/giandega)\
**Post date:** [May 3, 2022, 5:30pm UTC](https://sleuthkit.discourse.group/t/aleapp-not-works/3203/5 "2022-05-03T17:30:54Z")

</div>

ok thank you very much

---

<div class="post-metadata">

**Author:** ![nika](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/nika/32/1574_2.png) [@nika](https://sleuthkit.discourse.group/u/nika)\
**Post date:** [May 20, 2022, 7:43pm UTC](https://sleuthkit.discourse.group/t/aleapp-not-works/3203/6 "2022-05-20T19:43:33Z")

</div>

> [@Mark\_McKinnon](#):
>
> In order to use aLeapp in Autopsy you will need either a Image file source (E01, vhd, vmdk or raw image) or add the zip, tar or gz or the actual file system to a logical image source. Once you do that aLeapp should work fine.

I am not sure if this is what was meant, but I took an android backup (logical, through ADB), created a VHD, copied the ADB backup files to the VHD. I then imported the VHD into Autopsy and ran aLEAPP…no go. I must be doing something wrong.

I haven’t looked too deeply, but I have so far failed to find much documentation on this modules use. Though it would come in handy.

---

<div class="post-metadata">

**Author:** ![Mark\_McKinnon](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/mark_mckinnon/32/42_2.png) [@Mark\_McKinnon](https://sleuthkit.discourse.group/u/Mark_McKinnon)\
**Post date:** [May 20, 2022, 8:12pm UTC](https://sleuthkit.discourse.group/t/aleapp-not-works/3203/7 "2022-05-20T20:12:22Z")

</div>

If you go to the following directory what does the aLeapp output look like? \<case directory/ModuleOutput/aLeapp//ALEAPP\_Reports\_\<date/time\>/index.html?

---

<div class="post-metadata">

**Author:** ![nika](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/nika/32/1574_2.png) [@nika](https://sleuthkit.discourse.group/u/nika)\
**Post date:** [May 20, 2022, 11:43pm UTC](https://sleuthkit.discourse.group/t/aleapp-not-works/3203/8 "2022-05-20T23:43:48Z")

</div>

Thanks. In summary, the output looks like this:

> No files found for adb\_hosts → \*\*/data/misc/adb/adb\_keys  
> No files found for etc\_hosts → \*\*/system/etc/hosts  
> No files found for BashHistory → \*\*/.bash\_history  
> …

etc.

I started checking this out and comparing paths. It appears that at least on one occasion, the paths do not match up with my adb acquisition (i.e. WhatsApp).

More digging to do…
