ALEAPP Adds KeepSafe Android Artifact Parser, Expanding Mobile Forensic Analysis

The open-source Android forensic analysis tool ALEAPP has introduced support for extracting artifacts from KeepSafe, a privacy-focused application used to store photographs and videos behind additional access controls.

The new parser was included in ALEAPP version 2026.4.4, released on October 24, 2026, and highlighted in the October 29 digital-forensics news roundup by Forensic Focus.

Developed by community contributor Heather Charpentier, the module helps investigators examine application-specific data that may otherwise be overlooked during automated Android forensic analysis.

KeepSafe offers features such as PIN-protected storage, a decoy vault and a disguised calculator interface. Its Android implementation can also capture photographs following unsuccessful attempts to unlock the vault, potentially creating additional investigative artifacts.

Researchers found that some files associated with KeepSafe retain Exchangeable Image File Format (EXIF) metadata, including original creation timestamps and GPS coordinates. Investigators may be able to extract this information using ExifTool even when other forensic parsers do not display it.

The addition is significant because privacy applications can store information in formats or locations that conventional forensic examination workflows do not fully interpret.

For mobile-forensics examiners, the update provides another method for identifying relevant media artifacts and assessing associated metadata. However, the presence of a file or timestamp does not independently establish who created it, when it was placed in the vault or whether the recorded location is accurate.

Examiners should validate recovered artifacts against their source files and other available device evidence before drawing conclusions.