GLeapp Adds Image Similarity Detection to Mobile Forensics

GLeapp uses perceptual hashing alongside conventional file hashing, allowing it to identify images that may look similar even when their files are not identical.

The toolkit can also extract key frames from videos and include them in similarity searches. This allows an image found during an examination to potentially be linked to frames within video evidence.

GLeapp is designed for local forensic triage and can process media from folders, full-file-system extractions and forensic disk images. It also supports metadata extraction, duplicate detection and known-hash matching.

The new capability addresses a common challenge in mobile forensics: large device extractions can contain thousands of images and videos, making manual review time-consuming.

GLeapp is part of the open-source LEAPP collection of digital-forensics tools. The project provides investigators with a local workflow for processing and reviewing large media collections without relying solely on exact hash matches.

The update gives forensic examiners another way to move from a single item of interest to potentially related media across an entire evidence collection.