Do you need to recover a Snapchat from an iOS and Android mobile device?
Snapchat is well-known for allowing users to share pictures and videos with other users, while allowing the sender to set a specific time limit from one to ten seconds that the receiver can view the message.
The receiver of the message has that long to view the message, then the message “disappears forever.” Or at least that is the claim.
Below you’ll find the only 2 ways I’ve found that allow you to view Snaps after they had been “deleted”.
Recover Snaps Using Smartphone Spy Apps
The Snapchat app offers very robust security. That said, you can spy on someone’s Snapchat activity and see images they’ve posted using spy software. Spy apps are a type of cell phone surveillance software that tracks all activity on someone else’s phone.
Snapchat spy apps can monitor a user’s Snapchat activity as well as Facebook, Instagram, TikTok, and more. These apps are available for Android and iOS devices.
What Can Snapchat Spy Apps Monitor?
Snapchat spy apps can monitor someone’s Snapchat messages and conversation history. They also store screenshots of any activity within the user’s Snapchat account. This includes pictures, interactions with friends, and chats.
How to Recover Snapchat Images from an Android
All Snapchat data is stored locally on Android devices. Spy software access this data to track images and conversations from within the Snapchat app. Follow the steps below to recover Snapchat images from an Android device using uMobix.
- Open an account at https://umobix.com
- Select “Android phone or tablet” for the type of device to monitor.
- Submit your payment.
- Follow the supplied instructions for changing the target phone’s security settings
- Download and install the app on the target phone.
- Once finished, the app will download all Snapchat images and conversations
- View the target phone’s Snapchat data from the online control panel
If you would like more information about spying on Android devices, check out our list of the top Android surveillance apps.
How to Recover Snapchat Images on iOS
Recovering Snapchat images on iOS devices can be a bit more problematic. Most iOS spy apps can only access phone data that is stored in iCloud backups.
Snapchat data is stored locally on Apple devices. The iOS operating system utilizes sandboxing to restrict one app from accessing data in another app. The only way around the sandboxing limitation is to jailbreak the iOS device.
If you need to recover images on an iPhone or iPad using a spy app, it will require jailbreaking the device. Our favorite app for this is FlexiSPY. Follow the instructions below to install FlexiSPY on an iPhone or iPad.
- Go to FlexiSPY.com
- Click “Buy Now”.
- Select the “FlexiSPY Extreme” package and subscription length.
- Jailbreak the target iOS device using the supplied instructions
- Download and install the app on the target phone.
- Once finished, the app will download all Snapchat images and conversations
- View the target phone’s Snapchat data from the online control panel
FlexiSPY offers two options for installation on iPhones. These are recommended for those who want to avoid technical headaches.
- FlexiSPY Express: get a new iPhone shipped to your door with FlexiSPY pre-installed.
- Installation Services: a FlexiSPY technician will remotely install and configure the app for you.
Why Recover Snapchat Images?
There are a handful of reasons why you might want to recover Snapchat images from a phone.
Protect Your Children From Danger
The vast majority of Snapchat users are normal people. But there are also predators that take advantage of the Snapchat platform. These people look for young children who don’t know how to protect themselves.
If you’re concerned about the dangers of using Snapchat, it might make sense to check on your child’s usage of the platform from time to time.
A Cheating Spouse or Partner
Unfortunately Snapchat has become a very popular place for people to seek out extra-marital affairs. You can send and receive pictures that disappear within moments. This makes Snapchat ideal for a cheating.
Examining the photos and messages on your partner’s phone is one way to ensure you’re not being cheated on. Read more about this in our article on apps to help you catch a cheater.
Millions of Photos Per Day
Snapchat moves “upward of 150 million photos through the service on a daily basis, compared to Facebook’s Instagram, which moves 40 million photos a day, that is a lot of photos moved for such a new company.
The app differs in the fact that images and videos are ephemeral rather than permanent, something that is attractive to teens and young adults.
We wanted to know if “snaps” really do “disappear forever,” if there is metadata associated with “snaps,” if “snaps” can be recovered after becoming expired, and if they can be recovered, if there is metadata associated with the expired “snap.”
Based on the home screen for Snapchat, it is clear that these time stamps are stored some place, it is just unclear if they are recoverable. However, they are stored somewhere, even for expired “snaps.”
Image Recovery Within the Snapchat App
I used two android devices to examine artifacts left behind by Snapchat. An account was created on a Samsung Galaxy Note 2, and pictures and videos were sent to another account.
The receiving account was logged into on a Samsung Galaxy S3, when some of the images and videos were viewed, while others were not.
I then acquired the phone using AccessData’s Mobile Phone Examiner+ version 5.2.1.499. After the acquisition was complete, the image was exported as an .AD1 image file, and then imported to AccessData’s Forensic Toolkit version 4.0.2.33.
After a brief examination of the contents, a different account was created on the Samsung Galaxy Note 2, and more pictures and videos were sent to the account on the Samsung Galaxy S3.
This was to determine if there are identifiers for the sender account of a “snap.” The same acquisition process was followed again after the second batch of “snaps” were sent.
After another brief examination of the contents, pictures and videos were sent from the Samsung Galaxy S3 with the second account to both the the second and third accounts. The same acquisition process was followed again after sending these “snaps.”
All examination took place using AccessData’s Forensic Toolkit version 4.0.2.33.
Snapchat Structure
The majority of Snapchat data is stored within the data/data/com.snapchat.android folder. There are four folders within this directory, with two folders within the cache folder.
Examination of the Samsung Galaxy S3 revealed that within the shared_prefs folder are several XML files:
- CameraPreviewActivity.xml
- com.google.android.gcm.xml
- com.snapchat.android_preferences.xml
- SnapPreviewActivity.xml.
The com.snapchat.android_preferences.xml File
This file is where the majority of information stored by Snapchat is located. Within this file is a listing of all the contacts stored on the device. This is done with the permission allowed by the user for the application to read the contacts on the device.
Below the list of contacts is a listing of Snapchat messages. It appears that there is a set of fields stored for each message in Snapchat.
The following are the fields stored in this section of the XML file: type, mSender, mWasViewed, mCaptionPosition, mCaptionOrientation, mIsLoading, mIsTimerRunning, mIsBeingViewed, MWasOpened, mWasScreenshotted, mDisplayTime, mId, mTimestamp, mStatus, mIcon, and mMediaType.
We sent only two pictures from the DecipForensics2 account, and one was viewed and expired. Within this XML file are two records that show the mSender field set to “decipforensics2.”
Of those two records, one has the mWasOpened set to “true.” The author kept documentation as to which images were opened and allowed to expire and which are not, so it is known which image is tied to this record.
The mTimestamp field is stored in Epoch format. Upon conversion of this value, it showed the time that the image was either taken or viewed.
Further research will need to be done to determine which it is, however, the time is within the timeframe of both being sent and viewed. Unfortunately, the author did this within a few minutes of each other and did not record the exact time sent.
The mId field for the picture shown to the left is “270518365528484358r.” The mTimestamp field in the same record is “1365528484358.”
After converting the Epoch time format to readable format, the time stamp is for April 9, 2013 11:28:04 MDT. The similarities here will be address further in a later section of this paper
The received_image_snaps Folder
Within this folder were located every image sent to the DeciphForensics account on the Samsung Galaxy S3, including the images that had been viewed and were expired. There were some duplicate images with different names as well, the reason for this is unknown.
Android developers created a way for media files such as graphics to be stored on the phone for application use and function without being put into the Gallery application as an image to be viewed.
The way that they did this was with .nomedia files. “If a directory has a file named .nomedia, then the media store will not scan and record the metadata of files in that directory” (Hoog, 2011).
Each of the images within the received_image_snaps folder had a .nomedia extension appended to the end of the file name. For example, the name of the file figure 3 is “h1a81hurcs00h1365528700423.jpg.nomedia”.
This was likely done to prevent the images stored within this directory from being placed in the gallery or from being scanned by the media store. AccessData’s Forensic Toolkit recognized the .nomedia extension that was appended to the end of the file name and ignored it, displaying the images.
Correlations between the XML Records and the Image Names
There is a small correlation between records within the com.snapchat.android_preferences.xml file and the name of the image file stored in the received_image_snaps folder.
As shown above, there are three correlations between the name of the image, the mTimestamp value, and the mId value. While this is consistent with this image, it is not always consistent with all images. The section in blue is present in several of the other images, only with different numbers following to separate the image.
Conclusion
While it is much easier to use a spy app to view someone’s Snaps, you can also find the images within the app if you know where to look.
Metadata about expired “snaps” as well as unexpired “snaps,” and that images that are sent via Snapchat are indeed recoverable, and do not “disappear forever.”
Recommendations for Further Research
We recommend several avenues for further research into Snapchat and how it stores data.
Figuring out how to correlate the XML records to the actual images is vital. The author was able to do so in one instance because of known facts, but this will not be the case for examiners in live cases.
We finally recommends that all of this research should also be done on iOS devices to find out if “snaps” are recoverable and can have time stamp and sender information associated with the “snaps.”
You can more about this type of research on the Tool Report Decipher Forensics page.
