Investigating Android Snapchat App
15/12/2023 Friday
Snapchat is a multimedia messaging app available on Android and other platforms. Launched in 2011, it allows users to send photos and videos that disappear after a brief viewing period. The app's key features include "Snaps" with short-lived content, Stories for sharing longer-lasting multimedia compilations, and a variety of filters and augmented reality effects. Users can also chat, share location-based content, and discover selected content through the Discover feature. Snapchat has gained popularity among younger audiences for its ephemeral nature and creative tools for self-expression.
Digital Forensics Value of Android Snapchat App
Analyzing the artifacts left behind by the Android Snapchat application can reveal valuable information for investigators. For example, examining the contacts with whom a user has communicated on Snapchat can shed light on potential connections and relationships. This analysis can also disclose information about the user's account, such as email address, phone number, birthday, etc. Since Snapchat stories are designed to disappear after a set time, the recovered information about those hidden contents can also provide crucial insights.
Location of Android Snapchat App Artifacts
Android Snapchat App artifact can be found at the following locations:
data/user/0/com.snapchat.android/databases/main.db
data/user/0/com.snapchat.android/databases/memories.db
data/user/0/com.snapchat.android/databases/arroyo.db
data/user/0/com.snapchat.android/databases/core.db
data/user/0/com.snapchat.android/shared_prefs/user_session_shared_pref.xml
Analyzing Android Snapchat App Artifacts with ArtiFast
This section will discuss how to use ArtiFast to extract Android Snapchat App artifact from Android device's files and what kind of digital forensics insights we can gain from the artifact.
After you have created your case and added evidence for the investigation, at the Artifact Selection phase, you can select Android Snapchat App artifact:
×
Once ArtiFast parser plugins complete processing the artifact for analysis, it can be reviewed via “Artifact View” or “Timeline View,” with indexing, filtering, and searching capabilities. Below is a detailed description of Android Snapchat App artifact in ArtiFast.
Android Snapchat Chat Messages
- Message Date/Time: The message date and time.
- Client Conversation ID: The conversation ID.
- Message ID: The message ID.
- Message Type: The type of the message.
- Message Content: The message content.
- Sender: The sender of the message.
- Read Date/Time: The message read date/time.
Android Snapchat Friends
- Added Date/Time (Me): The date/time when this user added the account’s owner.
- User ID: The user ID.
- User Name: The user’s name.
- Display Name: The chosen display name by the user.
- Birthday: The user's birthday.
- Phone: The user's phone number.
- Server Display Name: The user's display name as saved on the server.
- Added Date/Time (Them): The date/time when the account’s owner added this user.
Android Snapchat Memories
- Message Date/Time: Creation date and time.
- Entry ID: The Entry ID.
- Title: The memory title.
- Media ID: The media ID.
- Media Type: The media type.
- Time Zone: The time zone where this memory has been taken.
- Has Location: Indicated whether this memory has a saved location or not.
- Media Key: The date/time when the account’s owner added this user.
- Message Date/Time: The message date/time.
- Latest Snap Create Date/Time: The latest snap created date/time.
- Earliest Snap Create Date/Time: The earliest snap created date/time.
- Width: The width of the media.
- Height: The height of the media.
- Duration: The duration of this media.
- Latitude: The latitude.
- Longitude: The longitude.
Android Snapchat Stories
- Created Date/Time: Date and time created.
- Story ID: The story ID.
- Display Name: The display name of the story publisher.
- Caption: The caption.
- Thumbnail URL: The thumbnail URL.
- Viewed: Indicates whether this story is viewed by the account user or not.
- Is Public: Indicates whether this story is published as a public story or not.
- Display Name: The user’s name of the story publisher.
- Snap ID: The snap ID.
- Media ID: The media ID.
- Expiration Date/Time: The date/time when this story expired.
- Snap Date/Time: The snap date/time.
- Duration (Ms): The duration of the story in milliseconds.
Android Snapchat User Information
- Country Code: Country Code.
- Display Name: Display Name.
- User Name: User Name.
- Phone Number: Phone Number.
- User ID: User ID.
- Email Address: Email Address.
- Account Created Date/Time: Account Created Date/Time.
- User Birthday: User Birthday.
For more information or suggestions please contact: [email protected]
