Investigating iOS SnapChat
02/02/2024 Friday
Snapchat is a multimedia messaging app available for Apple and Android devices, offering a unique platform for users to share photos and videos with friends. Snapchat is characterized by its ephemeral nature, as messages and stories typically disappear after a set time. Snapchat allows users to enhance their content with creative filters and lenses, including the popular face-altering options. The platform's Snap Map feature facilitates real-time location sharing.
Digital Forensics Value of iOS SnapChat
The information extracted from Snapchat's left-behind artifacts can shed light on user communications and content sharing. This analyzing process can reveal user account details, including usernames and email addresses, contributing to an understanding of the individuals involved. Besides that, geolocation data, contact information, and timestamps aid in reconstructing timelines and social connections.
Location of iOS SnapChat Artifacts
iOS SnapChat artifact can be found at the following location
/private/var/mobile/Containers/Data/Application/<App_GUID>
Analyzing iOS SnapChat Artifacts with ArtiFast
This section will discuss how to use ArtiFast to extract iOS SnapChat artifact from iOS device's files and what kind of digital forensics insights we can gain from the artifact.
After you have created your case and added evidence for the investigation, at the Artifact Selection phase, you can select iOS SnapChat artifact:
×
Once ArtiFast parser plugins complete processing the artifact for analysis, it can be reviewed via “Artifact View” or “Timeline View,” with indexing, filtering, and searching capabilities. Below is a detailed description of iOS SnapChat artifact in ArtiFast.
iOS Snapchat Best Friends
- Last Modification Date: Last Modification date.
- Display Name: Display Name.
- Snapchat Username: Snapchat Username.
- Sequence Number: Sequence Number.
iOS Snapchat Recently Snapped Friends
- Last Modification Date: Last Modification Date.
- Display Name: Display Name.
- Snapchat Username: Snapchat Username.
- Sequence Number: Sequence Number.
iOS Snapchat Other Friends
- Last Modification Date: Last Modification Date.
- Display Name: Display Name.
- Snapchat Username: Snapchat Username.
- Sequence Number: Sequence Number.
iOS Snapchat User Preferences
- Last Modification Date: File Last Modification Date.
- Snapchat Username: Snapchat Username.
- User ID: User ID.
- Is User Logged In: Is User Logged In.
- Is Verification Needed: Is Verification Needed.
- Widget Last View Date: Widget Last View date.
- Today Widget Friend Count: Today Widget Friend Count.
- Today Widget Friends: Today Widget Friends.
iOS Snapchat Chat Messages
- Client Conversation ID: Conversation ID.
- Message Date/Time: Message date and time.
- Message ID: Message ID.
- Read Date/Time: Message read date and time.
- Message Type: Message Type.
- Message Content: Message content.
- Sender: Sender.
iOS Snapchat Contacts
- Display Name: Display Name.
- User Name: Snapchat Username.
- User ID: User ID.
iOS Snapchat Memories
- Entry ID: Entry ID.
- Message Date/Time: Message date and time.
- Latest Snap Create Date/Time: Latest Snap Create Date/Time.
- Title: Title.
- Earliest Snap Create Date/Time: Earliest Snap Create Date/Time.
- Media ID: Media ID.
- Media Type: Media Type.
- Creation Date/Time: Creation date and time.
- Time Zone: Time zone.
- Width: Width.
- Height: Height.
- Duration: Duration in seconds.
- Has Location: Has Location.
- Privacy Status: Privacy Status.
- Attachment URL: Attachment URL.
For more information or suggestions please contact: kalthoum.karkazan@forensafe.com
