±Forensic Focus Partners

±Your Account


Nickname
Password


Forgotten password/username?


Membership:
New Today: 0
New Yesterday: 7
Overall: 27509
Visitors: 51

±Follow Forensic Focus

Join our LinkedIn group

Subscribe to news

Subscribe to forums

Subscribe to blog

Subscribe to tweets

Snapchat - Image retrieval

Discussion of forensic issues related to all types of mobile phones and underlying technologies (GSM, GPRS, UMTS/3G, HSDPA, LTE, Bluetooth etc.)
Subforums: Mobile Telephone Case Law
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

Snapchat - Image retrieval

Post Posted: Tue Nov 12, 2013 5:49 am

Hi,

Has anybody had any luck with extracting images from the Snapchat application where the image/video hasn't been saved by the sender?

Thanks

Amanda  

langers01
Newbie
 
 
  

Re: Snapchat - Image retrieval

Post Posted: Tue Nov 12, 2013 7:10 am

Have you seen this?

www.ksl.com/?sid=25106057

It might help you.  

sukeban
Newbie
 
 
  

Re: Snapchat - Image retrieval

Post Posted: Mon Feb 03, 2014 2:21 pm

It is possible to save the unviewed images.
The newest version of the SnapChat-App encrypt the images.
But you can easily decrypt them.
The App use an AES 128bit encryption algorithm with a 16 char long key.

For more information take a look at this article...

http://www.experts4handys.de/?p=575

If you want more detailed infos feel free to ask me.  

gharti
Newbie
 
 
  

Re: Snapchat - Image retrieval

Post Posted: Tue Feb 04, 2014 7:34 am

Great info, thanks! Wish the post was in English though... Smile Google Translate kinda did the job.

Did you post your decryption code somewhere?  

PM_SQ
Senior Member
 
 
  

Re: Snapchat - Image retrieval

Post Posted: Tue Feb 04, 2014 10:04 am

I 2nd PM_SQ's comments! Interesting read, good work gharti! Smile  

DCS1094
Senior Member
 
 
  

Re: Snapchat - Image retrieval

Post Posted: Wed Feb 05, 2014 4:42 am

Hello All,

We've had a few cases in recently with snapchat. I found a ruby script that would decrypt the encrypted images and movies and then just edited it a bit to parse through a folder to decrypt and rename the files for viewing. The script is as follows:-

#!/usr/bin/env ruby

require 'openssl'

exts=[".jpg.nomedia",".jpg.DELETED.nomedia",".mp4.nomedia",".mp4.DELETED.nomedia"]
repext=[".jpg",".jpg",".mp4",".mp4"]
for i in 0..3
snapchat= Dir["*" + exts[i]]
snapchat.each {|filename|
fname=File.basename(filename,exts[i])
puts fname+exts[i]
begin
data = File.open(filename, 'r:ASCII-8BIT').read
c = OpenSSL::Cipher.new('AES-128-ECB')
c.decrypt
c.key = 'M02cnQ51Ji97vwT4'
o = ''.force_encoding('ASCII-8BIT')
data.bytes.each_slice(16) { |s| o += c.update(s.map(&:chr).join) }
o += c.final
File.open(fname+repext[i], 'w') { |f| f.write(o) }
puts "Successfully decrypted ", fname+exts[i]
rescue
puts "Failed on decrypt for file ", fname+exts[i]
next
end
}
end


For some reason this works fine on my Linux install of Ruby but won't work on the Windows install of Ruby - on the plus side it has at least justified my purchase of a Raspberry Pi !!


Hope this helps,

Rich Morris - Cumbria Constabulary Hi-Tech Unit  

marshalm
Newbie
 
 
  

Re: Snapchat - Image retrieval

Post Posted: Wed Feb 05, 2014 6:58 am

And here is my little program in Java for decrypting a single picture:



// Example code showing SnapChat JPG decryption
// for the unseen stored pictures

import java.awt.image.BufferedImage;
import java.io.FileInputStream;
import java.io.FileOutputStream;
import javax.crypto.Cipher;
import javax.crypto.CipherInputStream;
import javax.crypto.spec.SecretKeySpec;
import javax.imageio.ImageIO;

public class sample {

public static void main(String[] arg) throws Exception {

//The 16 char AES key
String b = "M02cnQ51Ji97vwT4";

{

Cipher scCipher = Cipher.getInstance("AES/ECB/PKCS5Padding");
scCipher.init(2, new SecretKeySpec(b.getBytes(), "AES"));

FileInputStream output = new FileInputStream("D:\\Temp\\Crypt\\h1a81hurcs00h1390749911195.jpg");
CipherInputStream cis = new CipherInputStream(output, scCipher);
BufferedImage input1 = ImageIO.read(cis);
FileOutputStream out = new FileOutputStream("D:\\Temp\\Crypt\\SnapChat_decrypted_file_01.jpg");
ImageIO.write(input1,"JPG", out);
cis.close();

}
}
}


Hope we can find a way to rescue the viewed and deleted Pictures...  

gharti
Newbie
 
 
Reply to topicReply to topic

Share this forum topic to encourage more replies



Page 1 of 1