±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 35894
New Yesterday: 0 Visitors: 118

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

Can Snapchat Data Be Extracted from an iPhone 8 iOS v.11.4.1

Discussion of forensic issues related to all types of mobile phones and underlying technologies (GSM, GPRS, UMTS/3G, HSDPA, LTE, Bluetooth etc.)
Subforums: Mobile Telephone Case Law
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

UnallocatedClusters
Senior Member
 

Can Snapchat Data Be Extracted from an iPhone 8 iOS v.11.4.1

Post Posted: Jul 24, 18 21:04

Colleagues,

I have an iPhone 8, iOS version 11.4.1 from which my client wants to extract Snapchat evidence to produce in a case.

The iPhone 8 is my client's phone and I have full access to the phone's content.

I have Cellebrite PA and MOBILedit Forensic Express tools.

Has anyone had success extracting Snapchat communications from an iPhone 8 iOS v.11.4.1?

How about the following collection vector??:

1) Install Bluestacks Android emulator on my forensic workstation (https://www.bluestacks.com)

2) Install Snapchat on the Bluestacks Android emulator.

3) Log in to my client's Snapchat account using the Bluestacks Android emulator on my forensic workstation.

4) Synchronize the Snapchat account, which will *hopefully* pull in the desired Snapchat data that exists currently on my client's iPhone 8.

5) Perform a forensic collection of the Bluestacks data and extract Snapchat evidence.  
 
  

4Rensics
Senior Member
 

Re: Can Snapchat Data Be Extracted from an iPhone 8 iOS v.11

Post Posted: Jul 25, 18 08:21

That certainly sounds viable. I've never used BlueStacks so can't answer the question on what you could acquire, but in the same vain, if that didn't work, you could potentially do the same technique but install and log into SnapChat on an Android device that allows a full physical (if you had one to hand obvs) That should work. I've done full physicals on numerous Android devices and recovered SnapChat data (mainly Stories and Messages)

Good luck.  
 
  

passcodeunlock
Senior Member
 

Re: Can Snapchat Data Be Extracted from an iPhone 8 iOS v.11

Post Posted: Jul 25, 18 09:58

We just saved the Snapchat messages in a case using a rooted MTK based Android phone synchronized with the relevant Snapchat user account data.

The relevant data from our MTK physical dump was validated against the original Apple device, everything is ok.
_________________
Apple passcode unlock + decrypted filesystem dump, Android user locks unlock + physical dump with decrypted userdata partition. We provide our services world-wide, but we reserve the right for choosing which tasks we take and which we deny! 
 
  

JChan
Newbie
 

Re: Can Snapchat Data Be Extracted from an iPhone 8 iOS v.11

Post Posted: Jun 17, 19 14:15

Hi

Iphone analysis

If i was using the snapchat upto 5pm, and then uninstalled it a 8pm , would l loose all the local date regarding the application start and stop during 5pm>8pm?

What if any information would be available for that time period 5pm>8pm?  
 
  

cs1337
Senior Member
 

Re: Can Snapchat Data Be Extracted from an iPhone 8 iOS v.11

Post Posted: Jul 02, 19 18:28

very interesting with using a bluestacks android emulator. What did you use to parse the data after collecting it? I'm wondering if i can leverage this for a WeChat collection  
 

Page 1 of 1