±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 1 Overall: 32774
New Yesterday: 3 Visitors: 192

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

RSS Feed Widget

±Latest Webinars

Deleted Snapchat images on a 4S

Discussion of forensic issues related to all types of mobile phones and underlying technologies (GSM, GPRS, UMTS/3G, HSDPA, LTE, Bluetooth etc.)
Subforums: Mobile Telephone Case Law
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

Deleted Snapchat images on a 4S

Post Posted: Mon Apr 20, 2015 3:01 pm

Our agency recently received consent to search an iPhone 4S. My understanding is that a young lady was sending digital images to a much older male through Snapchat.

The father of the young lady found out she was using the Snapchat app and he deleted it from the device.

Several moons ago I was told that after a ‘Snap’ is viewed it is not visible through the app again, but it still is retained on the device, but with a different file extension. I was told that after viewing it would have the file extension ( .nodata )?

The alleged perps phone was seized and he had no advanced notice to delete anything. The guy is on probation for aggravated statutory rape of his kid so I would certainly like to be able to obtain any evidence if it exists.

Currently the alleged victim will not confirm that she sent the Snapchat photos to the alleged perp so it makes getting PC to check out the alleged perps phone a bit tough. So at this point I really need to get the photos out of the victims phone if possible.

I am going to assume that to obtain any physical data from the 4S that is will need to be jail broken first?

Does the file extension of a viewed ‘Snap’ exist as ‘.nodata ‘?

Does the father deleting the app from the device mess up the ability to obtain deleted image data?

My cellular forensic knowledge is pretty limited and my assumptions may be way off base.
Any assistance or input would be greatly appreciated.


Thanks!
_________________
Ed

I'm not a cellular technology expert, but I did stay at a Holiday Inn Express last night. 

hcso1510
Senior Member
 
 
  

Deleted Snapchat images on a 4S

Post Posted: Mon Apr 20, 2015 3:14 pm

Ed,

I am sure you already thought of this, but you might want to check to see if there is a mobile backup of the iPhone on the victim's computer.

iTunes mobile backup locations on computers:

A. Mac: ~/Library/Application Support/MobileSync/Backup/

B. Windows XP: \Documents and Settings\(username)\Application Data\Apple Computer\MobileSync\Backup\

C. Windows Vista, Windows 7, and Windows 8: \Users\(username)\AppData\Roaming\Apple Computer\MobileSync\Backup\I

If the victim synchronized the iPhone with iTunes on a PC prior to deletion of Snapchat, you may have more recoverable evidence from the mobile backup that iTunes created than the current iPhone.

Regards,

Larry  

UnallocatedClusters
Senior Member
 
 
  

Re: Deleted Snapchat images on a 4S

Post Posted: Thu Apr 23, 2015 4:14 pm

Ed,

I have seen the same "articles" or "posts" stating the .nodata extension, but I have had no luck recovering snapchat pictures or videos from any device.

I learned in an MPE class by AccessData that if an application is deleted from a cellular device the content may become available again from that application by reinstalling it to the device. The lesson was more on retrieving message content from databases that the application is using. As I have never tested this theory I wouldn't recommend doing so without testing on another 4S device (not evidence) and obviously after all other options have been exhausted.

As "UnalloctedClusters" stated, I would definitely check for backups of the device. I have found very fruitful evidence in many cases from backup files from the clients computer (that sometimes the client didn't even know was there!).

Good Luck!  

steveyo412
Newbie
 
 

Page 1 of 1