Join Us!

Can Snapchat Data B...
 
Notifications
Clear all

Can Snapchat Data Be Extracted from an iPhone 8 iOS v.11.4.1  

  RSS
UnallocatedClusters
(@unallocatedclusters)
Senior Member

Colleagues,

I have an iPhone 8, iOS version 11.4.1 from which my client wants to extract Snapchat evidence to produce in a case.

The iPhone 8 is my client's phone and I have full access to the phone's content.

I have Cellebrite PA and MOBILedit Forensic Express tools.

Has anyone had success extracting Snapchat communications from an iPhone 8 iOS v.11.4.1?

How about the following collection vector??

1) Install Bluestacks Android emulator on my forensic workstation (https://www.bluestacks.com)

2) Install Snapchat on the Bluestacks Android emulator.

3) Log in to my client's Snapchat account using the Bluestacks Android emulator on my forensic workstation.

4) Synchronize the Snapchat account, which will *hopefully* pull in the desired Snapchat data that exists currently on my client's iPhone 8.

5) Perform a forensic collection of the Bluestacks data and extract Snapchat evidence.

Quote
Posted : 24/07/2018 10:04 pm
4Rensics
(@4rensics)
Active Member

That certainly sounds viable. I've never used BlueStacks so can't answer the question on what you could acquire, but in the same vain, if that didn't work, you could potentially do the same technique but install and log into SnapChat on an Android device that allows a full physical (if you had one to hand obvs) That should work. I've done full physicals on numerous Android devices and recovered SnapChat data (mainly Stories and Messages)

Good luck.

ReplyQuote
Posted : 25/07/2018 9:21 am
passcodeunlock
(@passcodeunlock)
Senior Member

We just saved the Snapchat messages in a case using a rooted MTK based Android phone synchronized with the relevant Snapchat user account data.

The relevant data from our MTK physical dump was validated against the original Apple device, everything is ok.

ReplyQuote
Posted : 25/07/2018 10:58 am
JChan
(@jchan)
New Member

Hi

Iphone analysis

If i was using the snapchat upto 5pm, and then uninstalled it a 8pm , would l loose all the local date regarding the application start and stop during 5pm>8pm?

What if any information would be available for that time period 5pm>8pm?

ReplyQuote
Posted : 17/06/2019 3:15 pm
cs1337
(@cs1337)
Member

very interesting with using a bluestacks android emulator. What did you use to parse the data after collecting it? I'm wondering if i can leverage this for a WeChat collection

ReplyQuote
Posted : 02/07/2019 7:28 pm
Share: