Deleted Snapchat images on a 4S
Our agency recently received consent to search an iPhone 4S. My understanding is that a young lady was sending digital images to a much older male through Snapchat.
The father of the young lady found out she was using the Snapchat app and he deleted it from the device.
Several moons ago I was told that after a ‘Snap’ is viewed it is not visible through the app again, but it still is retained on the device, but with a different file extension. I was told that after viewing it would have the file extension ( .nodata )?
The alleged perps phone was seized and he had no advanced notice to delete anything. The guy is on probation for aggravated statutory rape of his kid so I would certainly like to be able to obtain any evidence if it exists.
Currently the alleged victim will not confirm that she sent the Snapchat photos to the alleged perp so it makes getting PC to check out the alleged perps phone a bit tough. So at this point I really need to get the photos out of the victims phone if possible.
I am going to assume that to obtain any physical data from the 4S that is will need to be jail broken first?
Does the file extension of a viewed ‘Snap’ exist as ‘.nodata ‘?
Does the father deleting the app from the device mess up the ability to obtain deleted image data?
My cellular forensic knowledge is pretty limited and my assumptions may be way off base.
Any assistance or input would be greatly appreciated.
I am sure you already thought of this, but you might want to check to see if there is a mobile backup of the iPhone on the victim's computer.
iTunes mobile backup locations on computers
A. Mac ~/Library/Application Support/MobileSync/Backup/
B. Windows XP \Documents and Settings\(username)\Application Data\Apple Computer\MobileSync\Backup\
C. Windows Vista, Windows 7, and Windows 8 \Users\(username)\AppData\Roaming\Apple Computer\MobileSync\Backup\I
If the victim synchronized the iPhone with iTunes on a PC prior to deletion of Snapchat, you may have more recoverable evidence from the mobile backup that iTunes created than the current iPhone.
I have seen the same "articles" or "posts" stating the .nodata extension, but I have had no luck recovering snapchat pictures or videos from any device.
I learned in an MPE class by AccessData that if an application is deleted from a cellular device the content may become available again from that application by reinstalling it to the device. The lesson was more on retrieving message content from databases that the application is using. As I have never tested this theory I wouldn't recommend doing so without testing on another 4S device (not evidence) and obviously after all other options have been exhausted.
As "UnalloctedClusters" stated, I would definitely check for backups of the device. I have found very fruitful evidence in many cases from backup files from the clients computer (that sometimes the client didn't even know was there!).