Can Snapchat Data B...
 
Notifications
Clear all

Can Snapchat Data Be Extracted from an iPhone 8 iOS v.11.4.1

5 Posts
5 Users
0 Likes
2,169 Views
UnallocatedClusters
(@unallocatedclusters)
Posts: 577
Honorable Member
Topic starter
 

Colleagues,

I have an iPhone 8, iOS version 11.4.1 from which my client wants to extract Snapchat evidence to produce in a case.

The iPhone 8 is my client's phone and I have full access to the phone's content.

I have Cellebrite PA and MOBILedit Forensic Express tools.

Has anyone had success extracting Snapchat communications from an iPhone 8 iOS v.11.4.1?

How about the following collection vector??

1) Install Bluestacks Android emulator on my forensic workstation (https://www.bluestacks.com)

2) Install Snapchat on the Bluestacks Android emulator.

3) Log in to my client's Snapchat account using the Bluestacks Android emulator on my forensic workstation.

4) Synchronize the Snapchat account, which will *hopefully* pull in the desired Snapchat data that exists currently on my client's iPhone 8.

5) Perform a forensic collection of the Bluestacks data and extract Snapchat evidence.

 
Posted : 24/07/2018 9:04 pm
4Rensics
(@4rensics)
Posts: 255
Reputable Member
 

That certainly sounds viable. I've never used BlueStacks so can't answer the question on what you could acquire, but in the same vain, if that didn't work, you could potentially do the same technique but install and log into SnapChat on an Android device that allows a full physical (if you had one to hand obvs) That should work. I've done full physicals on numerous Android devices and recovered SnapChat data (mainly Stories and Messages)

Good luck.

 
Posted : 25/07/2018 8:21 am
passcodeunlock
(@passcodeunlock)
Posts: 792
Prominent Member
 

We just saved the Snapchat messages in a case using a rooted MTK based Android phone synchronized with the relevant Snapchat user account data.

The relevant data from our MTK physical dump was validated against the original Apple device, everything is ok.

 
Posted : 25/07/2018 9:58 am
(@jchan)
Posts: 1
New Member
 

Hi

Iphone analysis

If i was using the snapchat upto 5pm, and then uninstalled it a 8pm , would l loose all the local date regarding the application start and stop during 5pm>8pm?

What if any information would be available for that time period 5pm>8pm?

 
Posted : 17/06/2019 2:15 pm
(@cs1337)
Posts: 83
Trusted Member
 

very interesting with using a bluestacks android emulator. What did you use to parse the data after collecting it? I'm wondering if i can leverage this for a WeChat collection

 
Posted : 02/07/2019 6:28 pm
Share: