Overview

For those of us who don’t have access to those GrayKey boxes or Cellebrite services to acquire physical images of devices, we are generally reliant upon logical extractions of iOS due to legal limitations or similar. After a recent enquiry relating to snapchat data and what was held on a device, I later found out that Snapchat have a download your data service much like Google Takeout.

I had a look into what data is held online and accessible by the user with their basic login. As it happens, as long as you have permission to access the account online, there’s quite a wealth of metadata available.

Points of Interest from an investigative standpoint

I’ve summarised some of the main points I think are interesting. The majority of these I believe would be more useful in criminal matters such as harassment, stalking, sexual abuse or missing person cases but are certainly interesting when considering the lack of available information from the device.

• Contains Account Creation dates, devices used with the account
• • Useful if there is a dispute over dates of communication and whether there are further devices involved
• Snap and chat history (no content and goes back at least as far as 1 month back)
• • Shows communication between specific individuals
• Lists of friends, friend requests sent, friends blocked, friends deleted  (no timestamps)
• • Any of these could be useful in identifying attempted communication or attempted ceasing communication with an individual.
• Search history (Including search term and Lat, Long coordinates from where those searches were performed)
• • Could indicate some form intent if searching for a specific individual
• Frequent locations, locations you have visited and Latest location

To download your Snapchat data

1. Login using account credentials and browse to: https://accounts.snapchat.com/accounts/downloadmydata
2. Once you’re in, scroll to the bottom of the page and hit ‘Submit Request’
3. Wait…
4. You should receive an email to the account used to set up the Snapchat account containing a hyperlink to the download page.
5. Alternatively, if you log back in the zip file will be available on the /downloadmydata page.

Once you download the data, it’ll be much like the format of a google takeout download, html and JSON.

and that’s it…

If you’re in a bit of a pickle and lacking device data, downloading account data directly from Snapchat may be a second best alternative.