Snapchat Forensics for iOS
Snapchat is a widely known and commonly used app amongst social media users. This application was one of the first to introduce the concept of disappearing messages, photos, or videos after viewing. Forensic analysis has been performed on different aspects of the application, typically on Android devices, such as messaging, and photo and video sharing based on whether the message or photo really is “deleted” after the allotted 10 seconds. However, since such few analyses have been done on the forensics of this application on iOS devices, the aim of this study is to focus primarily on the application of forensics on Snapchat for iOS using Cellebrite and Magnet AXIOM and comparing the results of the analyzed data to see what can be recovered. Forensic analysis will be performed by the creation and population of user data on an iPhone using the latest version of Snapchat. The gap that will be addressed is assessing how messages and photos on the iOS Snapchat application are deleted as intended and if they are not, where they would be stored. The digital artifacts such as messages, photos, videos, stories, and location data were able to be recovered and where they were found during our analysis is also discussed. A comparison was made between the software used and which was able to recover the most amount of useful data that could be used during an investigation.