'Deleted' Snapchat photos saved in phone data, can be examined as evidence

'Deleted' Snapchat photos saved in phone data, can be examined as evidence


7 photos
Save Story
Leer en español

Estimated read time: 3-4 minutes

This archived news story is available only for your personal, non-commercial use. Information in the story may be outdated or superseded by additional information. Reading or replaying the story in its archived form does not constitute a republication of the story.

OREM — Not so fast, Snapchat. Those 10-seconds-or-less pictures appear to have a much longer life, deep inside of smartphones.

Orem-based firm Decipher Forensics said it has derived a method to extract the supposedly no-longer-viewable images and pass them on to parents, lawyers and law enforcement.

"The actual app is even saving the picture," said Richard Hickman, a digital forensics examiner. "They claim that it's deleted, and it's not even deleted. It's actually saved on the phone."

On average, he said, it takes about six hours, but most of the time is spent simply imaging the phone's data.

"There's a folder called RECEIVED_IMAGES_SNAPS," Hickman explained, pointing at his computer screen. "And here they are."

Hickman said the Decipher Forensics team had only perfected the steps for extracting pictures from Android phones. He said he was currently developing the capability to do the same with Snapchat for iPhones.

The reason the photos don't vanish appears to be due to the way the makers of Snapchat designed the program. Hickman said that rather than have the program delete the files, it affixes the file extension ".NOMEDIA."

That extension makes the pictures unviewable to most people, but Hickman said forensics experts have the capability to simply take the files out of the phone and change the .NOMEDIA extension. The pictures are then viewable once again.

"I knew that I deleted that one," said Hickman, pointing to an image of a Sith Lord figurine. "Along with that one. I looked at those in Snapchat and here they are, still here."


The actual app is even saving the picture. They claim that it's deleted and it's not even deleted. It's actually saved on the phone.

–Richard Hickman, digital forensics examiner


Hickman posted his research online. The 24-year-old completed the study in conjunction with a mobile forensics course at Utah Valley University.

Decipher Forensics was also working to tie sender information to the pictures. Hickman said it's something he hadn't been able to do yet, but expressed confidence he could make that link in time.

Ironically, Hickman said pictures taken through the basic camera on an Android phone were actually more difficult to trace than the Snapchat photos.

"Then it's most likely put into unallocated space, where here it's actually allocated," Hickman said. "It's not that it's deleted — it just isn't mapped anymore. It says, OK, that spot where that picture was stored is now available to be overwritten. That's what would happen with a regular camera."

Snapchat had not yet replied to a request for a response Wednesday.

The app has been described as almost the "anti-Facebook," promising an alternative to the Facebook posts that seem to be immortalized forever online.

Related:

To date, Snapchat is the ninth most popular free app in the Apple app store. It has been especially popular with teens.

Still, law enforcement has expressed concerns about Snapchat being used as a platform for "sexting."

"If you want to send someone a picture, send it to them through Instagram," said Orem Police Lt. Craig Martinez. "It's still there. Everybody can see it."

Martinez, also a digital forensics investigator, wasn't entirely surprised with Decipher's discovery, considering almost anything can be uncovered on a phone, just like a traditional computer.

Martinez said if he has concerns about an app, he simply tells his children they can't use it.

"Be careful what you do on your cell phone, what you put on your cell phone," he cautioned. "Because once it's there, chances are it's going to be there for a really long time, even if you can't see it."

Hickman said it costs a family between $300 and $500 to forensically examine Snapchat photos. The company also works with lawyers and law enforcement.

Decipher Forensics also pushes parents to its website to find information about software that can be downloaded onto children's phones to track their computer and cell phone activity.

Photos

Related stories

Most recent Utah stories

Related topics

Utah
Andrew Adams

    STAY IN THE KNOW

    Get informative articles and interesting stories delivered to your inbox weekly. Subscribe to the KSL.com Trending 5.
    By subscribing, you acknowledge and agree to KSL.com's Terms of Use and Privacy Policy.

    KSL Weather Forecast