After reading our previous article on how Decipher Forensics had managed to find and restore expired Snapchats on Android devices, a photographer named Nick got to thinking that he might be able to do the same thing on his jailbroken iPhone.
The idea was that, since these snaps were simply saved in a folder in the file system, he should be able to use an app such as iFile to browse to that folder and see, save or even e-mail them to himself. It turns out he can, and it only took Nick 10 minutes to figure out where “deleted” Snapchat videos were stored.
So far he’s only been able to find where the video files are stored, but there’s no reason to believe one couldn’t also find those .NOMEDIA images somewhere in the iOS file system if they’re patient enough to dig for them. The path to the videos from the root is: var, mobile, applications, the alphanumeric code for the Snapchat app, and tmp.
It’s that second to last folder that was hardest to find. There doesn’t seem to be any rhyme or reason to this code (Nick’s was something along the lines of 20D36FE4….), so it may take you a while to find the right folder. Once you do, however, you have access to all of the Snapchat videos you’ve received, as well as the most recent video you sent, which is saved under the filename “filtered” whether or not you ever sent it.
As further proof of concept, Nick took an expired video of his friend, emailed it to himself, saved it to the camera roll on his phone, posted it to Facebook and tagged the friend in it. All of this was done without having to involve a computer at all. Last we heard, Decipher Forensics was still trying to find expired snaps on iOS, having only cracked Android. It seems Nick has already done half of their work for them.