Snapchat is an image-sharing and text-messaging service with over 100,000,000 downloads. Its signature feature is that images and videos sent will "self-destruct" after a time limit set by the sender, from 1-10 seconds. Furthermore, if a user takes a screenshot of the image, the sender is notified.Text chats do not have an expiration timer.
Package name: com.snapchat.android
Files of interest:
- /cache/stories/received/thumbnail/
- /sdcard/Android/data/com.snapchat.android/cache/my_media/
- /shared_prefs/com.snapchat.android_preferences.xml
- /databases/tcspahn.db
/cache/stories/received/thumbnail contains thumbnails of pictures taken by the user on the device. The /sdcard path contains the full-sized images. These remain even after the time limit has expired and the recipient can no longer access them. The files in both of these locations may not have proper file extensions.
The com.snapchat.android_preferences.xml file contains the email address used to create an account, and the phone number of the device registered with the account.
The tcspahn.db database contains all other information about the app's usage:
|
Table |
Description |
|
Chat |
Lists all text chats. Shows the sender, recipient, timestamp in Linux epoch time, and the text of the message. |
|
ContactsOnSnapchat |
Shows all users in the user's phonebook who also have Snapchat installed. The isAddedAsFriend column will show a 1 if the user has actually been added as a contact. |
|
Conversation |
Has information about each open conversation. Includes the sender and recipient, and the timestamp of the last sent and received snaps in Linux epoch format. |
|
Friends |
Similar to ContactsOnSnapchat, but only includes users who have been added as a friend. Includes the timestamp that each user added the other. |
|
ReceivedSnaps |
Metadata about received images and videos. Once the image/video is viewed, it appears to be removed from this table at some point. Contains a timestamp for each message, a status, whether or not a snap was screenshot, and the sender. |
|
SentSnaps |
Metadata about sent images and videos. Once the image/video is viewed, it appears to be removed from this table at some point. Contains a timestamp for each message, a status, and the recipient. |