Snapchat: History and Digital Forensic Artefacts
Introduction
Snapchat is one of the world’s most popular multimedia messaging applications, allowing users to send photographs, videos, text messages, and other content that is designed to disappear after viewing.
Launched with a focus on privacy and temporary communication, Snapchat has transformed the social media landscape by introducing features such as Stories, disappearing messages, augmented reality filters, and location sharing.
The platform is widely used by individuals of all ages and is frequently encountered in digital forensic investigations involving criminal, civil, corporate, and family law matters.
Despite Snapchat’s reputation for ephemeral messaging, significant amounts of data may be recovered from mobile devices, cloud backups, and associated accounts.
As a result, Snapchat evidence can play an important role in investigations and court proceedings.
History of Snapchat
Snapchat was created in 2011 by Evan Spiegel, Bobby Murphy, and Reggie Brown while they were students at Stanford University.
Originally launched under the name “Picaboo,” the application was designed to allow users to send photographs that would automatically disappear after being viewed.
The application was subsequently renamed Snapchat and rapidly gained popularity, particularly among younger users. The concept of temporary messaging differentiated Snapchat from traditional social media platforms, where content was typically permanent.
Major developments in Snapchat’s history include:
- 2011 – Snapchat launched on Apple’s iOS platform.
- 2012 – Android version released.
- 2013 – Introduction of Snapchat Stories, allowing content to remain visible for 24 hours.
- 2015 – Launch of Discover, featuring content from publishers and media organisations.
- 2017 – Snap Inc. became a publicly traded company.
- 2018 onwards – Expansion of augmented reality lenses, Snap Map, Spotlight, and premium subscription services.
Today, Snapchat has hundreds of millions of active users worldwide and remains one of the most influential social networking applications.
Snapchat Forensic Artefacts
Although Snapchat is designed to minimise permanent storage of messages, various forensic artefacts may remain on devices and associated systems.
The availability of artefacts depends on factors such as device type, operating system version, application version, user activity, and whether data has been deleted.
Device Information
Investigators may identify:
- Installed Snapchat application details
- Application version information
- Installation and update timestamps
- Device identifiers linked to Snapchat accounts
User Account Artefacts
Potential artefacts include:
- Username
- Display name
- Email address
- Linked telephone number
- Account creation details
- Friends and contact lists
Message Artefacts
Although messages are intended to disappear, forensic examination may reveal:
- Sent and received chat metadata
- Message timestamps
- Communication records between users
- Cached message content
- Notification remnants
- Image and Video Artefacts
- Investigators may recover:
- Saved snaps
- Cached images and videos
- Media stored within Memories
- Thumbnail images
- Shared multimedia content
- Snapchat Memories
- Memories is Snapchat’s cloud-based storage feature and may contain:
- Archived photographs
- Archived videos
- Saved Stories
- Associated metadata
- Creation and upload timestamps
- Snap Map Artefacts
- Location-related evidence may include:
- Location sharing settings
- Last known locations
- Geographic metadata
- Location history remnants
- Cache and Temporary Files
- Mobile devices frequently store:
- Cached images
- Temporary media files
- Thumbnail databases
- Application logs
- Session information
- Cloud-Based Evidence
- Where legally obtainable, investigators may seek:
- Snapchat account records
- Login history
- Account activity information
- Device registration data
Metadata
Forensic analysis may identify:
- Timestamps
- Device identifiers
- GPS coordinates
- User account associations
- File creation and modification information
Conclusion
While Snapchat is marketed as a platform for temporary communication, digital forensic investigations often reveal a variety of artefacts that may be relevant to an investigation.
Data recovered from mobile devices, backups, cloud services, and application caches can provide valuable evidence regarding user activity, communications, media sharing, and location information.
Consequently, Snapchat remains an important source of digital evidence in both criminal and civil investigations.
About Athena Forensics
For information on our digital forensic services or if you require any advice or assistance please contact a member of our team on 0330 123 4448 or via email on enquiries@athenaforensics.co.uk, further details are available on our contact us page.
Our client’s confidentiality is of the utmost importance. All correspondence is treated with discretion, from initial contact to the conclusion of any computer forensics investigation.
Our digital forensic experts are fully aware of the significance and importance of the information that they encounter and we have been accredited to ISO 9001 for 10 years. Our forensic experts are all security cleared and we offer non-disclosure agreements if required. Our premises along with our security procedures have been inspected and approved by law enforcement agencies.
Athena Forensics do not disclose personal information to other companies or suppliers.
