10 ms·

Snaprecovery: Recover old Snaps that have “disappeared” from Snapchat

84 points by blopeur 5y ago

treesknees 5y ago
>We don't need any forensics tools. We can simply use adb pull to fetch the files because they are never deleted. But once you logout from the app and after Snapchat deletes the Snaps, you will need the right forensics tools to recover the files. This feels like a bug, no? I don't see any logical reason for Snapchat to keep the files around that long.
- deleted 5y ago
  [deleted]
- jjeaff 5y ago
  I don't think an app has the kind of low level access required to actually wipe something from memory. Unless android has an API with a function to do so. I assume you are just telling the OS to delete the file and the OS does that however it normally does that. Truly wiping a file from storage requires overwriting it with random data.
  - fragmede 5y ago
    With wear leveling and modern filesystems, it's harder than that actually overwrite the file on disk (for modern definitions of the word disk). The operating system will ask the storage device to delete the data, but there aren't actually guarantees that the storage device actually listened to the operating system's request to delete the data.
    - m4rtink 5y ago
      Which is why if you care about sensitive data not being recoverable from failed media (eq. banking database, PII, mediacal records, etc.) you should always use full disk encryption (LUKS, bitkeeper, veracrypt, etc.). That way anything one could recover from that device afterwards would be effectively random noise to them without the decryption key, regardless how the firmware of the device actually wrote the individual data blocks.
      - swiley 5y ago
        Or run from tmpfs without swap.
  - jaywalk 5y ago
    That doesn't seem to be the case here, because the files are actually deleted once the user logs out of Snapchat. So it's obviously the Snapchat app itself that is triggering the file deletion, not the OS.
    - pessimizer 5y ago
      The person you're replying to is referring to making the files unrecoverable. The word most often used is "shred." edit: The Snapchat app, like the vast majority of applications, asks the OS to delete files. It very probably doesn't have any direct access to I/O.
      - treesknees 5y ago
        Seems like an API that the OS should expose. I'm sure other apps like banking/financial would benefit from this, too.
- lazyjeff 5y ago
  At the end of the day, the data has to live somewhere. If not on disk, then in memory or straight from the network. If the device is rooted, then the user would technically have access to any of these, so it doesn't really matter.
  - rideontime 5y ago
    But these are opened snaps. They don't have to live somewhere because they're supposed to be dead.
    - DavidPeiffer 5y ago
      I believe Snapchat has an option to reopen the snap you just viewed, but I don't think it's available for very long - maybe a couple minutes after viewing tops? No excuse I can think of for the media existing for more than a few minutes post-viewing.
    - dexterhaslem 5y ago
      yea this is ridiculous, they have lied through their teeth about what happens on Android. tho of course its probably half clueless negligence or a missed change, half not caring. all the same
- RicoElectrico 5y ago
  App developers on Android rarely bother to clean their app caches. Open Apps in settings, sort by size, check top entries and you'll be surprised. Explain to me why the hell does Instagram need 500 MB of cache. Kind of a bummer I don't know of any method to mass clear cache data of all apps on my non-rooted Galaxy S8. It'd save a lot of space and was possible on ancient HTC phones with Android 2.3.5. Edit: I experimented with wiping cache partition in recovery mode, but this ain't it - as the name suggests it's a separate partition.
  - Ashanmaril 5y ago
    Doesn't seem much better on iOS. I just checked and I've got Twitter with 2.59GB, Instagram with 1.27GB, TikTok with 1.21GB, etc.
    - marcellus23 5y ago
      Not sure about Android but iOS will automatically clear caches only if your free storage gets low. So if you have a lot of storage space, those numbers are probably expected.
    - Pxtl 5y ago
      This is why I just use the Twitter website on my phone.
  - neilv 5y ago
    If an app can accumulate 500MB of cache without pain to the app developer, I suspect cache management programming will remain a practice&skill mostly only for only systems programmers and the more bespoke backend programmers. I assume Insta invests in engineering for whatever cache expiration they do. And if there's 500MB cache, probably it's a conscious engineering decision. But maybe the majority app developers, if they could fill up cache, probably aren't thinking that far ahead -- not thinking about that non-visual, non-customer-story aspects. So most wouldn't have occasion to learn how to do cache management sufficiently well that they don't cause stability or performance problems.
    - 5y ago
deleted 5y ago
[deleted]
heavyset_go 5y ago
Last time I looked back in ~2016, Snapchat also persisted chat text contents in the Android app's SQLite database even after the messages "expired".
forgotmypw17 5y ago
Snapchat is user disempowerment patterns taken to their logical conclusion: The developer has full access to all their data, while the users have none. The other big players have been moving in that direction, making it less and less accessible and exportable, but Snap takes the cake.
- Slippery_John 5y ago
  > The other big players have been moving in that direction Not so, TikTok actively lets you download videos in a convenient format. I think that helped it grow too, since they embed a watermark and add a splash screen at the end. Certainly that's how I first found out about the platform. That said, this seems to be disabled in some regions (not sure if you can opt in).
  - forgotmypw17 5y ago
    What about "view once" videos?
deleted 5y ago
[deleted]
jamal-kumar 5y ago
Does anyone else remember when it was possible to extract snapchat messages that haven't been viewed yet because they had some ridiculously easy to find encryption key, hardcoded in the app? It was found running 'strings' and trying each one for the key and boom, one little script and you could just do this really easy for a long time even after knowledge of how to do it had been made public. This was so long ago, not sure what they did to change this at all -- No surprise at all they don't random-out the files here.
- heavyset_go 5y ago
  > Does anyone else remember when it was possible to extract snapchat messages that haven't been viewed yet because they had some ridiculously easy to find encryption key, hardcoded in the app? In ~2016 on Android, incoming messages that haven't been read yet weren't encrypted at all. You could just look at the app's SQLite database and find the message contents somewhere in the message table. The sending party would never known you had read it.
Causality1 5y ago
This is neat but I suspect its practical value isn't that high. The type of people who want permanent access to incoming snaps just run screen recorder software.

84 points by blopeur 5y ago

>We don't need any forensics tools. We can simply use adb pull to fetch the files because they are never deleted. But once you logout from the app and after Snapchat deletes the Snaps, you will need the right forensics tools to recover the files. This feels like a bug, no? I don't see any logical reason for Snapchat to keep the files around that long.

deleted 5y ago
[deleted]
jjeaff 5y ago
I don't think an app has the kind of low level access required to actually wipe something from memory. Unless android has an API with a function to do so. I assume you are just telling the OS to delete the file and the OS does that however it normally does that. Truly wiping a file from storage requires overwriting it with random data.
- fragmede 5y ago
  With wear leveling and modern filesystems, it's harder than that actually overwrite the file on disk (for modern definitions of the word disk). The operating system will ask the storage device to delete the data, but there aren't actually guarantees that the storage device actually listened to the operating system's request to delete the data.
  - m4rtink 5y ago
    Which is why if you care about sensitive data not being recoverable from failed media (eq. banking database, PII, mediacal records, etc.) you should always use full disk encryption (LUKS, bitkeeper, veracrypt, etc.). That way anything one could recover from that device afterwards would be effectively random noise to them without the decryption key, regardless how the firmware of the device actually wrote the individual data blocks.
    - swiley 5y ago
      Or run from tmpfs without swap.
- jaywalk 5y ago
  That doesn't seem to be the case here, because the files are actually deleted once the user logs out of Snapchat. So it's obviously the Snapchat app itself that is triggering the file deletion, not the OS.
  - pessimizer 5y ago
    The person you're replying to is referring to making the files unrecoverable. The word most often used is "shred." edit: The Snapchat app, like the vast majority of applications, asks the OS to delete files. It very probably doesn't have any direct access to I/O.
    - treesknees 5y ago
      Seems like an API that the OS should expose. I'm sure other apps like banking/financial would benefit from this, too.
lazyjeff 5y ago
At the end of the day, the data has to live somewhere. If not on disk, then in memory or straight from the network. If the device is rooted, then the user would technically have access to any of these, so it doesn't really matter.
- rideontime 5y ago
  But these are opened snaps. They don't have to live somewhere because they're supposed to be dead.
  - DavidPeiffer 5y ago
    I believe Snapchat has an option to reopen the snap you just viewed, but I don't think it's available for very long - maybe a couple minutes after viewing tops? No excuse I can think of for the media existing for more than a few minutes post-viewing.
  - dexterhaslem 5y ago
    yea this is ridiculous, they have lied through their teeth about what happens on Android. tho of course its probably half clueless negligence or a missed change, half not caring. all the same
RicoElectrico 5y ago
App developers on Android rarely bother to clean their app caches. Open Apps in settings, sort by size, check top entries and you'll be surprised. Explain to me why the hell does Instagram need 500 MB of cache. Kind of a bummer I don't know of any method to mass clear cache data of all apps on my non-rooted Galaxy S8. It'd save a lot of space and was possible on ancient HTC phones with Android 2.3.5. Edit: I experimented with wiping cache partition in recovery mode, but this ain't it - as the name suggests it's a separate partition.
- Ashanmaril 5y ago
  Doesn't seem much better on iOS. I just checked and I've got Twitter with 2.59GB, Instagram with 1.27GB, TikTok with 1.21GB, etc.
  - marcellus23 5y ago
    Not sure about Android but iOS will automatically clear caches only if your free storage gets low. So if you have a lot of storage space, those numbers are probably expected.
  - Pxtl 5y ago
    This is why I just use the Twitter website on my phone.
- neilv 5y ago
  If an app can accumulate 500MB of cache without pain to the app developer, I suspect cache management programming will remain a practice&skill mostly only for only systems programmers and the more bespoke backend programmers. I assume Insta invests in engineering for whatever cache expiration they do. And if there's 500MB cache, probably it's a conscious engineering decision. But maybe the majority app developers, if they could fill up cache, probably aren't thinking that far ahead -- not thinking about that non-visual, non-customer-story aspects. So most wouldn't have occasion to learn how to do cache management sufficiently well that they don't cause stability or performance problems.
  - 5y ago

deleted 5y ago

[deleted]

heavyset_go 5y ago

Last time I looked back in ~2016, Snapchat also persisted chat text contents in the Android app's SQLite database even after the messages "expired".

forgotmypw17 5y ago

Snapchat is user disempowerment patterns taken to their logical conclusion: The developer has full access to all their data, while the users have none. The other big players have been moving in that direction, making it less and less accessible and exportable, but Snap takes the cake.

Slippery_John 5y ago
> The other big players have been moving in that direction Not so, TikTok actively lets you download videos in a convenient format. I think that helped it grow too, since they embed a watermark and add a splash screen at the end. Certainly that's how I first found out about the platform. That said, this seems to be disabled in some regions (not sure if you can opt in).
- forgotmypw17 5y ago
  What about "view once" videos?

deleted 5y ago

[deleted]

jamal-kumar 5y ago

Does anyone else remember when it was possible to extract snapchat messages that haven't been viewed yet because they had some ridiculously easy to find encryption key, hardcoded in the app? It was found running 'strings' and trying each one for the key and boom, one little script and you could just do this really easy for a long time even after knowledge of how to do it had been made public. This was so long ago, not sure what they did to change this at all -- No surprise at all they don't random-out the files here.

heavyset_go 5y ago
> Does anyone else remember when it was possible to extract snapchat messages that haven't been viewed yet because they had some ridiculously easy to find encryption key, hardcoded in the app? In ~2016 on Android, incoming messages that haven't been read yet weren't encrypted at all. You could just look at the app's SQLite database and find the message contents somewhere in the message table. The sending party would never known you had read it.

Causality1 5y ago

This is neat but I suspect its practical value isn't that high. The type of people who want permanent access to incoming snaps just run screen recorder software.