The beauty of Snapchat, a popular photo-sharing app, is that photos disappear moments after picture messages are sent. They can never be resurfaced by the sender, and the recipient can’t view the image for more than a few seconds before it self-destructs.
But apparently Snapchat doesn’t actually delete the photos. It just buries them deep inside a device. A digital forensics examiner named Richard Hickman has found a way to resurface the private pictures on Androids.
Hickman, 24, took a mobile forensics course at Utah Valley University. During his research there, he discovered that Snapchat stores every photo in a folder called “RECEIVED_IMAGES_SNAPS.” An extension, “.NOMEDIA” is added to each photo file which makes them hard – but not impossible – to find.
“The actual app is even saving the picture,” Hickman tells KSL.com. “They claim that it’s deleted, and it’s not even deleted. It’s actually saved on the phone.”
Decipherforensics.comSnapchat storage structure, uncovered by Hickman.When Hickman changed the .NOMEDIA extension, the photos were viewable again.
“It’s not that [a photo is] deleted — it just isn’t mapped anymore,” Hickman says. “It says, OK, that spot where that picture was stored is now available to be overwritten. That’s what would happen with a regular camera.”
On average, it takes Hickman six hours to resurface the photos on Androids, depending on how much data is stored on the device. He’s still cracking the Snapchat code on iPhones.
He’s detailed the full methodology for resurfacing Snapchat photos, here. Snapchat has not given a public statement about Hickman’s findings.
Here’s a video of Hickman explaining his findings:
Business Insider Emails & Alerts
Site highlights each day to your inbox.