Snapchat open source intelligence investigation methods

Snapchat is a multimedia instant messaging application and service whose main feature is "burn after reading". Users can use Snapchat to take photos, record videos, add text and drawings, and send them to their friends list on the app. These photos and videos are called " Snaps," and all photos have a life span of 1 to 10 seconds. After a user takes a photo and sends it to a friend, the photo is automatically destroyed on time, according to the user's pre-determined schedule.

Snapchat content can appear in a variety of formats that can provide investigators with useful information.

1. Search Snapchat by location

If the user has device-level location services turned on and selected, snaps will collect location data at various points in time during the user's Snapchat usage. However, users can keep and delete their location data in the application settings, which means that location data is not always available.

Snapmap is an official Snapchat map that enables the public to view publicly available geotagged snaps by embedded location. A publicly available snap is one in which the user has location data turned on on their device and has selected the location service in the Snapchat app settings. Investigators can use Snapmap to perform map/location-driven searches of public Snapchat content.

Investigators can manually move to any location in the world and view public snaps posted from any location by clicking on the location on the map.

Snapmap is a heat map that shows high-density areas of public snaps arranged by color, from low and blue to high and red.

In addition to manually navigating to a location in Snapmap, you can also jump to a location using the URL action.

2. View recent public snaps of Snapchat users

Investigators can use the Snapchat URL to determine if an account is associated with a username and to view any recent public snaps made by that account.

To determine whether a username is valid and whether a Snapchat account is associated with it, enter the username into the Snapchat app search bar, which is located in the upper left corner of the app under the magnifying glass icon.

Or enter it into the following content URL, https://www.snapchat.com/add/username, replacing "username" with the target username.

3. Snapchat indexing sites

There are several sites that offer Snapchat users the ability to log in and register their sites. Most of them are focused on dating.

They offer the opportunity to search their database. And because users of these sites can provide additional information there (such as their gender, age, hobbies, etc.), it might be interesting to see if usernames found on Snapchat pop up there as well.

Keep in mind that people who appear on these sites must register themselves. This is not a copy of the Snapchats database.

For example, Ghostcodes.com.

4. Searching for phone numbers

If you want to know if a phone number is associated with a Snapchat account, simply add the number to your phone contacts in your smartphone and then sync your contacts with Snapchat. If there is a match, you will see the username on the screen.

Next, click the outline icon in the upper right corner of the screen. Select All Contacts to see if anyone in your contacts has a Snapchat profile.

5. Extract Snapchat content

Public snaps, including those identified in Snapmap and Stories, can be downloaded manually in the browser.

To download snaps from Snapmap, proceed as follows:

1. You can open Developer Tools by clicking F12 or right-clicking on the page and selecting Inspect.

2. In the Developer Tools menu, select the Network tab, and then select the Media sub-tab.

3. If the Data section of Media is empty, you may need to refresh the page using the Refresh button or by clicking Ctrl+R.

4. Right-click on the Snapshot link and click to open it in a new tab.

Similarly, the same process can be used to download videos from a Snapchat user's Stories. To download snaps from Stories:

1. Click F12 or right-click the page and select Check to open Developer Tools.

2. In the Developer Tools menu, select the Network tab, and then select the Media sub-tab.

3. If the Data section of Media is empty, you may need to refresh the page using the Refresh button or by clicking Ctrl+R.

4. Right-click on the video link and click to open it in a new tab. Alternatively, find the video under the title, copy and paste the URL into a new tab, or in the Preview tab, right-click the video and select Open it in a new tab.

5. After opening the video in a new window, you can play the video.

6. In the bottom right corner of the video, there will be an options button with 3 dots.

7. Clicking on the "Options" button will open a list of options. Click the "Download" button to save the video to your device.

At this point, we may notice a blurry part on the screen due to the fact that the overlay tab has been removed. By default, snaps removes the user-added graphic overlay from the public story. However, this overlay layer can be re-added to snaps and displayed by manipulating the URL to allow investigators to view the original video as it is uploaded.

In the following URL https://s.sc-cdn.net//default/media.mp4, replace "media.mp4" with "embedded.mp4"

After changing the URL, the overlay will be visible on the video.