Snapchats Don’t Disappear

Snapchats Don’t Disappear: Forensics Firm Has Pulled Dozens of Supposedly-Deleted Photos From Android Phones

Another way to undermine Snapchat’s privacy promises

A 24-year-old forensics examiner from Utah has made a discovery that may make some Snapchat users think twice before sending a photo that they think is going to quickly disappear. Richard Hickman of Decipher Forensics found that it’s possible to pull Snapchat photos from Android phones simply by downloading data from the phone using forensics software and removing a “.NoMedia” file extension that was keeping the photos from being viewed on the device. He published his findings online and local TV station KSL has a video showing how it’s done.

“I was surprised no one else had done it because of how easy it was,” said Hickman by phone. “It just took a couple of days to discover it.”

Hickman started the research while in a Mobile Forensics Class this spring. He says it’s come in useful at Decipher Forensics as clients have wanted Snapchat evidence from phones in divorce and missing teenager cases. He says they have grabbed 60 to 70 deleted Snapchats from phones so far, with at least 40 photos taken from just one phone.

Hickman says he’s now doing research on Snapchat recovery from the iPhone; a few months ago, Buzzfeed found at least one flaw that made that possible. At the time, Snapchat founder Evan Spiegel told Buzzfeed, “The people who most enjoy using Snapchat are those who embrace the spirit and intent of the service. There will always be ways to reverse engineer technology products — but that spoils the fun!”

If you don’t want to spoil the fun, don’t send photos to someone via Snapchat that could one day be used against you in a court of law.

Snapchat has not responded to a request for comment. I’m curious whether the Federal Trade Commission — which is the federal agency responsible for investigating companies for deceptive or misleading practices — will be taking a closer look at Snapchat and its claims to users that photos are deleted. This exploit seems like a rather simple one.