Analyzing Residual Snapchat Data on iOS for Digital Triage
What happens when a key application is no longer present on a device? This white paper explores how investigators can use residual data from an Advanced Logical acquisition to identify traces of a deleted Snapchat application on iOS. It examines Bundle IDs, network usage, messaging activity, SQLite databases and other artefacts that, when viewed collectively, can help indicate that an application previously existed on a device and support further investigative enquiries.