# Forensic Analysis of the Snapchat iOS App with Spectacles-Synced Artifacts

Logan Vanputte, Gokila Dorai, Andrew Clark Iv, Rayna Mock, Josh Brunty

► To cite this version:

Logan Vanputte, Gokila Dorai, Andrew Clark Iv, Rayna Mock, Josh Brunty. Forensic Analysis of the Snapchat iOS App with Spectacles-Synced Artifacts. 18th IFIP International Conference on Digital Forensics (DigitalForensics), Jan 2022, Virtual, United States. pp.65-81, 10.1007/978-3-031-10078-9_4. hal-05315737

HAL Id: hal-05315737

https://inria.hal.science/hal-05315737v1

Submitted on 15 Oct 2025

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
<figure><img src="image_2.png" /></figure>

ifip

International Federation for Information Processing

This document is the original author manuscript of a paper submitted to an IFIP
conference proceedings or other IFIP publication by Springer Nature. As such, there
may be some differences in the official published version of the paper. Such
differences, if any, are usually due to reformatting during preparation for publication or
minor corrections made by the author(s) during final proofreading of the publication
manuscript.
Chapter 4

FORENSIC ANALYSIS OF THE
SNAPCHAT iOS APP WITH
SPECTACLES-SYNCED ARTIFACTS

Logan VanPutte, Gokila Dorai, Andrew Clark IV, Rayna Mock and Josh Brunty

**Abstract** The Spectacles wearable smart glasses device from Snapchat records snaps and videos for the Snapchat service. A Spectacles device can sync data with a paired smartphone and upload recorded content to a user's online account. However, extracting and analyzing data from a Snapchat app is challenging due to the disappearing nature of the media. Very few commercial tools are available to obtain data from Snapchat apps.

This chapter focuses on the extraction and analysis of artifacts from
Snapchat and, specifically, Spectacles devices paired with Apple iPhones.
A methodology is presented for forensically imaging Apple iPhones be-
fore and after critical points in the Spectacles and Snapchat pairing
and syncing processes. The forensic images are examined to reveal
the effects of each step of the pairing process. Several photos, videos,
 thumbnails and metadata files originating from Spectacles devices were
obtained and tied to specific times, devices and locations. The research
provides interesting insights into evidence collection from Spectacles de-
vices paired with Apple iPhones.

**Keywords:** Wearable devices, Snapchat, Spectacles, iOS apps, iPhones, evidence

1. Introduction

Snapchat, originally launched as Picaboo [8, 11], is a social-media
mobile messaging application with related desktop and web applica-
tions [22, 24] that is used for multimedia instant messaging and commu-
nications. Manufactured by Snap of Santa Monica, California, Snapchat
is a very popular application – as of 2020, it had more than 347 million
global users active each month, the vast majority of them in India and
the United States [27, 29]. Since 2018, Snapchat has been ranked as the most critical social media application by teens in the United States, followed by TikTok and Instagram [28].

After creating an account, a Snapchat user can take and send pictures and videos called snaps and text messages called chats to individual friends, group chats, all Snapchat friends using My Story and publicly using Our Story. By default, snaps are deleted unless they are saved to memory; however, the length of time before automatic deletion depends on how the snaps were shared. In the default settings, snaps sent to friends are deleted after all the recipients view them or after 30 days; snaps sent to group chats, My Story and Shared Stories are deleted after 24 hours; snaps sent to Public Stories do not have a set amount of time before they are deleted [25]. Chats are automatically deleted after all the recipients view them [25]. According to Snapchat Support [23], snaps saved in chats are not saved to user devices, but to Snapchat servers [23].

In 2016, Snap released the first generation of Spectacles [10]. Following this, the second-generation of Spectacles and the third generation, Spectacles 3, were released. The most recent fourth-generation Spectacles has augmented reality capabilities. Spectacles are Bluetooth-enabled glasses with two camera lenses on the outside of each eye, enabling Snapchat users to take snaps with the glasses and share the snaps in their Snapchat accounts via the app.

Social media is widely used around the world – Statista [26] reports that almost 50% of Internet users use social media at least once a month. As a result, it is not surprising that social media may contain evidence of criminal activity. The top three areas of content and account violations on Snapchat during the last half of 2020 were sexually-explicit content by a large margin, followed by sales and distribution of regulated goods, and threatening, violent or harmful content [21]. Given these statistics and reports about child exploitation, restricted or banned drug sales and money laundering conducted on and via Snapchat and other similar apps [2, 12, 20], research into the evidence found in Snapchat and accessories would be very useful to digital forensic professionals.

Previous research on mobile device artifacts from Snapchat has focused on smartphones running Android operating systems. Limited research has been conducted on iPhones running iOS. Currently, Google's Android and Apple's iOS have more than 99% of the global mobile operating system market share, with Android controlling most of the global market [17]. About 90% of U.S. residents have access to smartphones and 46.9% of them use Apple iPhones [16].

This research focuses on the extraction and analysis of artifacts from Snapchat and, specifically, Spectacles devices paired with Apple iPhones
running iOS. Cellebrite UFED and Magnet AXIOM Process were employed for physical acquisition and iTunes backup was used for logical acquisition. Macroplant iExplorer, Cellebrite Physical Analyzer and Magnet AXIOM Examine were employed for forensic examinations and analyses. The experimental findings are reported and various implications related to user data privacy are discussed.

## 2. Related Work

Alyahya et al. [1] conducted forensic analyses of Snapchat on Android devices using the Magnet AXIOM Examine and Autopsy tools. Using Magnet AXIOM Examine, they were able to examine Snapchat event logs and metadata about Snapchat friends, sent snaps, chat messages and one of the received snaps. They were also able to see previews of some of the photo snaps using the two tools. However, they were only able to process video snaps using Autopsy.

Malley [14] examined Snapchat video files on Android and iPhone devices to see if the files were modified when transferred by Gmail, Dropbox and text messages, and to see if images sent from an iPhone to an Android device, and vice versa, would leave artifacts that tied the images to their original senders. In the case of Android devices, files transferred by Gmail and Dropbox were not altered based on hash value computations. However, files transferred by text messages were compressed, which altered their hash values. In the case of iPhones, files sent via Dropbox were not altered whereas those sent via Gmail or text messages were compressed, altering the files. Nevertheless, regardless of the compression encountered in the two types of devices, it was still possible to trace images back to the originating smartphone, based on the presence of Android data in video files and “core media” (an iOS-specific artifact) in images sent by iPhones.

Wu et al. [31] analyzed data from various messaging apps on iOS and Android devices. The goal was to determine the data and artifacts that could be gathered from apps such as Snapchat and Burner due to their increased use by criminals. Analyses of Snapchat apps using Cellebrite and AccessData Forensic Toolkit revealed that information such as timestamps, contact information and message IDs could be collected from iOS devices whereas the most recently received snaps could be obtained from Android devices, albeit in duplicate. Both types of devices provided logs that included the names of the most recently sent snaps, which could be used to link senders and receivers. However, it was not possible to determine the length of time after which snaps were removed by Snapchat.
Walnycky et al. [30] attempted to reconstruct data gathered from the Snapchat app. However, Snapchat encrypts network traffic, so it was not possible to obtain audio, video and image sharing data, and packet inspection was unsuccessful.

Raji [19] loaded Snapchat on a rooted Android device in order to analyze the available artifacts. The Paraben E3 tool was used to identify recent chat messages, user account and friend list data, sent and received snaps with timestamps, and whether or not messages had been opened. The largest artifact that was not recoverable by the Paraben E3 tool was a preview of what a snap looked like. Since the experiments focused solely on an Android device, it is not clear what artifacts could be collected from an iOS device.

Chamberlain and bin Azhar [9] analyzed three mobile ephemeral messaging applications on an iOS device. Subsequently, they examined three other mobile ephemeral messaging applications on an Android device along with one application that was previously analyzed on the iOS device [6]. The Oxygen tool was used to examine the iOS and Android devices, MOBILedit Forensics Express to examine the iOS device, and Andriller, FTK Imager and Autopsy to examine the Android device. Snapchat and Facebook Messenger were selected for the iOS and Android devices due to their popularity, and two other applications were chosen due to their use of encrypted messaging, three in the case of the Android device with one shared application between the two devices. Analysis of Snapchat using Oxygen revealed the Snapchat user name, indications that offensive words were detected in messages, indications of messages between two users, evidence that a user deleted a message and general application data [9]. The MOBILedit Forensics Express tool found the same general application data as Oxygen, but additionally, obtained the accounts that logged into Snapchat, contact list, and location of the PLIST file containing contact information [9].

Matthews et al. [15] conducted a study on the usability of Snap Map, a Snapchat platform that shows publicly-available snaps by their locations on a live heat map to support closed-circuit TV footage in a distributed surveillance system. They determined that the web version of Snap Map was better than the mobile app version for this purpose because snaps and related metadata could be saved as JSON objects. Using the snaps and related metadata, Matthews and colleagues concluded that Snap Map could support law enforcement objectives related to closed-circuit TV systems. However, they discovered that the extent to which the objectives could be met depended on the accuracy of the location metadata, length of availability and quality of the snaps. They also noted that additional research regarding data reliability and accuracy
<table><caption>Table 1. Device details.</caption><thead><tr><th>Device</th><th>Type</th><th>Operating System</th></tr></thead><tbody><tr><td>Spectacles that Snap! (Coral)</td><td>Wearable IoT</td><td>Spectacles v1.11.5</td></tr><tr><td>First Generation (S1)</td><td></td><td></td></tr><tr><td>Spectacles 2 (Original Onyx)</td><td>Wearable IoT</td><td>Spectacles v2.15.2</td></tr><tr><td>Second Generation (S2)</td><td></td><td></td></tr><tr><td>Spectacles 2 (Original Onyx)</td><td>Wearable IoT</td><td>Spectacles v2.15.2</td></tr><tr><td>Second Generation (S3)</td><td></td><td></td></tr><tr><td>iPhone 11 (P1)</td><td>Smartphone</td><td>iOS 14.6</td></tr><tr><td>iPhone 12 (P2)</td><td>Smartphone</td><td>iOS 14.6</td></tr><tr><td>Alienware 13 R3 (D1)</td><td>Laptop</td><td>Windows 10 Home v21H1</td></tr><tr><td>Computer (D2)</td><td>Computer</td><td>Windows 10 Enterprise v20H2</td></tr><tr><td>USB Cables</td><td>Connector</td><td>NA</td></tr></tbody></table>

was needed and whether or not the data could be collected and analyzed automatically [15].

## 3. Methodology

This section describes the methodology for forensically imaging Apple devices before and after critical points in the Spectacles and iPhone Snapchat pairing and syncing processes. Specifically, it describes the experimental environment and experimental procedure.

### 3.1 Experimental Environment

Table 1 describes the devices used in the experiments. One first generation Spectacles wearable glasses (S1) and two second generation Spectacles wearable glasses (S2 and S3) were employed. Two iOS devices, an Apple iPhone 11 (P1) and an Apple iPhone 12 (P2), both running iOS 14.6, were used. It was decided to focus on iPhones in the experiments because the vast majority of the research in Snapchat forensics has concentrated on Android devices and the Apple's iOS is the second most commonly used mobile operating system after Google's Android [17]. Two iPhone models were employed in the experiments to determine if any differences exist in the artifacts recovered from the two devices.

Figure 1 presents an overview of the methodology. After setting up the devices and conducting experimental trials, iTunes was used to perform unencrypted and encrypted backups. Cellebrite UFED and Magnet AXIOM Process were used to obtain forensic images. The forensic images were analyzed using Macroplant iExplorer, Cellebrite Physical Analyzer and Magnet AXIOM Examine. Acquisition and analysis of the iPhone
<figure><img src="image_3.png" /><figcaption>Figure 1. Overview of the methodology.</figcaption></figure>

images were conducted using a laptop running Windows 10 Home OS Build 19043.1081 to 19043.12.37 and a computer running Windows 10 Enterprise OS Build 19042.1288. The Apple File System (APFS) is the default filesystem for iOS 10.3 and later versions [3, 4]; therefore, the iPhones running iOS 14.6 used APFS. The two Windows machines were used for ease of access and due to the physical distance between research team members.

<table><caption>Table 2. Software details.</caption><thead><tr><td>Software</td><td>Version</td><td>Devices</td></tr></thead><tbody><tr><td>Cellebrite Physical Analyzer</td><td>7.36.0.42</td><td>Computer</td></tr><tr><td>Cellebrite UFED</td><td>7.49.0.2</td><td>Computer</td></tr><tr><td>iExplorer</td><td>4.4.2</td><td>Laptop</td></tr><tr><td>iTunes</td><td>12.11.3.17</td><td>Laptop</td></tr><tr><td>Magnet AXIOM Process and Examine</td><td>5.3.0.25803</td><td>Laptop, Computer</td></tr><tr><td>Magnet AXIOM Process and Examine</td><td>5.5.1.26621</td><td>Laptop, Computer</td></tr><tr><td>Snapchat App for iOS</td><td>11.34.1.34-5</td><td>iPhone 11, iPhone 12</td></tr></tbody></table>

Table 2 lists the software used in the experiments. A mix of open-source and commercial digital forensic tools were employed. An official Snapchat app for iOS 11.34.1.35 was downloaded from the Apple App Store for each test iPhone, which had a dedicated phone number. An iCloud account was created for each test iPhone.

## 3.2 Experimental Procedure

After setting up the iPhones, installing updates, downloading the Snapchat app and setting up the Snapchat accounts, friends and the
default Team Snapchat were setup on the iPhones. The Snapchat account of iPhone P1 had four friends, default Team Snapchat, iPhone P2 Snapchat account and two other friends. The Snapchat account of iPhone P2 had three friends, default Team Snapchat, iPhone P1 Snapchat account and one shared friend. Each Spectacles device (S1, S2 and S3) was paired to its iPhone using Bluetooth, enabling the device to sync its data with the Snapchat app. Note that an iPhone must be connected to Wi-Fi or cellular in order to pair the phone with a Spectacles device. After snaps were taken using the Spectacles devices and they were paired, thumbnails of the snaps showed up under Memories. However, the snaps could not be viewed or shared until they were imported from the Spectacles devices by connecting to them via Bluetooth and selecting import.

The research goal was to conduct forensic analyses of the iPhones to identify and examine the data and artifacts related to their Snapchat applications and Spectacles devices. Several experimental trials were conducted with the iPhones and Spectacles devices. During each trial, the dates, times, locations of all actions, observations and results were documented.

Several steps were involved in each trial after the Snapchat app was downloaded and configured, and the Spectacles devices were charged, updated and configured.

Each experimental trial involved messaging and sharing snaps in the following order. First, several snaps were taken with the Spectacles devices and it was confirmed that the snaps taken with the Spectacles devices appeared in the Snapchat applications on the iPhones. Next, the snaps taken with the Spectacles devices were shared with another Snapchat account. Following this, several additional snaps were taken. However, these snaps were taken with the iPhone cameras using the Snapchat app and the snaps were shared with another Snapchat account. The final step was to connect each iPhone to a laptop with a USB cable and create a backup of the iPhone using iTunes. The trials swapped iPhones and Spectacles devices for error checking purposes and to determine if different artifacts remained for different iPhone-Spectacles combinations.

The following information was recorded during each experimental trial:

* iPhone test device

* Spectacles test device

* Type of iPhone-Spectacles connectivity

* Device connected to the iPhone test device

* Physical location of the experiment
<table><caption>Table 3. Main Snapchat data locations.</caption><thead><tr><th>Directory Folder</th><th>Subfolder</th></tr></thead><tbody><tr><td>App</td><td>com.toyopagroup.picaboo (F1)</td></tr><tr><td>App</td><td>com.toyopagroup.picaboo (F2)</td></tr><tr><td>App Group</td><td>com.toyopagroup.picaboo.homeWidget (F3)</td></tr><tr><td>App Plugin</td><td>com.toyopagroup.picaboo notification (F4)</td></tr><tr><td></td><td>com.toyopagroup.picaboo.share (F5)</td></tr><tr><td></td><td>com.toyopagroup.picaboo.today (F6)</td></tr></tbody></table>

* Date and time each snap was taken

* Type of each snap (picture or video)

* Device taking each snap (Spectacles device or iPhone camera)

* Description of each snap

During the experiments, it was observed that, when the snaps taken with a Spectacles device were shared, the snaps were rounded and, when they were shared with a friend, thumbnails of the shared snaps were shown. However, when snaps taken with an iPhone camera in Snapchat were shared, the snaps were not shown and only messages appeared to indicate that the snaps were delivered.

Forensic acquisitions were conducted on the iTunes backups using the Cellebrite UFED and Magnet AXIOM Process tools. The iTunes backups and other images were analyzed forensically using iExplorer, Cellebrite Physical Analyzer and Magnet AXIOM Examine.

## 4. Experimental Results and Findings

This section describes the experiment results and discusses the experimental findings.

The iExplorer tool was used to access the iPhone filesystems. The filesystems were organized into ten parts with most of the data in the Backup Explorer folder. The Backup Explorer folder was divided into 21 sections.

Table 3 shows the locations of Snapchat-related data. Other artifacts and indications of artifacts related to Snapchat were found with iExplorer and in the file tree section of Magnet AXIOM Examine under folders F2 through F6. Two files were found in folder F1, a PLIST file in subfolder SF2 with the same name as folder F1 and **snapcode** in subfolder SF4. All the folders belonging to the App Plugin directory shown
in Table 3 were empty except for the same three subfolders, Documents (SF1), Library (SF2) and Library/Preferences (SF3). Most of these artifacts did not change after the experimental trials or were not related to the Spectacles devices.

The majority of altered artifacts of interest were found in folder F1. Figure 2 shows the file tree for folder F1. Folder F1 contains two subfolders, Documents (SF1) and Library (SF2). In the Documents subfolder (SF1), the subfolders, gallery, gallery_data_object, gallery_encrypted_db, global_scoped and persisted_events only contained empty folders; the subfolder user_scoped was completely empty.

Data from Snapchat and Spectacles related to snaps were stored in the F1 folder. Images, video, thumbnails and metadata files were stored in subfolder SF1 in a file named *laguna* using unique identifiers. The majority of the time, each identifier had corresponding MOV, THM, JPG, IMU and MDA files with the same identifier. When using iExplorer, thumbnail files for some of the snaps taken with Spectacles S1 were viewable.

The directory also contained a file named *device-list-archive.dat*, a PLIST file with information about the Spectacles device and files transferred between the iPhone and Spectacles device. Data about the Spectacles device included the firmware version, device name, pairing information, Wi-Fi password (if enabled on the Spectacles device), timestamps, setup information, etc.

Image and video metadata were found in the PLIST file under SC-SpectaclesDevicecontentStorecontentkeys. A SCSpectaclesContent key exists for each picture and video imported from a Spectacles device. The keys store location information (if available), timestamps, size, duration, as well as the filenames of images, videos, thumbnails and metadata.

Image, video and thumbnail files were found on the iPhone device after importing. Using the data found in *device-list-archive.dat*, a certain image, video or thumbnail can be tied to a time, Spectacles device, iPhone and (if available), a location (Figure 3). Thumbnails for all the images and videos taken with a Spectacles device were found on the iPhone. A file was present for the most recent video and mentioned in *device-list-archive.dat*, but the file turned out to be empty. It was confirmed that the MOV file was the most recent video based on the timestamps in *device-list-archive.dat*. However, playable MOV files were found for older videos taken with Spectacles. More research needs to be done to determine if importing, saving to Memories or uploading videos results in Spectacles videos being saved on the device or removed.
[-] com.toyopagroup.picaboo

[-] Documents

[-] bitmoji_content

[-] gallery

[-] 1

[-] gallery_data_object

[-] 1

[-] gallery_encrypted_db

[-] 3

[-] 8f4bef3443cf1f536746be3e5b3b8e96a371d72bcaa649ffa84253d6b91e

[-] gallery_search

[-] 25

[-] 8f4bef3443cf1f536746be3e5b3b8e96a371d72bcaa649ffa84253d6b91e

[-] global_scoped

[-] global_scoped-docobjects

[-] global_scoped-preferences

[-] Lenses

<figure><img src="image_4.png" /><figcaption>(b) Directory com.toyopagroup.picaboo structure-2.</figcaption></figure>

<figure><img src="image_5.png" /><figcaption>(c) Directory com.toyopagroup.picaboo structure-3.</figcaption></figure>

Figure 2. Directory com.toyopagroup.picaboo structure.
```json
contentStore: SCSpectaclesContentStore = {
  content: NSArray = {
    SCSpectaclesContent = {
      location: AsciiString = Null
      contentName: AsciiString = 00000000300000001
      thumbnailFile: SCSpectaclesFile = {
        pictureFile: AsciiString = Null
        multisnapGroupID: AciiString = 0030000
        mediaFormat: integer = 4
        videoDuration: real = 10.5
        hdVideoFile: SCSpectaclesFile = {
          remoteFileName: AsciiString =
            00000000300000001.MOV
          localFilename: AsciiString =
            000000003-0000-0001-832F-E0B7B45A8E6
          B_HD.MOV
          remoteFileSize: integer = 10682649
        buttonSide: integer = 0
        genericAssetFiles: AsciiString = Null
        synced: boolean = False
        type: integer = 0
        UUID: AciiString = 000000003-0000-0001-832F-E0B7B45A8E6B
        mediaType: integer = 5
        sdVideoFile: SCSpectaclesFile = {
          timeOfCapture: NSDate = 10/4/2021 7:19:07 PM
          batchID: NSUUID = 1f6f3f30-b754-8c40-444264d09ced
          metadataFile: SCSpectaclesFile = {
            remoteFileName: AsciiString =
              00000000300000001.MDA
            localFilename: AsciiString =
              000000003-0000-0001-832F-E0B7B45A8E6B.MDA
            remoteFileSize: integer = 527
          imuDataFile: SCSpectaclesFile = {
            genericAssetMetadata: AsciiString = Null
          IV: data = B9 CA D5 57 FD 74 10 49 D1 10 00 18
            9A 0A 3B
          key: data = 6F 70 E4 37 08 BF 6D 19 B6 66 26
            04 86 8D 71 6F 4B 4A 8C 20 A5 45 64 4A 98
            4E F3 6A 7D F0 29 6E
```

<caption>Figure 3. Image and video files transferred from a Spectacles device.</caption>

Other files changed after the Spectacles pairing, namely the PLIST file `iPhone/mobile/Containers/Data/Application/com.toyopagroup.picabo-o/Library/Preferences/com.toyopagroup.picaboo.plist`. This file was updated to include several keys related to Spectacles data such as the key `SPECTACLES-IOS-HERMOSA_INTEGRATION`. The file also appears to update information in the Spectacles updates and release notes. Three other PLIST files were found in the same folder, `app.aifactory.-splendidSDK.plist`, `com.apple.EmojlCache.plist`
```json
{
  "app_travel_mode": false,
  "session_id": "f.ZkS2m5+oSPo1DWQ2",
  "os_type": "iOS",
  "event_sampled_rate": 1,
  "device_storage": 99,
  "app_startup_type": "WARM",
  "event_name": "SPECTACLES DEVICE STATUS",
  "app_version": "11.35.0.34",
  "user_id": "loganv6886",
  "AMPEvent.isCritical": false,
  "video_count": 6,
  "device_id": "832FE0B8B45A8E6B",
  "user_guid": "ff93a73b-1d77-4312-8ac7-2d64e97156ca",
  "firmware_version": "v2.13.1",
  "client_ts": 1633458074.439924,
  "log_queue_sequence_id": 21,
  "locale": "en",
  "log_queue_name": "shadow",
  "frame_color": "ONYX",
  "hardware_version": "4.0",
  "device_battery": 0,
  "app_build": "",
  "connection_download_bandwidth_bps": 0,
  "os_version": "14.6",
  "device_model": "iPhone13,2",
  "device_connectivity": "UNREACHABLE",
  "client_id": "CC009CFB-3A4D-B118-E8779329B600",
  "user_sampled_rate": 1,
  "has_bitmoji": false,
}
```

<caption>Figure 4. JSON file retrieved after iPhone-Spectacles pairing.</caption>

and `com.mapbox.event-s.plist`. Other files that were updated after pairing included JSON files found in `com.toyopagroup.picaboo/Library/blizzard/sealed/queue-/gce_best-effort` and in `com.toyopagroup.picaboo/Library/blizzard/seale-d/queue/shadow`. These files, which contained references to Spectacles device and iPhone information, were created after pairing with and syncing data from the Spectacles device.

The majority of the Snapchat and Spectacles data was found in the `/App/com.toyopagroup.picaboo/laguna` directory and in the `PLIST` and JSON files in the `/App/com.toyopagroup.picaboo/Library` directory (Figure 4).

## 5. Limitations and Challenges

Only two experiment trials were performed using Spectacles device S1 due to poor battery life, lack of charging equipment, difficulty importing
snaps and unpredictable usage availability. Most of the snaps taken with the Spectacles device S1 on the iPhone 11 (P1) displayed thumbnails in the Snapchat application; however, it was possible to import only the first four snaps. As reported by Buxton [7], first-generation Spectacles devices such as S1 have several mechanical problems due to design flaws. The two trials involving Spectacles device S1 were conducted only on iPhone 11 (P1) and it was only possible to examine the backups using iExplorer because access was not available to the Cellebrite and Magnet AXIOM tools at the time. As a result, most of the analysis conducted using iExplorer, Cellebrite and Magnet AXIOM and the associated results came from images and backups of iPhone 11 (P1) and iPhone 12 (P2) using the second-generation Spectacles devices S2 and S3.

A jailbroken iPhone would likely have contained artifacts and data that were more accessible. Several folders that appeared to be promising were discovered, but they turned out to be empty. An article by Magnet Forensics [13] providing support for Magnet AXIOM says that obtaining encryption keys from a jailbroken device could help with uncovering more artifacts and decrypting Snapchat Memories and Snapchat My Eyes Only content.

In summary, images, videos, thumbnails and metadata files originating from Spectacles devices were stored in the /App/com.toyopagroup.pi cab-oo/Documents/laguna directory. This directory also contained the device-list-archive.dat file that provided data and insights about the Spectacles devices and transferred files. The Spectacles device data included the firmware version, device name, pairing information, Wi-Fi password (if enabled on the Spectacles device), timestamps and setup information. The file also contained location information (if available), timestamps, sizes, durations and the filenames of the images, videos, thumbnails and metadata originating from the Spectacles device.

# 6. Conclusions

This chapter has described the process of examining and analyzing forensic artifacts from Snapchat iOS apps that relate to the use of Spectacles devices. Non-jailbroken iPhone 11 and iPhone 12 smartphones with the Snapchat app installed and paired with first- and second-generation Spectacles devices were used to share snaps taken within the apps and with the iPhone cameras. Logical and physical acquisitions were conducted to obtain forensic images for analysis. Analysis of the forensic images using Macroplant iExplorer, Cellebrite Physical Analyzer and Magnet AXIOM Examine enabled the recovery of several photos, videos, thumbnails and metadata files originating from Specta-
ables that were tied to specific times, iPhone devices and locations. The results provide interesting insights into evidence collection during each step of the Spectacles-iPhone pairing process.

Research on forensic analyses of wearable devices [5] and the presence of sensitive user data from smartwatch devices [18] indicate that future research should examine the Spectacles devices themselves. Since this research only considered iPhones that sent snaps, it would be worthwhile to also look at iPhones that received snaps. Additionally, due to the different default deletion times in Snapchat [25] and the option to change when snaps are deleted, it would be valuable to conduct experiments that image iPhones several times over an extended period after snaps are created, shared, sent and received. Future research will also examine other glasses and wearable devices to understand and extract the stored evidence and evaluate its admissibility.

## Acknowledgement

This research was supported by the National Science Foundation under the CyberCorps Scholarship for Service (SFS) Program Grant no. DGE 2043302.

## References

[1] T. Alyahya and F. Kausar, Snapchat analysis to discover digital forensic artifacts on Android smartphones, *Procedia Computer Science*, vol. 109, pp. 1035-1040, 2017.

[2] M. Anderson, I-TEAM — Ambushed by images: An investigation into online child sexual abuse, *WRDW-TV*, Atlanta, Georgia (www.wrdw.com/2021/10/07/i-team-ambushed-by-images-an-investigation-into-online-child-sexual-abuse), October 7, 2021.

[3] Apple Developer Program, About Apple File System, Apple, Cupertino, California (developer.apple.com/documentation/foundation/file_system/about_apple_file_system), 2021.

[4] Apple Developer Program, File System Basics, Apple, Cupertino, California (developer.apple.com/library/archive/documentation/FileManagement/Conceptual/FileSystemProgrammingGuide/FileSystemOverview/FileSystemOverview.html), 2021

[5] I. Baggili, J. Oduro, K. Anthony, F. Breitinger and G. McGee, Watch what you wear: Preliminary forensic analysis of smart watches, *Proceedings of the Tenth International Conference on Availability, Reliability and Security*, pp. 303-311, 2015.
[6] H. bin Azhar, R. Cox and A. Chamberlain, Forensic investigations of popular ephemeral messaging applications on Android and iOS platforms, *International Journal on Advances in Security*, vol. 13(1-2), pp. 41-53, 2020.

[7] M. Buxton, The pipeline: The Snapchat Spectacles engineer who embraces failure, *Yahoo! News* (www.yahoo.com/news/pipeline-snapchat-spectacles-engineer-embraces-173500431.html), July 26, 2018.

[8] B. Caddy, Picaboo: How to send naughty photos without getting caught, *ShinyShiny* (www.shinyshiny.tv/2011/09/how-to-send-naughty-photos-without-getting-caught.html) September 16, 2011.

[9] A. Chamberlain and H. bin Azhar, Comparisons of forensic tools to recover ephemeral data from iOS apps used for cyberbullying, *Proceedings of the Fourth International Conference on CyberTechnologies and Cyber-Systems*, pp. 88-93, 2019.

[10] K. Chaykowski, Snapchat leaps into hardware, rebrands as ‘Snap Inc.’, *Forbes*, September 24, 2016.

[11] J. Colao, The inside story of Snapchat: The world's hottest app or a $3 billion disappearing act? *Forbes*, January 19, 2014.

[12] Europol, Money muling, The Hague, The Netherlands (www.europpol.europa.eu/activities-services/public-awareness-and-prevention-guides/money-muling), December 1, 2021.

[13] Magnet Forensics, Decrypt app data using the iOS Keychain and GrayKey, Herndon, Virginia (support.magnetforensics.com/s/article/Decrypt-app-data-using-the-iOS-Keychain-G GrayKey), April 18, 2022.

[14] A. Malley, A Comparison Analysis of Saved Snapchat Video Files on Androids vs. iPhones, M.S. Thesis, Recording Arts Program, College of Arts and Media, University of Colorado Denver, Denver, Colorado, 2021.

[15] R. Matthews, K. Lovell and M. Sorell, Ghost protocol – Snapchat as a method of surveillance, *Digital Investigation*, vol. 36(S), article no. 301112, 2021.

[16] S. O'Dea, iPhone users as share of smartphone users in the United States 2014-2021, Statista, New York (www.statista.com/statistics/260811/social-network-penetration-worldwide), 2021.
[17] S. O'Dea, Market share of mobile operating systems worldwide 2012-2021, Statista, New York (www.statista.com/statistics/260811/social-network-penetration-worldwide), 2021.

[18] N. Odom, J. Lindmar, J. Hirt and J. Brunty, Forensic inspection of sensitive user data and artifacts from smartwatch wearable devices, *Journal of Forensic Sciences*, vol. 64(6), pp. 1673-1686, 2019.

[19] M. Raji, Digital Forensic Tools and Cloud-Based Machine Learning for Analyzing Crime Data, M.S. Thesis, Department of Information Technology, Georgia Southern University, Statesboro, Georgia, 2018.

[20] S. Ray, Snapchat promises crackdown on sale of illicit drugs amid Fentanyl scare, *Forbes*, October 7, 2021.

[21] Snap, Transparency Report, July 1, 2020 – December 31, 2020, Santa Monica, California (snap.com/en-US/privacy/transparency/2020-12-31), 2021.

[22] Snapchat Support, About Snap Map, Snap, Santa Monica, California (support.snapchat.com/en-US/article/snap-map-about), 2021.

[23] Snapchat Support, Saving and deleting snaps, Santa Monica, California (support.snapchat.com/en-US/a/saving-snaps), 2021.

[24] Snapchat Support, Snap Camera FAQ, Snap, Santa Monica, California (support.snapchat.com/en-US/article/snap-camera-faq), 2021.

[25] Snapchat Support, When does Snapchat delete snaps and chats? Snap, Santa Monica, California (support.snapchat.com/en-US/a/when-are-snaps-chats-deleted), 2021.

[26] Statista, Social network penetration worldwide from 2017 to 2025, New York (www.statista.com/statistics/260811/social-network-penetration-worldwide), 2020.

[27] Statista, Countries with the most Snapchat users 2021, New York (www.statista.com/statistics/315405/snapchat-user-region-distribution), 2021.

[28] Statista, Favorite social networks of U.S. teens 2012-2020, New York (www.statista.com/statistics/250172/social-network-usage-of-us-teens-and-young-adults), 2021.

[29] Statista, Snapchat: Number of global users 2018-2024, New York (www.statista.com/statistics/626835/number-of-monthly-active-snapchat-users), 2021.
[30] D. Walnycky, I. Baggili, A. Marrington, J. Moore and F. Breitinger, Network and device forensic analysis of Android social-messaging applications, *Digital Investigation*, vol. 14(S1), pp. S77-S84, 2015.

[31] C. Wu, C. Vance, R. Boggs and T. Fenger, Forensic analysis of data transience applications in iOS and Android, Poster Presentation, Forensic Science Graduate Program, Marshall University, Huntington, West Virginia (www.marshall.edu/forensics/files/Wu-Poster.pdf), 2013.