Snapchat Warrant Returns in Magnet AXIOM

Snapchat Warrant Returns are one of the supported platforms for analysis in AXIOM. With the Cloud feature, you can load the .zip file you receive from Snapchat into AXIOM and be able to parse a wide array of content alongside your other evidence in the case. This will allow you to timeline Snapchat artifacts alongside the mobile phone or other returns you process in AXIOM.

In some instances, you may not have the information you need to parse Snapchat from an iOS device which will make warrant return content even more valuable. For AXIOM to parse content from Snapchat, you will need data from the iOS keychain. This may not be available to you, so you may be relying on the content from a warrant return.

With a warrant return it is much simpler as you simply load the .zip file you received for the return. There are several artifacts that are parsed from Snapchat Warrant Returns including account Information, Friends, Group Chat Messages, IP History, Messages, Pictures, and Videos. The support includes display of emojis that may be valuable to understanding the context of the conversations. The IP History Artifact provides not only the IP address, but also the times associated with login and logout.

If you have any comments or questions feel free to reach out to me at Jessica.hyde@magnetforensics.com. Has something changed in a Snapchat return you have received? Is there more data available you would like us to support? Please, drop us a line and let us know.