Product Features

Snapchat Warrant Returns in Magnet AXIOM

Snapchat Warrant Returns are one of the supported platforms for analysis in AXIOM. With the Cloud feature, you can load the .zip file you receive from Snapchat into AXIOM and be able to parse a wide array of content alongside your other evidence in the case. This will allow you to timeline Snapchat artifacts alongside the mobile phone or other returns you process in AXIOM.

In some instances, you may not have the information you need to parse Snapchat from an iOS device which will make warrant return content even more valuable. For AXIOM to parse content from Snapchat, you will need data from the iOS keychain. This may not be available to you, so you may be relying on the content from a warrant return.

Figure: Entering decryption information for iOS parsing of Snapchat from a File System iOS image

With a warrant return it is much simpler as you simply load the .zip file you received for the return. There are several artifacts that are parsed from Snapchat Warrant Returns including account Information, Friends, Group Chat Messages, IP History, Messages, Pictures, and Videos. The support includes display of emojis that may be valuable to understanding the context of the conversations. The IP History Artifact provides not only the IP address, but also the times associated with login and logout.

Figure: Snapchat Warrant Return artifacts

If you have any comments or questions feel free to reach out to me at Has something changed in a Snapchat return you have received? Is there more data available you would like us to support? Please, drop us a line and let us know.

Subscribe today to hear directly from Magnet Forensics on the latest product updates, industry trends, and company news.

Start modernizing your digital investigations today.