A COMPARISON ANALYSIS
OF SAVED SNAPCHAT VIDEO FILES
ON ANDROIDS VS IPHONES
by
ANGELA RAE MALLEY
B.A., University of Denver, 2012
A thesis submitted to the
Faculty of the Graduate School of the
University of Colorado in partial fulfillment
of the requirements for the degree of
Master of Science
Recording Arts Program
2021
ii
This thesis for the Master of Science degree by
Angela Rae Malley
has been approved for the
Recording Arts Program
by
Catalin Grigoras, Chair
Jeff Smith
Cole Whitecotton
Date: May 15, 2021
iii
Malley, Angela Rae (M.S., Recording Arts Program)
A Comparison Analysis of Saved Snapchat Video Files on Androids vs iPhones
Thesis directed by Associate Professor Catalin Grigoras
ABSTRACT
This thesis study analyzes the similarities and differences between video files saved via
the Snapchat application on Android and Apple iPhones. With the rise in common use of social
media platforms comes a rise in evidence of interest created within these applications.
Understanding how these video files are saved as far as file structure, format and the data that
each application stores will help with future authentication of video files created via Snapchat.
Snapchat video files were created, saved, and transferred via several different methods.
The Android Snapchat video files were transferred via Dropbox, Gmail and MMS message to the
iPhone. These video files were compared to one another and then compared to the files
originating on the iPhone. The Snapchat video files created on the iPhone were transferred via
Dropbox, Gmail and MMS message to the Android. These video files were compared to one
another and then compared to the files originating on the Android.
The analysis of the Android Snapchat video files showed several notable results. The
video files transferred via Dropbox and Gmail showed no changes when compared to the original
video files extracted from the Android, and the video files transferred via MMS message and
extracted from the iPhone showed heavy recompression. The video files transferred via MMS
message and extracted from the iPhone also showed audio and video stream hash value
mismatches, meaning both the audio and video of these files was recompressed. The metadata of
the original Android Snapchat video files showed “Snap Audio” and “Snap Video,” which
directly relates to the originating application, Snapchat. The videos transferred via MMS
iv
message and extracted from the iPhone showed “Android Version 10,” but no longer showed
“Snap” in the metadata, which directly linked them to the Android, but not the Snapchat
application. The audio samples of the files transferred via MMS message and extracted from the
iPhone showed only a minor decrease from the original Android Snapchat files even though the
recompression was great.
The analysis of the iPhone Snapchat video files also showed several prominent results.
The Snapchat video files transferred via Dropbox showed no changes when compared to the
original iPhone Snapchat video files, whereas the video files transferred via Gmail and sent via
MMS message and extracted from the Android showed heavy recompression. The video files
transferred via Gmail showed audio stream hash value matches and video stream hash
mismatches, meaning the audio remained unchanged, and the video was recompressed. The
video files sent via MMS message and extracted from the Android showed audio and video
stream mismatches, meaning both the audio and video was recompressed. The metadata of all the
Snapchat video files originating from the iPhone showed “Core Media,” which is associated with
Apple, but there was no evidence directly correlating with the application, Snapchat.
Additionally, the video files sent via MMS message and extracted from the Android showed
“Apple Revision 1” and the video file transferred via Gmail displayed “Apple QuickTime.”
When analyzing the audio samples of the Snapchat video files originating on the iPhone, the
video files transferred via Gmail showed no change even though these files were recompressed,
and the video files sent via MMS message and extracted from the Android showed a significant
decrease in audio samples.
The form and content of this abstract are approved. I recommend its publication.
Approved: Catalin Grigoras
v
DEDICATION
This thesis is dedicated to my mom, Susan, my dad, Edward, and my stepmother, Kara
for all their love, support, and encouragement, and to my grandfather who always encourages me
to further my education.
vi
ACKNOWLEDGEMENTS
This thesis would not have been possible without the National Center of Media Forensics
at the University of Colorado Denver. I would like to thank my committee members, Jeff Smith,
Catalin Grigoras, and Cole Whitecotton for all their guidance and suggestions during the
preparation of this thesis and for sharing their extensive knowledge over the course of this
program. I would also like to thank Leah Haloin for her support and reminders during this
program, and for her formatting review of this thesis.
vii
TABLE OF CONTENTS
CHAPTER
I. INTRODUCTION ........................................................................................................ 1
Previous Research ......................................................................................................... 1
II. MATERIALS ................................................................................................................ 4
III. METHODOLOGY ....................................................................................................... 6
Methods......................................................................................................................... 6
IV. DETAILS OF EXAMINATION ................................................................................ 14
Hash Values ................................................................................................................ 14
Metadata from ExifTool ............................................................................................. 16
MediaInfo – File Format ............................................................................................. 18
Audio Samples ............................................................................................................ 19
V. CONCLUSIONS......................................................................................................... 23
Android ....................................................................................................................... 23
iPhone ......................................................................................................................... 26
Android vs. iPhone...................................................................................................... 30
Future Research .......................................................................................................... 31
REFERENCES .................................................................................................................... 33
APPENDIX .......................................................................................................................... 34
viii
LIST OF TABLES
TABLE
1. Audio Samples of Android Snapchat Video 001 .............................................................. 21
2. Audio Samples of iPhone Snapchat Video 011 ................................................................ 22
3. Hash Values of Android Snapchat Video 004 .................................................................. 24
4. Stream Hash Values of Android Snapchat Video 004 ...................................................... 24
5. Partial Metadata of Android Snapchat Video 004 from ExifTool .................................... 25
6. Partial Metadata of Android Snapchat Video 004 from ExifTool .................................... 26
7. Partial Metadata of Android Snapchat Video 004 from MediaInfo ................................. 26
8. Audio Samples of Android Snapchat Video 004 .............................................................. 26
9. Hash Values of iPhone Snapchat Video 014 .................................................................... 27
10. Stream Hash Values of iPhone Snapchat Video 014 ........................................................ 27
11. Partial Metadata of iPhone Snapchat Video 014 from ExifTool ...................................... 28
12. Partial Metadata of iPhone Snapchat Video 014 from ExifTool ...................................... 29
13. Partial Metadata of iPhone Snapchat Video 014 from ExifTool ...................................... 29
14. Audio Samples of iPhone Snapchat Video 014 ................................................................ 30
15. Partial Metadata of Android Snapchat Video 004 vs. iPhone Snapchat Video 014 ......... 31
ix
LIST OF ABBREVIATIONS
3GP – Third Generation Partnership Project
AMR – Adaptive Multi-Rate
AVC – Advanced Video Coding
EXIF – Exchangeable Image File
MMS – Multimedia Messaging Service
1
CHAPTER I
INTRODUCTION
Today’s society is roaring in social media, and with the use of personal mobile devices
becoming more prevalent, so is the amount of digital evidence captured by these devices and
specifically social media applications. Snapchat is a mobile social media application with
millions of users that is based around its camera capture function. It allows users to snap pictures
and videos using the application linked to their phone camera that can then be saved to the phone
and/or sent to other users. Some captured moments may contain evidence important to current or
future litigation. Understanding how both Androids and iPhones save these images and videos
and what kinds of data each application stores within the files will help with future
authentication of evidence files created by the Snapchat application. This thesis will focus on
forensically examining and comparing the hash values, stream hash values, metadata, and audio
samples of snap video files created by Snapchat and saved to an Android versus an iPhone. In
addition, several transfer methods will also be utilized in order to analyze how these methods
may change the video files and which distinguishing data remains, if any, with the video files
even when these methods of transfer are used. This forensic analysis is important because
understanding distinguishing aspects about video files saved using the Snapchat camera capture
function will assist with future authentication of evidence video files created with the
application.
Previous Research
Digital evidence is becoming more and more relevant in today’s world and with this
comes the importance of digital forensic science. [1] Media forensics includes the collection,
preservation, and analysis of media, such as audio, videos and images. Media sources include,
2
but are not limited to, digital cameras, voice recorders, DVR systems, computers, tablets, and
mobile phones.
The analysis of media forensics can consist of container and content analysis. Analysis of
the container includes a review of aspects such as file name, hash values, file structure, file
format, hex data, create/modify dates, and metadata. Analysis of the content includes a review of
the encoded data and the decoded information being digital audio, still images, and video.
Authentication is an important part of media forensic analysis as if a media file is found
to be inauthentic or manipulated it may be dismissed in a court of law. The purpose of
authentication is to validate that the media file is what it is presented to be and that it has not
been manipulated to depict something untrue. [2]
As there are no official best practices for digital video authentication available to the
forensic science community, Greg Wales wrote Proposed Framework for Digital Video
Authentication in 2019. He proposes an analysis of file structure, video and audio streams, and
verification of the device used to create the video file. These analyses include critical listening
and a visual analysis for inconsistencies. The purpose of the file structure analysis is to make a
determination on whether the evidence file is consistent with an original. [3] Understanding the
way in which common devices and applications capture and store media data will be helpful in
identifying sources of evidence media files in future cases.
To many people mobile phones are a part of everyday life, collecting and storing their
daily activities, such as calls, text messages, locations, calendar events, photos/videos,
application activity, and web history. In Seeking the Truth from Mobile Evidence, John Blair
defines cell phone forensics in the three parts: Recovering, Data, and Validating. Recovering
data starts with the legal process that usually begins with the suspicion of a crime. Data refers to
3
the collection of the data in two types: Logical and Physical. Logical data is limited and easily
understood as user data and may contain some deleted data. Physical data goes deeper, includes
deleted user data, and is less commercially accessible. Validating includes visual validation and
the validation of artifacts by using multiple forensic tools. [3]
Snapchat is a Snap Inc. social media mobile application with a camera capture function
compatible with Android and iOS devices that allows users to share photos or videos (called
“snaps”) and instant message with specific friends or post stories that friends may view.
Received snaps are viewed when opened and then are automatically deleted. A user may choose
to save a snap to the device’s internal storage before sending. [5] The snap videos and images
can be saved without sending and also be sent without saving. Snapchat also offers features that
users may add to snaps, such as, filters, texts, paint, icons, emoticons, links and music.
4
CHAPTER II
MATERIALS
The following materials were used in the collection of Android Snapchat video files and
iPhone video files. The noted installed applications on the cell phones were used for the transfer
of Snapchat video files and the noted installed application on the laptop was used to access and
download transferred files. The Cellebrite applications were run on the analysis laptop with a
license dongle to forensically acquire the cell phones, open the extractions, and export the
Snapchat video files.
• 1 Android Samsung Galaxy S9
o Model: SM-G96OU
o Serial Number: R58M74MYNJW
o IMEI: 358192100265191
o Software Version G960USQU8FTJ3
o Original power/data cord
o Snapchat v. 11.15.1.34 installed
o Gmail v. 2019.11.21.283644823.release installed
o Dropbox (accessed via Google App 12.4.9.23.arm64)
• 1 Apple iPhone 11
o Model: A2111
o Serial Number: FK1ZJ0FKN733
o IMEI: 353980105155630
o Software Version: 14.4
o Apple charging/data cord
5
o Snapchat v11.15.0 installed
o Gmail v. 6.0.201115 installed
o Dropbox (accessed via web browser, Safari)
• 1 Lenovo Thinkpad Laptop running Windows 10
o Google Chrome web browser v. 88.0.4324 installed
• Cellebrite UFED 4PC 7.40.0.229
• Cellebrite Physical Analyzer 7.41.0.8
The following materials were used in the analysis of Android Snapchat video files and iPhone
video files. Jacksum and Fmpeg were used to calculate hash values of the Snapchat video files.
ExifTool and MediaInfo were used to collect the metadata of the files. iZotope, FAAS, Mp4dump,
and Mp4info were used to calculate the audio samples of the Snapchat video files.
• Jacksum 2.0.0
• ExifTool 12.11
• MediaInfo 20.08
• FFmpeg v. 4.3
• iZotope RX 8 Advanced Editor (64-bit) v8.1.0.
• FAAS
• Mp4dump
• Mp4info
6
CHAPTER III
METHODOLOGY
Two mobile phones, one Android and one iPhone, were used for the data collection of
Snapchat video files. Ten snap videos were taken and saved on each device using the capture
function within the Snapchat application. Each snap video was then transferred using Dropbox,
Gmail and MMS message. The videos were uploaded to Dropbox using web browser mobile
applications, Google for the Android and Safari for the iPhone, sent via email using the Gmail
application, and sent in MMS messages to the opposite device. The Android and the iPhone were
both forensically acquired using Cellebrite UFED 4PC, an industry-standard software tool
designed for mobile device acquisitions. The acquisitions of the Android and the iPhone were
loaded into Cellebrite Physical Analyzer, a software tool used for the analysis of mobile
acquisitions. Twenty snap videos, ten captured on the device and ten received via MMS message
by the device, were located in each acquisition and exported to the analysis laptop. The web
browser, Google Chrome, was used on the analysis laptop to download the ten Android snap
videos and the ten iPhone snap videos from Dropbox and then Gmail.
Methods
Android
A Samsung Galaxy S9 Android phone with Snapchat and the Gmail application installed
was used for analysis. The Snapchat application was opened, and ten snap videos were taken by
holding down the circular record button. The durations were varied at random and kept to less
than 30 seconds to keep the file sizes small enough to email. After each snap video was recorded,
it was saved to the phone then closed. The screenshots below display the steps taken in the
Snapchat application on the Android to collect each video.
7
1. Record video by holding the circular button
2. Save the video to Camera Roll by touching the “Save” button
8
3. The “Save” button changes to a checkmark to confirm the save
Dropbox
Dropbox is a cloud storage service that allows a user to upload and share files across
devices. The ten video files were uploaded to a Dropbox Basic account by navigating to the
Dropbox webpage (dropbox.com) using the Google web browser application on the Android.
The following steps were taken to upload the snap files to Dropbox once logged into a Dropbox
Basic account.
1. From the Dropbox Home screen click the “…” button to open the dropdown menu
2. Select “Upload Files”
3. Select “Photo Library”
4. Scroll to locate Snapchat videos
5. Select Snapchat videos and click “Add”
6. Create folder
9
7. Name the folder “Snapchat Android”
8. Select “Upload”
Gmail
The Gmail application is a Google email application used to send and receive emails using a
Gmail account. Gmail was used on the Android to compose emails and send the ten Snapchat
videos to another Gmail account. Five emails were sent with two videos attached to each email.
The list below outlines the steps taken.
1. Open Gmail application
2. Select “Compose” to create a new email
3. Enter receiving email address in “To”
4. Enter “Videos 1” in “Subject”
a. Subsequent emails were numbered accordingly
5. Attach videos by selecting the paperclip attachment icon and navigating to the videos in
“Photos,” which is the Camera Roll
6. Send the email
The snap videos were then downloaded to the analysis laptop by logging into the receiving
email account and downloading them to the computer.
Sent to iPhone via MMS Message
The ten Snapchat video files were transferred to the iPhone via MMS messages by
opening a conversation between the two devices and then attaching the snap videos and sending.
Extracted from Android
The Android was forensically acquired using Cellebrite UFED 4PC. A licensed version
of the software was run on the analysis laptop and the Android was connected via the original
10
cord. A full logical extraction was completed. Once the extraction was successful it was loaded
into Cellebrite Physical Analyzer and the ten saved snap videos were located as well as the MMS
messages containing the ten videos received from the iPhone and were exported.
iPhone
An iPhone 11 with Snapchat and the Gmail application installed was used for analysis. The
Snapchat application was opened, and ten videos were taken by holding down the circular record
button. The durations were varied at random, but kept to less than 30 seconds to allow for
emailing. After each video was recorded, it was saved to the phone’s Camera Roll then closed.
The screenshots below display the steps taken in the Snapchat application on the iPhone to
collect each video.
1. Record video by holding the circular button
11
2. Save the video to Camera Roll by touching the “Save” button
3. The “Save” button changes to a checkmark to confirm the save
12
Dropbox
The ten video files were uploaded to a Dropbox Basic account by navigating to the Dropbox
webpage (dropbox.com) using Safari on the iPhone. The following steps were taken to upload
the files to Dropbox once logged into a Dropbox Basic account.
1. From the Dropbox Home screen click the “…” button to open the dropdown menu
2. Select “Upload Files”
3. Select “Photo Library”
4. Scroll to locate Snapchat videos
5. Select Snapchat videos and click “Add”
6. Create folder
7. Name the folder “Snapchat iPhone”
8. Select “Upload”
Once the Snapchat video files were uploaded to Dropbox they were downloaded to the
analysis laptop. Dropbox was logged into through the web browser, Chrome, and the folder
“Snapchat iPhone” containing the iPhone Snapchat video files was downloaded to the computer.
Gmail
The Gmail application is a Google email application used to send and receive emails using a
Gmail account. Gmail was used on the iPhone to compose emails and send the ten Snapchat
videos to another Gmail account. Five emails were sent with two videos attached to each email.
The list below outlines the steps taken.
1. Open Gmail application
2. Select “Compose” to create a new email
3. Enter receiving email address in “To”
13
4. Enter “Videos 1” in “Subject”
a. Subsequent emails were numbered accordingly
5. Attach videos by selecting the paperclip attachment icon and navigating to the videos in
“Photos,” which is the Camera Roll
6. Send the email
The videos were then downloaded to the analysis laptop by logging into the receiving email
account and downloading them to the computer.
Sent to Android via MMS Message
The ten Snapchat video files were transferred to the Android via MMS messages by
opening a conversation between the two devices and then attaching the snap videos and sending.
Extracted from iPhone
The iPhone was forensically acquired using Cellebrite UFED 4PC. A licensed version of
the software was run on the analysis laptop and the iPhone was connected via an Apple charging
cord. A full logical extraction was completed. Once the extraction was successful it was loaded
into Cellebrite Physical Analyzer, the ten saved snap videos were located as well as the MMS
messages containing the ten videos received from the Android and were exported.
14
CHAPTER IV
DETAILS OF EXAMINATION
Working copies of each of the Snapchat video files collected from the iPhone, the
Android, Dropbox and Gmail were created and used for all analyses, eighty in total. The snap
video files that originated on the Android were compared to each other by analyzing hash values,
stream hash values, metadata, and audio samples. The same was done for the files that originated
on the iPhone. Then the defining aspects of the Android snap video files and the iPhone snap
video files were compared to each other.
Hash Values
A hash value is a calculated numeric/alphanumeric value that acts as a digital
“fingerprint” and is used to identify digital files. Hash values are used for validating evidence.
[6] When hash values are the same, it confirms that the files match and one is not different from
the other in any way. The hash values for each file were calculated using Jacksum 2.0.0 and the
audio and video stream hashes were calculated using FFmpeg for the purpose of comparing the
Snapchat video files transferred via Gmail, Dropbox and MMS message to the “original”
extracted from each phone. SHA256 was used for the hash values of the video files and MD5
was used for the audio and video stream hash values. The MD5 and SHA family of algorithms
are considered industry standards when calculating hash values in relation to mobile forensics.
[6] When the video file hash values match, it means that the file had not been compressed or
changed in the transfer. The file size was also calculated by Jacksum and included. The audio
and video stream hashes were calculated for the files that did not show hash value matches to the
originals. This was done to show whether the files were solely re-containerized or whether they
were transcoded and recompressed.
15
Android
The SHA256 hash values of each of the ten original Android Snapchat video files along
with their corresponding transferred files were calculated using Jacksum. The snap videos
transferred via Dropbox and Gmail consistently showed hash matches to the originals extracted
from the Android. The files that were sent via MMS message and extracted from the iPhone
showed hash mismatches. (See Appendix A for an example of these hash values.)
The audio and video stream MD5 hash values were calculated using Ffmpeg for the
original Android Snapchat video files and the files that were transferred via MMS messages and
extracted from the iPhone. The stream hashes were not calculated for the video files that were
transferred via Dropbox and Gmail since these files had SHA256 hash value matches to the
original files. The audio and video stream hash values were both a mismatch, meaning they were
not solely re-containerized. Both the audio and video of the Snapchat files were changed or
recompressed. (See Appendix B for examples of the stream hash values.)
iPhone
The SHA256 hash values of each of the ten original iPhone Snapchat video files along
with their corresponding transferred files were calculated using Jacksum. The snap videos
transferred via Dropbox showed hash value matches to the original Snapchat videos extracted
from the iPhone. The video files transferred via Gmail showed hash value mismatches as well as
those extracted from the Android that were sent via MMS messages from the iPhone. (See
Appendix C for examples of the hash values.)
The audio and video stream MD5 hash values were calculated for the original iPhone
Snapchat video files, the files that were transferred via Gmail, and those sent via MMS messages
and extracted from the Android. The stream hashes for the files transferred via Dropbox were not
16
calculated since these files had SHA256 hash value matches to the original files. The files
transferred via Gmail had audio stream hash value matches, but video stream hash value
mismatches. This means that the audio in the video was not changed or recompressed, but the
video was. The video files that were sent via MMS message and extracted from the Android had
audio and video stream mismatches, meaning both streams were not solely re-containerized. (See
Appendix D for examples of the stream hash values.)
Metadata from ExifTool
EXIF (Exchangeable Image File Format) is a common format in which media file
metadata is written. Exiftool was run on each of the Snapchat videos files for the purpose of
comparison analysis, focusing on the file size, format, duration, compressor, video frame rate,
image size and average bitrate. The metadata was also analyzed for signs of the Snapchat
application and the originating device.
Android
Exiftool was run on the ten Android Snapchat video files and their corresponding
transferred files. The snap video files extracted from the Android and transferred using Dropbox
and Gmail had hash value matches, so these video files remained unchanged except for the file
name and file dates, which do not alter any content. The saved snap video files sent via MMS
messages and extracted from the iPhone showed changes due to recompression. This
recompression occurs on the Android before a video is sent via MMS message.
The file sizes of the videos received by the iPhone were an average of 96.14 percent
smaller than the sizes of the files extracted from the Android. The file types/formats remain the
same, mp4. The duration, track duration and media duration changed just slightly between the
videos extracted from the Android and the files extracted from the iPhone, but it was
17
inconsistently shorter or longer. The metadata of the files extracted from the iPhone showed an
Android version, while the others did not. The audio format was consistent between the four
files, mp4a. The image height and width of the file extracted from the Android was 1072 x 1920,
whereas the file transferred via MMS to the iPhone was much smaller at 176 x 144. The handler
description showed “Snap Video” for the files extracted from the Android, which did not carry
over to file transferred to the iPhone. The video frame rate and the average bitrate showed a
significant reduction for the video file transferred to the iPhone. (See Appendix E for examples
of the metadata shown using ExifTool.)
iPhone
Exiftool was run on the ten iPhone Snapchat video files and their corresponding
transferred files. The snap video files extracted from the iPhone and transferred to Dropbox had
hash value matches, so these video files remained unchanged except for the file name and file
dates, which do not alter any content. The saved snap video files sent via Gmail and MMS
messages to the Android showed changes due to recompression. This occurs on the iPhone
before a video is sent in an MMS message.
The file sizes of the videos transferred using Gmail were on average 89.42 percent
smaller and the videos extracted from the Android were on average 97.94 percent smaller than
the files extracted from the iPhone. The file type/format changed from mp4 to mov for the Gmail
files and 3gp for the files extracted from the Android. 3GP (Third Generation Partnership
Project) is a format video format for compression related to mobile devices. The durations of the
video files were mostly consistent when compared to their corresponding transferred files. The
Duration and Track Duration were consistent with nine of the ten videos. Snapchat video file 014
showed a slight difference in the Track Duration for the file extracted from the Android. The
18
Media Duration showed as slightly different for each of the test files with the versions
transferred using Gmail and sent via MMS messagess to the Android. The audio format changed
from mp4a to amr with the video files extracted from the Android. AMR (Adaptive Mult-Rate
audio codec) is a known compression format used in mobile device MMS messaging. The video
files extracted from the Android showed an Encoder Vendor as Apple, and the files transferred
via Gmail showed a Handler Vendor ID as Apple. The original iPhone snap video and the
Dropbox video file did not show “Apple” anywhere in the metadata. All the files did show “Core
Media” in the Handler Description. The files from Gmail showed slightly different with “Core
Media Data Handler.” Core Media is a framework specific to Apple iOS devices. The image size
for the video files extracted from the iPhone and Dropbox was 656 x 1232. The image size for
the Gmail video files was 256 x 480, and the size for the videos extracted from the Android was
320 x 240. The video frame rates for the files extracted from the iPhone and Dropbox were
approximately 30 frames per second, the Gmail files were consistent or very similar to the
original files, and the files from the Android showed as half of that at 15 frames per second. The
average bitrate of the Gmail files was significantly lower than the original iPhone file and even
less for the file extracted from the Android. The Compression ID showed as AVC (Advanced
Video Coding) for each of the video files. (See Appendix F for examples of the metadata shown
using ExifTool.)
MediaInfo – File Format
The saved Snapchat video files were also reviewed in MediaInfo for file structure
analysis and a comparison between the transfer methods. Much of the same information can be
seen in this data as the metadata shown using ExifTool, but there are several significant
differences.
19
Android
The ten saved Android Snapchat video files, numbered 001 through 010, were loaded
into MediaInfo as well as their corresponding transferred files. The notable difference between
the metadata shown using ExifTool and MediaInfo was that MediaInfo shows “Snap Video” as
well as “Snap Audio” in the metadata for the original video files extracted from the Android and
the video files transferred via Dropbox and Gmail. This is significant because it directly relates
to Snapchat and provides evidence to this application as the source. The metadata displayed
using MediaInfo did not show the Android version, which is shown in the metadata displayed
using ExifTool. (See Appendix G for examples of the metadata shown using MediaInfo.)
iPhone
The ten saved iPhone Snapchat video files, numbered 011 through 020, were loaded into
MediaInfo as well as their corresponding transferred files. There were two notable differences
between the metadata shown using ExifTool and MediaInfo. MediaInfo shows “Core Media
Video” as well as “Core Media Audio” for the files extracted from the iPhone and the videos
transferred via Dropbox and Gmail, and the files extracted from the Android show “Apple
Revision 1” and “Apple QuickTime.” The files extracted from the Android did not show
“Apple” anywhere in the metadata displayed using ExifTool. “Core Media” and “Apple” are
significant because they both directly relate to the source being the iPhone. There still is no
evidence that relates directly to the Snapchat application as with the ExifTool metadata. (See
Appendix G for examples of the metadata shown using MediaInfo.)
Audio Samples
The total audio samples of each Snapchat video file and their corresponding transferred
files were calculated using four different tools: iZotope RX 8 Advanced, mp4dump, mp4info,
20
and FAAS. The tools mp4dump and mp4info were run using Windows Powershell, which is a
command-line shell. The use of multiple tools shows how different tools can lead to different
results.
Android
The audio samples were calculated for the ten Snapchat video files extracted from the
Android and those that were sent via MMS messages and extracted from the iPhone. The audio
samples of the files that were transferred via Dropbox and Gmail were not calculated because
these files had hash value matches to the original video files extracted from the Android,
meaning the number of samples would also match. The tools used were iZotope RX 8 Advanced,
mp4dump, mp4info, and FAAS.
When comparing the original video files extracted from the Android to the files sent via
MMS message and extracted from the iPhone, it was found that the files extracted from the
iPhone had a decrease between 0.1 and 0.4 percent in the number of audio samples. The tools
mp4dump, mp4info, and FAAS consistently showed matching results, whereas iZotope RX 8
Advanced showed results with 1024 less samples for each file. The percentage change between
the number of samples calculated for the videos extracted from the Android versus the iPhone
with iZotope was very close to the percent of change calculated using the other tools. For
example, the percent decrease for video 001 extracted from the Android versus the video
extracted from the iPhone was 0.15129 percent when using iZotope and 0.15106 percent when
using mp4dump, mp4info, and FAAS.
The following table represents the audio samples calculated in each tool for the Android
snap video file 001 extracted from the Android and the video file sent via MMS message and
extracted from the iPhone. (See Appendix I for additional examples)
21
Table 1. Audio Samples of Android Snapchat Video 001
001 Audio Samples
iZotope RX 8
mp4dump
mp4info
FAAS
Extracted from Android
676864
677888
677888
677888
Extracted from iPhone
675840
676864
676864
676864
iPhone
The audio samples were calculated for the ten iPhone Snapchat video files extracted from
the iPhone and their corresponding files transferred via Gmail and those sent via MMS messages
and extracted from the Android. The audio samples of the files that were transferred via Dropbox
were not calculated because these files had hash value matches to the original files extracted
from the iPhone, meaning the number of samples would also match. The tools used were iZotope
RX 8 Advanced, mp4dump, mp4info, and FAAS.
The video files that were transferred via Gmail consistently had the same number of
audio samples as the original files extracted from the iPhone even though it was found during the
metadata analysis that these files were 89.42 percent smaller in file size.
When comparing the video files extracted from the iPhone to the files sent via MMS
messages and extracted from the Android, it was found that the files extracted from the iPhone
had a decrease between 81.689 and 81.895 percent in the number of audio samples. The tools
mp4dump and mp4info consistently showed matching results, but those results were slightly
different than the sample numbers found using FAAS and iZotope. Even so, the percentages of
change were very similar using each tool. For example, for video file 011 the percentage of
change between the file extracted from the iPhone compared to the file extracted from the
Android showed an 81.774 percent decrease with iZotope. With mp4dump and mp4info the
percentage of change was an 81.851 percent decrease, and with FAAS the percentage of change
was an 81.850 percent decrease.
22
A consistent change was found in audio sample numbers was between tools for each of
the video files, 011 through 020, sent via MMS message and extracted from the Android. The
tools mp4dump and mp4info showed 160 less samples than iZotope and 200 more than FAAS.
FAAS showed 40 more samples than iZotope. A consistency was not found when comparing the
number of samples for the video files extracted from the iPhone and the files transferred via
Gmail.
The following table represents the audio samples calculated in each tool for the iPhone
snap video file 011 extracted from the iPhone and the corresponding video file sent via MMS
message and extracted from the Android. (See Appendix J for additional examples)
Table 2. Audio Samples of iPhone Snapchat Video 011
011 Audio Samples
iZotope RX 8
mp4dump
mp4info
FAAS
Extracted from iPhone
762880
766976
766976
765824
Gmail
762880
766976
766976
765824
Extracted from Android
139040
139200
139200
139000
23
CHAPTER V
CONCLUSIONS
Upon completion of the forensic analyses, conclusions were made when comparing the
saved Android Snapchat video files extracted from the Android to those same files transferred
via Dropbox, Gmail and MMS messages to the iPhone and when comparing the saved iPhone
Snapchat video files extracted from the iPhone to those same files transferred via Dropbox,
Gmail and MMS messages to the Android. Then the results of the analysis on the Android snap
videos were compared to those from the iPhone snap videos and defining factors of each were
found. It is important to reiterate that these video files were captured using the camera capture
function within the Snapchat application and then saved to the mobile devices. The snap videos
were not actually sent. Sending the videos to friends or posting them on a story does not
automatically save them to the device.
Android
A comparison analysis was completed on the four types of Android snap video
files. The video files extracted from the Android were considered to be the original files, whereas
the other files were created via three transfer methods: Dropbox, Gmail message and MMS
messages to the iPhone. The video files transferred via Dropbox and Gmail message had hash
value matches to their counterparts extracted from the Android, meaning these methods did not
recompress or change the video files in any way. The table below shows the hash values for
Android Snapchat video file 004 and its corresponding transferred files. The hash values
highlight in green are matches, and the hash value highlighted in yellow shows a mismatch.
24
Table 3. Hash Values of Android Snapchat Video 004
004
Extracted from
Android
Dropbox
Gmail
Extracted from iPhone
Filename
Snapchat-
636849438_1.mp4
Snapchat-
636849438.mp4
Snapchat-
636849438.mp4
Snapchat-
6368494381.mp4
File Size
17710032 bytes
17710032 bytes
17710032 bytes
701734 bytes
SHA256
22058d789088b578d9f47
caa53c36c6339ffbbccfd5
b8cbfeac150597428fe1e
22058d789088b578d9f47
caa53c36c6339ffbbccfd5
b8cbfeac150597428fe1e
22058d789088b578d9f47
caa53c36c6339ffbbccfd5
b8cbfeac150597428fe1e
720d9b0e2411ff0fda40d0
7187b2d7f96b72cd1c356
71e2ccaece73ab54ba004
The audio and video stream hash values were also analyzed for each of the Snapchat
video files extracted from the Android the corresponding transferred video files to see if audio
and/or video was merely re-containerized. The Android Snapchat video files that were sent via
MMS message and extracted from the iPhone showed video and audio stream mismatches,
meaning neither the audio or video was re-containerized. The audio and video of these files were
both re-compressed in the transfer. With that being said, the comparison of Android snap video
files focused on the changes between the videos extracted from the Android and the ones that
were sent via MMS messages and extracted from the iPhone. The table below shows the audio
and video stream hash values for Android Snapchat video file 004 (highlighted in green) and its
corresponding video file transferred via MMS message and extracted from the iPhone
(highlighted in yellow).
Table 4. Stream Hash Values of Android Snapchat Video 004
004
Extracted from Android
Extracted from iPhone
Audio Stream Hash Values
a59c01a538fd8f77133fbbf1e022d2cc
19889dd5217892da333e960bb0a99cf2
Video Stream Hash Values
a3f59e6e8c3e5e62965516e872bcaf28
30765ba93f1a6b489e1fa00fc7172df6
The metadata of each of the Android snap video files was analyzed for file structure and
format. In preparation for sending the Android video files via MMS messages, the mobile device
automatically recompressed the files. The video files extracted from the iPhone were on average
96.14 percent smaller in file size than the original files extracted from the Android. The format
25
remained the same as mp4 and the audio format remained as mp4a. The image height and width
decreased from 1072 x 1920 to 176 x 144. The video frame rate was approximately cut in half,
and the average bitrate was decreased from approximately 8 megabits per second to 300 kilobits
per second. The table below shows these categories from the metadata pulled from ExifTool for
the Android Snapchat video file 004 (highlighted in green) and its corresponding video file
transferred via MMS message and extracted from the iPhone (highlighted in yellow.)
Table 5. Partial Metadata of Android Snapchat Video 004 from ExifTool
004
Extracted from Android
Extracted from iPhone
File Size
17 MiB
685 KiB
File Type
MP4
MP4
File Type Extension
mp4
mp4
Media Data Size
17701743
695573
Image Width
1072
176
Image Height
1920
144
Source Image Width
1072
176
Source Image Height
1920
144
Video Frame Rate
28.604
14.296
Image Size
1072x1920
176x144
Avg Bitrate
8.11 Mbps
318 kbps
“Snap Video” is shown in the metadata pulled using ExifTool, and the metadata pulled
using MediaInfo displayed “Snap Video” and “Snap Audio” for the files extracted from the
Android and transferred files with hash value matches, which directly relates to the Snapchat
application. The files sent via MMS messages and extracted from the iPhone no longer showed
“Snap” anywhere in the metadata, but they did show “Android Version 10” in the metadata
displayed using ExifTool. This directly relates to Android, but not the Snapchat application. The
tables below show these categories from the metadata shown in ExifTool and MediaInfo for the
Android Snapchat video file 004 (highlighted in green) and its corresponding video file
transferred via MMS message and extracted from the iPhone (highlighted in yellow.)
26
Table 6. Partial Metadata of Android Snapchat Video 004 from ExifTool
004
Extracted from Android
Extracted from iPhone
Android Version
10
Handler Description
Snap Video
SoundHandle
Table 7. Partial Metadata of Android Snapchat Video 004 from MediaInfo
004
Extracted from Android
Extracted from iPhone
Title
Snap Video
VideoHandle
Title
Snap Audio
SoundHandle
The audio samples of each saved snap video file were also reviewed using four different
tools, iZotope RX 8 Advanced, mp4dump, mp4info, and FAAS, and the number of samples was
only reduced slightly by a decrease between 0.1 and 0.4 percent with the video files sent via
MMS messages and extracted from the iPhone. The table below shows the audio samples for the
Android Snapchat video file 004 (highlighted in green) and its corresponding video file
transferred via MMS message and extracted from the iPhone (highlighted in yellow.)
Table 8. Audio Samples of Android Snapchat Video 004
004 Audio Samples
iZotope RX 8
mp4dump
mp4info
FAAS
Extracted from Android
769024
770048
770048
770048
Extracted from iPhone
768000
769024
769024
769024
iPhone
A comparison analysis was completed on the four types of iPhone snap video files. The
video files extracted from the iPhone were considered to be the original files, whereas the other
files were created via the three transfer methods: Dropbox, Gmail and MMS message to the
Android. The video files transferred via Dropbox had hash value matches to their counterparts
extracted from the iPhone, meaning these files were not recompressed or changed, but the files
sent via Gmail and MMS message were recompressed prior to sending. The table below shows
that the files transferred via Dropbox maintained the same hash values (highlighted in green),
27
while the files transferred via Gmail (highlighted in yellow) and sent via MMS message and
extracted from the Android (highlighted in blue) showed hash mismatches.
Table 9. Hash Values of iPhone Snapchat Video 014
014
Extracted from iPhone
Dropbox
Gmail
Extracted from
Android
Filename
8A75528F-2D19-41E2-
A1F4-
B84372E659A3.MP4
IMG_3568.MP4
IMG_64212286.MOV
8A75528F-1.3gp
File Size
12847178 bytes
12847178 bytes
1313878 bytes
257293 bytes
SHA256
15312538a4b1822f92de4
ee5913eed615afce4c1723
dd6e95fc31c2812375c50
15312538a4b1822f92de4
ee5913eed615afce4c1723
dd6e95fc31c2812375c50
ac9f7dc460306536a117a
c18b446d16d7328e766e8
c77e19f18f52a2b4dfbf08
7293d328b3dd4b3af35fe
99edd2f7c9310239973c2
2aa0655828fe1642c4785
d
The audio and video stream hashes were analyzed for each of the Snapchat video files
extracted from the iPhone and their corresponding transferred video files to see if audio and/or
video was merely re-containerized. The iPhone Snapchat video files that were transferred via
Gmail had audio stream hash matches to the original iPhone Snapchat video files, but had video
stream hash mismatches, meaning the audio was re-containerized and not altered, but the video
was re-compressed. The iPhone Snapchat video files that were sent via MMS messages and
extracted from the Android had audio and video stream hash mismatches. The table below shows
the audio and video stream hash values of the Snapchat video files extracted from the iPhone
(highlighted in green), the video files transferred via Gmail (the audio stream hash match
highlighted in green, and the video stream mismatch highlighted in yellow), and the video file
sent via MMS message and extracted from the Android (highlight in blue.)
Table 10. Stream Hash Values of iPhone Snapchat Video 014
014
Extracted from iPhone
Gmail
Extracted from Android
Audio Stream Hash
Values
f7371854cce8e8c217945085da
cb5210
f7371854cce8e8c217945085da
cb5210
c6996b64f867ed02f930204b8d
6e9a95
Video Stream Hash
Values
a6ee1d0f1b1022ed7edb0a454e
545a1d
f3f684266ad871b1b9d93d143
597cefc
18945d8ed6dd57f9ce2a38a969
8a3f60
The metadata of each of the iPhone snap video files was analyzed for file structure and
format. The file sizes of the videos transferred via Gmail were reduced by 89.42 percent and the
28
files transferred via MMS messages to the Android were reduced by 97.94 percent. The format
was changed from mp4 to mov with the Gmail transfer and to 3gp for the files extracted from the
Android. The audio format changes from mp4a to amr for the files extracted from the Android.
The image size for the video files extracted from the iPhone and Dropbox was 656 x 1232. The
image size for the Gmail video files was 256 x 480, whereas the size for the videos extracted
from the Android was 320 x 240. The video frame rate for the files extracted from the iPhone
and Dropbox were approximately 30 frames per second, the Gmail files are consistent or very
similar to the original files, and the files from the Android displayed the frame rate as half at 15
frames per second. The average bitrate of the Gmail files was significantly lower than the
original iPhone file and even less for the file extracted from the Android. The table below
displays these categories from the metadata pulled from ExifTool for the iPhone Snapchat video
file 014 (highlighted in green) and its corresponding video files transferred via Gmail
(highlighted in yellow) and sent via MMS message and extracted from the iPhone (highlighted in
blue.)
Table 11. Partial Metadata of iPhone Snapchat Video 014 from ExifTool
014
Extracted from iPhone
Gmail
Extracted from Android
File Size
12 MiB
1283 KiB
251 KiB
File Type
MP4
MOV
3GP
Audio Format
mp4a
mp4a
samr
Image Width
656
256
320
Image Height
1232
480
240
Video Frame Rate
29.952
30.026
15
Image Size
656x1232
256x480
320x240
Avg Bitrate
7.56 Mbps
768 kbps
150 kbps
“Core Media Video” was shown in the metadata for all the files, except the files
transferred to Gmail showed “Core Media Data Handler.” The video file transferred via Gmail
displayed “Apple” in the metadata pulled using ExifTool. The MediaInfo metadata showed
29
“Core Media Video” and “Core Media Audio” for all files. The files extracted from the Android
only showed “Apple Revision 1” and the files transferred via Gmail showed “Apple QuickTime”
as the writing library in MediaInfo. This particular data showed a correlation to Apple, but there
was no data directly relating to the Snapchat application. The tables below show these categories
in the metadata displayed using ExifTool and MediaInfo for the Snapchat video files extracted
from the iPhone (highlighted in green), the files transferred via Gmail (highlighted in green for
the data matching the original file, and yellow for the changes), and the files sent via MMS
message and extracted from the Android (highlighted in green for the data matching the original
file, and blue for the changes.)
Table 12. Partial Metadata of iPhone Snapchat Video 014 from ExifTool
014
Extracted from iPhone
Gmail
Extracted from Android
Handler Description
Core Media Video
Core Media Data Handler
Core Media Video
Handler Vendor ID
Apple
Table 13. Partial Metadata of iPhone Snapchat Video 014 from ExifTool
014
Extracted from iPhone
Gmail
Extracted from Android
Writing library
Apple QuickTime
Title
Core Media Video
Core Media Video
Core Media Video
Title
Core Media Audio
Core Media Audio
Core Media Audio
Writing library
Apple Revision 1
The audio samples of each saved iPhone Snapchat video file were also reviewed using
four different tools, iZotope RX 8 Advanced, mp4dump, mp4info, and FAAS, and the number of
samples was not reduced with the Gmail transfer even though the file sizes were reduced, but the
number of audio samples of the video files extracted from the Android were reduced
significantly by a decrease between 81.689 and 81.895. The table below shows the audio
samples for the iPhone Snapchat video file 014 and its corresponding video files transferred via
30
Gmail (both highlighted in green) and sent via MMS message and extracted from the iPhone
(highlighted in blue.)
Table 14. Audio Samples of iPhone Snapchat Video 014
014 Audio Samples
iZotope RX 8
mp4dump
mp4info
FAAS
Extracted from iPhone
594944
599040
599040
597888
Gmail
594944
599040
599040
597888
Extracted from Android
108640
108800
108800
108600
Android vs. iPhone
The saved Snapchat video files had similarities and differences between the files
extracted from the Android and the iPhone as the original files. The format was mp4 with an
audio format of mp4a and the AVC compressor. The video frame rate was approximately 30
frames per second and an average bitrate around 8 megabits per second. The resolution was
displayed as 72 pixels per inch for the Android snap video files and the iPhone snap video files,
although the image sizes were different at 1072 x 1920 for the Android and 656 x 1232 for the
iPhone.
Videos from both the Android and the iPhone had defining factors that were mostly
carried through even when transferred. The Android showed “Snap Audio” and/or “Snap Video”
in the metadata for the original files and the files transferred via Dropbox and Gmail. The video
files that were transferred via MMS and extracted from the iPhone no longer showed the “Snap
Audio” or “Snap Video,” but they did add data showing the Android version, which ties the files
back to the Android, but not necessarily Snapchat. The saved iPhone snap video files
consistently showed “Core Media” for all of the files, which is a framework specifically related
to Apple iOS devices. This, however, does not specifically relate to Snapchat. The table below
displays categories of interest in the metadata for the Android Snapchat video file 004 versus the
31
iPhone Snapchat video file 014. The similarities are highlighted in green and the differences are
highlighted in yellow and blue.
Table 15. Partial Metadata of Android Snapchat Video 004 vs. iPhone Snapchat Video 014
004 Android Snapchat Video vs.
014 iPhone Snapchat Video
Original Extracted from Android
Original Extracted from iPhone
File Type
MP4
MP4
Audio Format
mp4a
mp4a
Image Width
1072
656
Image Height
1920
1232
Handler Description
Snap Video
Core Media Video
Video Frame Rate
28.604
29.952
Image Size
1072x1920
656x1232
Avg Bitrate
8.11 Mbps
7.56 Mbps
Compressor ID
avc1
avc1
X Resolution
72
72
Y Resolution
72
72
Different transfer methods may recompress the files in different ways or change the
format, but this analysis shows that both the iPhone and Android leave defining marks within the
data that could be used to trace them back to the originating device or application. The Snapchat
video files created on the Android, however, were the only files that left an indication that the
Snapchat application was used.
Future Research
There are multiple ways that this comparison analysis between Snapchat video files
created on an Android and iPhone could be furthered. Different operating system versions could
be used in the collection of Snapchat video files on Android and iPhones. This would require
waiting for multiple operating system versions to be released for Androids and iPhones, which
was outside of the scope of time for this thesis. Snapchat videos longer than 30 seconds could be
taken to analyze whether the level of recompression is greater with the larger file sizes. This
thesis limited the durations of the video files to less than thirty seconds in order to keep the file
sizes small enough to send using Gmail, so it is unlikely that this transfer method would be an
32
option with this type of further research. Additionally, different transfer methods could be
utilized in further research studies, such as Facebook Messenger, WhatsApp, or Airdrop.
Transfer methods in this thesis were limited due to time constraints.
This thesis focused on a comparison of Snapchat video files originating from an Android
or iPhone and transferred using several methods. In further research, the original Snapchat video
files from an Android could be compared to video files captured with the pre-installed camera
application, and the Snapchat video files captured on the iPhone could be compared to videos
taken with the pre-installed iPhone camera application. This analysis would show the differences
and similarities between the data that Snapchat saves versus the data that the pre-installed camera
applications save.
Another option for additional research would be to complete physical acquisitions of an
Android and an iPhone to analyze whether additional Snapchat videos may be recoverable when
sent and received rather than saved prior to sending. Physical acquisitions opposed to logical
acquisitions are not typically commercially available and were not an option for this thesis. [3]
33
REFERENCES
[1] Lin, X. Introductory Computer Forensics, A Hands-on Practical Approach, Springer, 2018.
[2] SWGDE Digital & Multimedia Evidence Glossary Version: 3.0 (June 23, 2016)
[3] Wales, G. (2019) Proposed Framework for Digital Video Authentication. University of
Colorado at Denver, ProQuest Dissertations Publising, 2019. 13881456.
[4] Blair, J. Seeking the Truth from Mobile Evidence: Basic Fundamentals, Intermediate and
Advanced Overview of Current Mobile Forensic Investigations. Chapter 1, p. 3 – 13, 2018.
[5] Alyahya, T., & Kausar, F. (2017). Snapchat Analysis to Discover Digital Forensic Artifacts
on Android Smartphone. Elsevier, Science Direct Procedia Computer Science.109C 1035-1040.
Doi: 10.1016/j.procs.2017.05.421.
[6] Wilson, R., Chi, H. A Framework for Validating Aimed Mobile Digital Forensics
Evidences. ACM SE ’18. March 29-31, 2018.
[7] SWGDE Best Practices for Digital Forensic Video Analysis Version 1.0 (November 20,
2018)
[8] Hook, S. A., Faklaris, C.. Oh, Snap! The State of Electronic Discovery Amid the Rise of
Snapchat, WhatsApp, Kik, and Other Mobile Messaging Apps. The Federal Lawyer, 2016.
[9] Garcia Villalba, L.J., Sandoval Orozco, A. L., Ramos Lopez, R., Hernandez Castro, J.
Identification of Smartphone Brand and Model via Forensic Video Analysis. Elsevier, Expert
Systems with Applications, 2016.
[10] Huamán, C. Q., Sandoval Orozco, A. L., García Villalba. L. J. Authentication and Integrity
of Smartphone Videos through Multimedia Container Structure Analysis. Elsevier, Future
Generation Computer Systems. 108 15 – 33, 2020.
[11] Jansen, W., Ayers, R. Guidelines on Cell Phone Forensics, Recommendations of the
National Institute of Standards and Technology. National Institute of Standards and Technology,
Special Publication. 800-101, May 2007.
[12] Batmpatsalou, K., Cruz, T., Monteiro, E., Simoes, P. ACM Computing Surveys. Vol. 51, No.
3, Article 46, April 2018.
[13] SWGDE Technical Notes on FFmpeg Version: 2.0 (November 20, 2018)
34
APPENDIX A
The ten original Android Snapchat video files were numbered 001 through 010. The
following tables display the SHA256 hash values for 001, 002, and 003, the original files and
their corresponding transferred files. The tables show that the files transferred via Dropbox and
Gmail maintained the same hash values, while the files that were sent via MMS message and
extracted from the iPhone had hash mismatches. The video files extracted from the iPhone shows
a 96.39 percent reduction in size.
Hash Values of Android Snapchat Video 001
001
Extracted from Android
Dropbox
Gmail
Extracted from iPhone
Filename
Snapchat-
196961414_1.mp4
Snapchat-
196961414.mp4
Snapchat-
196961414.mp4
Snapchat-
1969614141.mp4
File Size
15502360 bytes
15502360 bytes
15502360 bytes
559137 bytes
SHA256
7f1514c0ad86b63db3756
eb4db78c43a70291833ca
923c38fca2fc98b5652b18
7f1514c0ad86b63db3756
eb4db78c43a70291833ca
923c38fca2fc98b5652b18
7f1514c0ad86b63db3756
eb4db78c43a70291833ca
923c38fca2fc98b5652b18
1dd10fb5955b79f2f105b
0c7ef789ddb6a811dc90c
08d2c7d0862b18fc6e57c
1
Hash Values of Android Snapchat Video 002
002
Extracted from
Android
Dropbox
Gmail
Extracted from iPhone
Filename
Snapchat-
340788319_1.mp4
Snapchat-
340788319.mp4
Snapchat-
340788319.mp4
Snapchat-
3407883191.mp4
File Size
15065500 bytes
15065500 bytes
15065500 bytes
562219 bytes
SHA256
f0e36da99467e234f3850
4ff025671940031f118e2
859d96ae4be019692a8fe
4
f0e36da99467e234f3850
4ff025671940031f118e2
859d96ae4be019692a8fe
4
f0e36da99467e234f3850
4ff025671940031f118e2
859d96ae4be019692a8fe
4
34e43190edfb1ef439ec73
13a53a851267240868e27
b7c74ac4d82e208528005
Hash Values of Android Snapchat Video 003
003
Extracted from
Android
Dropbox
Gmail
Extracted from iPhone
Filename
Snapchat-
533796126_1.mp4
Snapchat-
533796126.mp4
Snapchat-
533796126.mp4
Snapchat-
5337961261.mp4
File Size
8722728 bytes
8722728 bytes
8722728 bytes
316179 bytes
SHA256
296635f347986b25c9c88
c6c28506e5422d0255307
3eb37dd10728c8ff50b20
e
296635f347986b25c9c88
c6c28506e5422d0255307
3eb37dd10728c8ff50b20
e
296635f347986b25c9c88
c6c28506e5422d0255307
3eb37dd10728c8ff50b20
e
fc30e18c7fa885b812a545
a8f519a6106486956f7cb
260db7b87c43847134f00
35
APPENDIX B
The following tables display the audio and video stream MD5 hash values for 001, 002,
and 003, the original Android Snapchat video files and the files sent via MMS messages and
extracted from the iPhone. The audio and video stream hashes were a mismatch between the
files.
Stream Hash Values of Android Snapchat Video 001
001
Extracted from Android
Extracted from iPhone
Audio Stream Hash Values
c1fe9c064f4ca6d75b95e15e099baf8f
13a5bd6a8c6822f48aa8ed7561efaf78
Video Stream Hash Values
3f048f2884ecd43bf4ade0837e164ff5
bb46a6503d5ca362fe21e4c8e0cc78d3
Stream Hash Values of Android Snapchat Video 002
002
Extracted from Android
Extracted from iPhone
Audio Stream Hash Values
cef7f6ae5f06a2a54134654e8334c1a2
6b4f4a486ed9123f4963a3292d8242a3
Video Stream Hash Values
0489d9f5fa50848c42681d7ed657fad4
445bcb5d1f9c751b616020a173ea62c5
Stream Hash Values of Android Snapchat Video 003
003
Extracted from Android
Extracted from iPhone
Audio Stream Hash Values
ff149e8f1f698ea68694b4eda2c3d016
1c7a8ad27b592b00130e3ed49b09e7fd
Video Stream Hash Values
1c7a8ad27b592b00130e3ed49b09e7fd
ecec2e9be2cd6a1ff756ab310320691b
APPENDIX C
The ten iPhone Snapchat video files were numbered 011 through 020. The following
tables display the SHA256 hash values of 011, 012, and 013, the original files and their
corresponding transferred files. The tables show that the files transferred via Dropbox
maintained the same hash values, while the files transferred via Gmail and MMS message to the
Android showed hash mismatches.
36
Hash Values of iPhone Snapchat Video 011
011
Extracted from iPhone
Dropbox
Gmail
Extracted from
Android
Filename
EA334448-85EE-4BB8-
82E0-
962BBE848EC3.MP4
IMG_3575.MP4
IMG_16065091.MOV
EA334448-1.3gp
File Size
16517932 bytes
16517932 bytes
1688092 bytes
328835 bytes
SHA256
cf78854c3c72c7960cfe54
41355587c2d6b2e18c9bf
e1e856403462d7446cb70
cf78854c3c72c7960cfe54
41355587c2d6b2e18c9bf
e1e856403462d7446cb70
f7fb78cd705b4dd244902
7366a7712dc84ef45c297
c498d12646c87e60f91be
7
831571eb4d3983c71bf54
41d6a20fa32ff8e678216b
917fd88e34b7332babe91
Hash Values of iPhone Snapchat Video 012
012
Extracted from iPhone
Dropbox
Gmail
Extracted from
Android
Filename
98F95CC8-62E2-489C-
8E9A-
1FBBBF830AA9.MP4
IMG_3567.MP4
IMG_27744659.MOV
98F95CC8-1.3gp
File Size
13001296 bytes
13001296 bytes
1320618 bytes
254516 bytes
SHA256
54614dce8895b003ba9b7
34286c2e2c6401113bda9
963f781574fc9b1ebe9fae
54614dce8895b003ba9b7
34286c2e2c6401113bda9
963f781574fc9b1ebe9fae
7e3a916e76459e018b419
dd01457ceb0803f2fb6eca
6a74ed1a946aa4fba9e80
9361d4541d964fc4c7a36
0255d90fa76aa5c1cb234
c8cb96f3e3f4eea3d1a33d
Hash Values of iPhone Snapchat Video 013
013
Extracted from iPhone
Dropbox
Gmail
Extracted from
Android
Filename
7AB4BBB0-9EF7-48C0-
BC0C-
DF6DB30AEDB2.MP4
IMG_3573.MP4
IMG_257523635.MOV
7AB4BBB0-1.3gp
File Size
10840796 bytes
10840796 bytes
1097934 bytes
213149 bytes
SHA256
268aa45588aa3462b8844
6cbc28c35a59d44affb4ff
883df6ae35d26d386a620
268aa45588aa3462b8844
6cbc28c35a59d44affb4ff
883df6ae35d26d386a620
4f0afdec555acdef2c8797
24115a5409a5dde0bef55
2a1e8d86e35419dfc8096
2168829901c86da3c598b
0057da633618b3d2d980
6963f36f3f4c4b163bcc61
2
APPENDIX D
The following tables display the audio and video stream MD5 hash values for 011, 012
and 013, the original iPhone Snapchat video files, the files transferred via Gmail and the ones
sent via MMS messages and extracted from the Android. The files transferred via Gmail show
audio stream hash value matches and video stream hash value mismatches, while the files
extracted from the Android show audio and video stream hash value mismatches.
37
Stream Hash Values of iPhone Snapchat Video 011
011
Extracted from iPhone
Gmail
Extracted from Android
Audio Stream Hash
Values
a4b33ec18ca0059187d4c68
d4bf5b4e3
a4b33ec18ca0059187d4c68
d4bf5b4e3
1cab3aa5539ef22b9ba8e1c
1d667582c
Video Stream Hash
Values
3f048f2884ecd43bf4ade083
7e164ff5
6ec59c9db7592640d2506de
d2e80cdd7
9b85cff262df4e86b40a740
95364b3a2
Stream Hash Values of iPhone Snapchat Video 012
012
Extracted from iPhone
Gmail
Extracted from Android
Audio Stream Hash
Values
4feb20818a74b2ccb68a915
8aa1d00cf
4feb20818a74b2ccb68a915
8aa1d00cf
cd4e5489dc300675d84e356
694d771c3
Video Stream Hash
Values
259088a9a0d9b43e98622af
71ffaa5ae
013ffdc71e6606de37dd2b2
931f2adb8
76b975535489492cdd42b6
b321472db2
Stream Hash Values of iPhone Snapchat Video 013
013
Extracted from iPhone
Gmail
Extracted from Android
Audio Stream Hash
Values
5cc7af9575dc84d59237bf1
1b50789e0
5cc7af9575dc84d59237bf1
1b50789e0
0e3b86093daf08f89ae60ba
90b22019e
Video Stream Hash
Values
112eb39d67e26c4e9bb83ca
622e07d4c
df45e6a60ae17c6d210ceb0
6e2475000
9cddd8d011201033b8734c
7206cb1333
APPENDIX E
The following tables display the metadata from ExifTool for 001, 002, and 003, the
original Android Snapchat video files and their corresponding transferred files.
ExifTool Metadata of Android Snapchat Video 001
001
Extracted from
Android
Dropbox
Gmail
Extracted from
iPhone
File Name
Snapchat-
196961414_1.mp4
Snapchat-
196961414.mp4
Snapchat-
196961414.mp4
Snapchat-
1969614141.mp4
File Size
15 MiB
15 MiB
15 MiB
546 KiB
File Modification
Date/Time
2021:02:21 22:43:16-
07:00
2021:02:21 20:23:50-
07:00
2021:02:21 20:27:00-
07:00
2021:02:21 18:07:26-
07:00
File Access Date/Time
2021:02:23 23:56:49-
07:00
2021:02:27 17:28:21-
07:00
2021:02:27 18:58:55-
07:00
2021:02:24 22:39:59-
07:00
File Creation Date/Time
2021:02:23 23:29:50-
07:00
2021:02:27 17:25:03-
07:00
2021:02:27 17:25:34-
07:00
2021:02:23 23:29:50-
07:00
38
001
Extracted from
Android
Dropbox
Gmail
Extracted from
iPhone
File Permissions
rw-rw-rw-
rw-rw-rw-
rw-rw-rw-
rw-rw-rw-
File Type
MP4
MP4
MP4
MP4
File Type Extension
mp4
mp4
mp4
mp4
MIME Type
video/mp4
video/mp4
video/mp4
video/mp4
Major Brand
MP4 v2 [ISO 14496-
14]
MP4 v2 [ISO 14496-
14]
MP4 v2 [ISO 14496-
14]
MP4 v2 [ISO 14496-
14]
Minor Version
0.0.0
0.0.0
0.0.0
0.0.0
Compatible Brands
isom, mp42
isom, mp42
isom, mp42
isom, mp42
Media Data Size
15494332
15494332
15494332
553712
Media Data Offset
32
32
32
40
Movie Header Version
0
0
0
0
Create Date
2021:02:22 00:41:27
2021:02:22 00:41:27
2021:02:22 00:41:27
2021:02:22 01:07:03
Modify Date
2021:02:22 00:41:27
2021:02:22 00:41:27
2021:02:22 00:41:27
2021:02:22 01:07:03
Time Scale
600
600
600
1000
Duration
15.37 s
15.37 s
15.37 s
15.36 s
Preferred Rate
1
1
1
1
Preferred Volume
100.00%
100.00%
100.00%
100.00%
Preview Time
0 s
0 s
0 s
0 s
Preview Duration
0 s
0 s
0 s
0 s
Poster Time
0 s
0 s
0 s
0 s
Selection Time
0 s
0 s
0 s
0 s
Selection Duration
0 s
0 s
0 s
0 s
Current Time
0 s
0 s
0 s
0 s
Next Track ID
255
255
255
3
Play Mode
SEQ_PLAY
Android Version
10
User Data eng (ykn)
-180.00-180.000/
-180.00-180.000/
-180.00-180.000/
Track Header Version
0
0
0
0
Track Create Date
2021:02:22 00:41:27
2021:02:22 00:41:27
2021:02:22 00:41:27
2021:02:22 01:07:03
Track Modify Date
2021:02:22 00:41:27
2021:02:22 00:41:27
2021:02:22 00:41:27
2021:02:22 01:07:03
Track ID
256
256
256
1
Track Duration
15.37 s
15.37 s
15.37 s
15.36 s
Track Layer
0
0
0
0
Track Volume
100.00%
100.00%
100.00%
0.00%
Balance
0
0
0
0
Audio Format
mp4a
mp4a
mp4a
mp4a
Audio Channels
1
1
1
1
Audio Bits Per Sample
16
16
16
16
Audio Sample Rate
44100
44100
44100
44100
Matrix Structure
1 0 0 0 1 0 0 0 1
1 0 0 0 1 0 0 0 1
1 0 0 0 1 0 0 0 1
1 0 0 0 1 0 0 0 1
Image Width
1072
1072
1072
176
Image Height
1920
1920
1920
144
Media Header Version
0
0
0
0
Media Create Date
2021:02:22 00:41:27
2021:02:22 00:41:27
2021:02:22 00:41:27
2021:02:22 01:07:03
Media Modify Date
2021:02:22 00:41:27
2021:02:22 00:41:27
2021:02:22 00:41:27
2021:02:22 01:07:03
Media Time Scale
90000
90000
90000
44100
39
001
Extracted from
Android
Dropbox
Gmail
Extracted from
iPhone
Media Duration
15.36 s
15.36 s
15.36 s
15.35 s
Handler Type
Video Track
Video Track
Video Track
Audio Track
Handler Description
Snap Video
Snap Video
Snap Video
SoundHandle
Graphics Mode
srcCopy
srcCopy
srcCopy
srcCopy
Op Color
0 0 0
0 0 0
0 0 0
0 0 0
Compressor ID
avc1
avc1
avc1
s263
Source Image Width
1072
1072
1072
176
Source Image Height
1920
1920
1920
144
X Resolution
72
72
72
72
Y Resolution
72
72
72
72
Bit Depth
24
24
24
24
Pixel Aspect Ratio
65536:65536
65536:65536
65536:65536
65536:65536
Color Representation
nclx 5 6 5
nclx 5 6 5
nclx 5 6 5
nclx 5 1 6
Video Frame Rate
27.732
27.732
27.732
13.866
User Data eng
-180.00-180.000/
-180.00-180.000/
-180.00-180.000/
Image Size
1072x1920
1072x1920
1072x1920
176x144
Megapixels
2.1
2.1
2.1
0.025
Avg Bitrate
8.06 Mbps
8.06 Mbps
8.06 Mbps
288 kbps
Rotation
0
0
0
0
ExifTool Metadata of Android Snapchat Video 002
002
Extracted from
Android
Dropbox
Gmail
Extracted from
iPhone
File Name
Snapchat-
340788319_1.mp4
Snapchat-
340788319.mp4
Snapchat-
340788319.mp4
Snapchat-
3407883191.mp4
File Size
14 MiB
14 MiB
14 MiB
549 KiB
File Modification
Date/Time
2021:02:21 22:43:16-
07:00
2021:02:21 20:23:41-
07:00
2021:02:21 20:27:00-
07:00
2021:02:21 18:08:20-
07:00
File Access Date/Time
2021:02:23 23:56:16-
07:00
2021:02:27 17:50:51-
07:00
2021:02:27 18:58:12-
07:00
2021:02:24 22:41:58-
07:00
File Creation Date/Time
2021:02:23 23:29:50-
07:00
2021:02:27 17:25:03-
07:00
2021:02:27 17:25:34-
07:00
2021:02:23 23:29:50-
07:00
File Permissions
rw-rw-rw-
rw-rw-rw-
rw-rw-rw-
rw-rw-rw-
File Type
MP4
MP4
MP4
MP4
File Type Extension
mp4
mp4
mp4
mp4
MIME Type
video/mp4
video/mp4
video/mp4
video/mp4
Major Brand
MP4 v2 [ISO 14496-
14]
MP4 v2 [ISO 14496-
14]
MP4 v2 [ISO 14496-
14]
MP4 v2 [ISO 14496-
14]
Minor Version
0.0.0
0.0.0
0.0.0
0.0.0
Compatible Brands
isom, mp42
isom, mp42
isom, mp42
isom, mp42
Media Data Size
15058649
15058649
15058649
557066
Media Data Offset
32
32
32
40
Movie Header Version
0
0
0
0
Create Date
2021:02:22 00:36:53
2021:02:22 00:36:53
2021:02:22 00:36:53
2021:02:22 01:07:59
Modify Date
2021:02:22 00:36:53
2021:02:22 00:36:53
2021:02:22 00:36:53
2021:02:22 01:07:59
40
002
Extracted from
Android
Dropbox
Gmail
Extracted from
iPhone
Time Scale
600
600
600
1000
Duration
14.75 s
14.75 s
14.75 s
14.82 s
Preferred Rate
1
1
1
1
Preferred Volume
100.00%
100.00%
100.00%
100.00%
Preview Time
0 s
0 s
0 s
0 s
Preview Duration
0 s
0 s
0 s
0 s
Poster Time
0 s
0 s
0 s
0 s
Selection Time
0 s
0 s
0 s
0 s
Selection Duration
0 s
0 s
0 s
0 s
Current Time
0 s
0 s
0 s
0 s
Next Track ID
255
255
255
3
Play Mode
SEQ_PLAY
Android Version
10
User Data eng (ykn)
-180.00-180.000/
-180.00-180.000/
-180.00-180.000/
Track Header Version
0
0
0
0
Track Create Date
2021:02:22 00:36:53
2021:02:22 00:36:53
2021:02:22 00:36:53
2021:02:22 01:07:59
Track Modify Date
2021:02:22 00:36:53
2021:02:22 00:36:53
2021:02:22 00:36:53
2021:02:22 01:07:59
Track ID
256
256
256
1
Track Duration
14.72 s
14.72 s
14.72 s
14.82 s
Track Layer
0
0
0
0
Track Volume
100.00%
100.00%
100.00%
0.00%
Balance
0
0
0
0
Audio Format
mp4a
mp4a
mp4a
mp4a
Audio Channels
1
1
1
1
Audio Bits Per Sample
16
16
16
16
Audio Sample Rate
44100
44100
44100
44100
Matrix Structure
1 0 0 0 1 0 0 0 1
1 0 0 0 1 0 0 0 1
1 0 0 0 1 0 0 0 1
1 0 0 0 1 0 0 0 1
Image Width
1072
1072
1072
176
Image Height
1920
1920
1920
144
Media Header Version
0
0
0
0
Media Create Date
2021:02:22 00:36:53
2021:02:22 00:36:53
2021:02:22 00:36:53
2021:02:22 01:07:59
Media Modify Date
2021:02:22 00:36:53
2021:02:22 00:36:53
2021:02:22 00:36:53
2021:02:22 01:07:59
Media Time Scale
90000
90000
90000
44100
Media Duration
14.75 s
14.75 s
14.75 s
14.70 s
Handler Type
Video Track
Video Track
Video Track
Audio Track
Handler Description
Snap Video
Snap Video
Snap Video
SoundHandle
Graphics Mode
srcCopy
srcCopy
srcCopy
srcCopy
Op Color
0 0 0
0 0 0
0 0 0
0 0 0
Compressor ID
avc1
avc1
avc1
s263
Source Image Width
1072
1072
1072
176
Source Image Height
1920
1920
1920
144
X Resolution
72
72
72
72
Y Resolution
72
72
72
72
Bit Depth
24
24
24
24
Pixel Aspect Ratio
65536:65536
65536:65536
65536:65536
65536:65536
Color Representation
nclx 5 6 5
nclx 5 6 5
nclx 5 6 5
nclx 5 1 6
41
002
Extracted from
Android
Dropbox
Gmail
Extracted from
iPhone
Video Frame Rate
29.56
29.56
29.56
9.854
User Data eng
-180.00-180.000/
-180.00-180.000/
-180.00-180.000/
Image Size
1072x1920
1072x1920
1072x1920
176x144
Megapixels
2.1
2.1
2.1
0.025
Avg Bitrate
8.17 Mbps
8.17 Mbps
8.17 Mbps
301 kbps
Rotation
0
0
0
0
ExifTool Metadata of Android Snapchat Video 003
003
Extracted from
Android
Dropbox
Gmail
Extracted from
iPhone
File Name
Snapchat-
533796126_1.mp4
Snapchat-
533796126.mp4
Snapchat-
533796126.mp4
Snapchat-
5337961261.mp4
File Size
8.3 MiB
8.3 MiB
8.3 MiB
309 KiB
File Modification
Date/Time
2021:02:21 22:43:16-
07:00
2021:02:21 20:23:47-
07:00
2021:02:21 20:28:00-
07:00
2021:02:21 19:22:54-
07:00
File Access Date/Time
2021:02:23 23:55:38-
07:00
2021:02:27 17:59:33-
07:00
2021:02:27 18:57:59-
07:00
2021:02:24 22:43:30-
07:00
File Creation Date/Time
2021:02:23 23:29:50-
07:00
2021:02:27 17:25:03-
07:00
2021:02:27 17:25:34-
07:00
2021:02:23 23:29:50-
07:00
File Permissions
rw-rw-rw-
rw-rw-rw-
rw-rw-rw-
rw-rw-rw-
File Type
MP4
MP4
MP4
MP4
File Type Extension
mp4
mp4
mp4
mp4
MIME Type
video/mp4
video/mp4
video/mp4
video/mp4
Major Brand
MP4 v2 [ISO 14496-
14]
MP4 v2 [ISO 14496-
14]
MP4 v2 [ISO 14496-
14]
MP4 v2 [ISO 14496-
14]
Minor Version
0.0.0
0.0.0
0.0.0
0.0.0
Compatible Brands
isom, mp42
isom, mp42
isom, mp42
isom, mp42
Media Data Size
8718990
8718990
8718990
312198
Media Data Offset
32
32
32
40
Movie Header Version
0
0
0
0
Create Date
2021:02:22 02:20:24
2021:02:22 02:20:24
2021:02:22 02:20:24
2021:02:22 02:22:25
Modify Date
2021:02:22 02:20:24
2021:02:22 02:20:24
2021:02:22 02:20:24
2021:02:22 02:22:25
Time Scale
600
600
600
1000
Duration
8.68 s
8.68 s
8.68 s
8.66 s
Preferred Rate
1
1
1
1
Preferred Volume
100.00%
100.00%
100.00%
100.00%
Preview Time
0 s
0 s
0 s
0 s
Preview Duration
0 s
0 s
0 s
0 s
Poster Time
0 s
0 s
0 s
0 s
Selection Time
0 s
0 s
0 s
0 s
Selection Duration
0 s
0 s
0 s
0 s
Current Time
0 s
0 s
0 s
0 s
Next Track ID
255
255
255
3
Play Mode
SEQ_PLAY
Android Version
10
42
003
Extracted from
Android
Dropbox
Gmail
Extracted from
iPhone
User Data eng (ykn)
-180.00-180.000/
-180.00-180.000/
-180.00-180.000/
Track Header Version
0
0
0
0
Track Create Date
2021:02:22 02:20:24
2021:02:22 02:20:24
2021:02:22 02:20:24
2021:02:22 02:22:25
Track Modify Date
2021:02:22 02:20:24
2021:02:22 02:20:24
2021:02:22 02:20:24
2021:02:22 02:22:25
Track ID
256
256
256
1
Track Duration
8.68 s
8.68 s
8.68 s
8.65 s
Track Layer
0
0
0
0
Track Volume
100.00%
100.00%
100.00%
0.00%
Balance
0
0
0
0
Audio Format
mp4a
mp4a
mp4a
mp4a
Audio Channels
1
1
1
1
Audio Bits Per Sample
16
16
16
16
Audio Sample Rate
44100
44100
44100
44100
Matrix Structure
1 0 0 0 1 0 0 0 1
1 0 0 0 1 0 0 0 1
1 0 0 0 1 0 0 0 1
1 0 0 0 1 0 0 0 1
Image Width
1072
1072
1072
176
Image Height
1920
1920
1920
144
Media Header Version
0
0
0
0
Media Create Date
2021:02:22 02:20:24
2021:02:22 02:20:24
2021:02:22 02:20:24
2021:02:22 02:22:25
Media Modify Date
2021:02:22 02:20:24
2021:02:22 02:20:24
2021:02:22 02:20:24
2021:02:22 02:22:25
Media Time Scale
90000
90000
90000
44100
Media Duration
8.62 s
8.62 s
8.62 s
8.66 s
Handler Type
Video Track
Video Track
Video Track
Audio Track
Handler Description
Snap Video
Snap Video
Snap Video
SoundHandle
Graphics Mode
srcCopy
srcCopy
srcCopy
srcCopy
Op Color
0 0 0
0 0 0
0 0 0
0 0 0
Compressor ID
avc1
avc1
avc1
s263
Source Image Width
1072
1072
1072
176
Source Image Height
1920
1920
1920
144
X Resolution
72
72
72
72
Y Resolution
72
72
72
72
Bit Depth
24
24
24
24
Pixel Aspect Ratio
65536:65536
65536:65536
65536:65536
65536:65536
Color Representation
nclx 5 6 5
nclx 5 6 5
nclx 5 6 5
nclx 5 1 6
Video Frame Rate
16.306
16.306
16.306
16.306
User Data eng
-180.00-180.000/
-180.00-180.000/
-180.00-180.000/
Image Size
1072x1920
1072x1920
1072x1920
176x144
Megapixels
2.1
2.1
2.1
0.025
Avg Bitrate
8.03 Mbps
8.03 Mbps
8.03 Mbps
288 kbps
Rotation
0
0
0
0
43
APPENDIX F
The following tables display the metadata from ExifTool for 011, 012, and 013, the
original iPhone Snapchat video files and their corresponding transferred files. The categories of
interest are highlighted.
ExifTool Metadata of iPhone Snapchat Video 011
011
Extracted from
iPhone
Dropbox
Gmail
Extracted from
Android
File Name
EA334448-85EE-
4BB8-82E0-
962BBE848EC3.MP4
IMG_3575.MP4
IMG_16065091.MOV
EA334448-1.3gp
File Size
16 MiB
16 MiB
1649 KiB
321 KiB
File Modification
Date/Time
2021:02:21 18:42:53-
07:00
2021:02:21 20:23:44-
07:00
2021:02:21 20:33:00-
07:00
2021:02:21 22:44:40-
07:00
File Access
Date/Time
2021:02:27 17:00:59-
07:00
2021:03:02 22:11:28-
07:00
2021:03:02 22:25:54-
07:00
2021:02:27 16:12:08-
07:00
File Creation
Date/Time
2021:02:23 23:29:49-
07:00
2021:02:27 17:25:17-
07:00
2021:02:27 17:25:43-
07:00
2021:02:23 23:29:49-
07:00
File Permissions
rw-rw-rw-
rw-rw-rw-
rw-rw-rw-
rw-rw-rw-
File Type
MP4
MP4
MOV
3GP
File Type Extension
mp4
mp4
mov
3gp
MIME Type
video/mp4
video/mp4
video/quicktime
video/3gpp
Major Brand
MP4 v2 [ISO 14496-
14]
MP4 v2 [ISO 14496-
14]
Apple QuickTime
(.MOV/QT)
3GPP Media (.3GP)
Release 6 Streaming
Servers
Minor Version
0.0.1
0.0.1
0.0.0
0.1.0
Compatible Brands
isom, mp41, mp42
isom, mp41, mp42
qt
3gp6, isom
Media Data Size
16506118
16506118
1675942
325421
Media Data Offset
44
44
36
3414
Movie Header
Version
0
0
0
0
Create Date
2021:02:22 01:42:53
2021:02:22 01:42:53
2021:02:22 03:32:00
2021:02:22 01:58:08
Modify Date
2021:02:22 01:42:53
2021:02:22 01:42:53
2021:02:22 03:32:01
2021:02:22 01:58:09
Time Scale
600
600
600
600
Duration
17.39 s
17.39 s
17.39 s
17.39 s
Preferred Rate
1
1
1
1
Preferred Volume
100.00%
100.00%
100.00%
100.00%
Preview Time
0 s
0 s
0 s
0 s
Preview Duration
0 s
0 s
0 s
0 s
Poster Time
0 s
0 s
0 s
0 s
Selection Time
0 s
0 s
0 s
0 s
Selection Duration
0 s
0 s
0 s
0 s
Current Time
0 s
0 s
0 s
0 s
Next Track ID
3
3
3
3
44
011
Extracted from
iPhone
Dropbox
Gmail
Extracted from
Android
Track Header
Version
0
0
0
0
Track Create Date
2021:02:22 01:42:53
2021:02:22 01:42:53
2021:02:22 03:32:00
2021:02:22 01:58:08
Track Modify Date
2021:02:22 01:42:53
2021:02:22 01:42:53
2021:02:22 03:32:01
2021:02:22 01:58:09
Track ID
1
1
1
1
Track Duration
17.37 s
17.37 s
17.37 s
17.37 s
Track Layer
0
0
0
0
Track Volume
100.00%
100.00%
100.00%
100.00%
Balance
0
0
0
0
Audio Format
mp4a
mp4a
mp4a
samr
Audio Channels
2
2
1
2
Audio Bits Per
Sample
16
16
16
16
Audio Sample Rate
44100
44100
44100
8000
Encoder Vendor
appl
Encoder Version
1
Purchase File
Format
mp4a
Matrix Structure
1 0 0 0 1 0 0 0 1
1 0 0 0 1 0 0 0 1
1 0 0 0 1 0 0 0 1
1 0 0 0 1 0 0 0 1
Image Width
656
656
256
320
Image Height
1232
1232
480
240
Clean Aperture
Dimensions
256x480
Production Aperture
Dimensions
256x480
Encoded Pixels
Dimensions
256x480
Media Header
Version
0
0
0
0
Media Create Date
2021:02:22 01:42:53
2021:02:22 01:42:53
2021:02:22 03:32:00
2021:02:22 01:58:08
Media Modify Date
2021:02:22 01:42:53
2021:02:22 01:42:53
2021:02:22 03:32:01
2021:02:22 01:58:09
Media Time Scale
600
600
600
600
Media Duration
17.45 s
17.45 s
17.39 s
17.40 s
Media Language
Code
und
und
und
und
Handler Type
Video Track
Video Track
Alias Data
Video Track
Handler Description
Core Media Video
Core Media Video
Core Media Data
Handler
Core Media Video
Handler Class
Data Handler
Handler Vendor ID
Apple
Graphics Mode
srcCopy
srcCopy
ditherCopy
srcCopy
Op Color
0 0 0
0 0 0
32768 32768 32768
0 0 0
Compressor ID
avc1
avc1
avc1
avc1
Compressor Name
H.264
Source Image Width
656
656
256
320
Source Image Height
1232
1232
480
240
X Resolution
72
72
72
72
Y Resolution
72
72
72
72
Bit Depth
24
24
24
24
45
011
Extracted from
iPhone
Dropbox
Gmail
Extracted from
Android
Video Frame Rate
30.023
30.023
30.023
15
Image Size
656x1232
656x1232
256x480
320x240
Megapixels
0.808
0.808
0.123
0.077
Avg Bitrate
7.59 Mbps
7.59 Mbps
771 kbps
150 kbps
Rotation
0
0
0
0
ExifTool Metadata of iPhone Snapchat Video 012
012
Extracted from
iPhone
Dropbox
Gmail
Extracted from
Android
File Name
98F95CC8-62E2-
489C-8E9A-
1FBBBF830AA9.MP
4
IMG_3567.MP4
IMG_27744659.MOV
98F95CC8-1.3gp
File Size
12 MiB
12 MiB
1290 KiB
249 KiB
File Modification
Date/Time
2021:02:21 18:34:19-
07:00
2021:02:21 20:23:44-
07:00
2021:02:21 20:32:00-
07:00
2021:02:21 22:44:40-
07:00
File Access
Date/Time
2021:02:27 16:41:25-
07:00
2021:03:02 22:03:49-
07:00
2021:03:02 22:26:25-
07:00
2021:02:27 15:39:10-
07:00
File Creation
Date/Time
2021:02:23 23:29:49-
07:00
2021:02:27 17:25:17-
07:00
2021:02:27 17:25:43-
07:00
2021:02:23 23:29:49-
07:00
File Permissions
rw-rw-rw-
rw-rw-rw-
rw-rw-rw-
rw-rw-rw-
File Type
MP4
MP4
MOV
3GP
File Type Extension
mp4
mp4
mov
3gp
MIME Type
video/mp4
video/mp4
video/quicktime
video/3gpp
Major Brand
MP4 v2 [ISO 14496-
14]
MP4 v2 [ISO 14496-
14]
Apple QuickTime
(.MOV/QT)
3GPP Media (.3GP)
Release 6 Streaming
Servers
Minor Version
0.0.1
0.0.1
0.0.0
0.1.0
Compatible Brands
isom, mp41, mp42
isom, mp41, mp42
qt
3gp6, isom
Media Data Size
12991517
12991517
1310299
251363
Media Data Offset
44
44
36
3153
Movie Header
Version
0
0
0
0
Create Date
2021:02:22 01:34:19
2021:02:22 01:34:19
2021:02:22 03:29:41
2021:02:22 01:57:50
Modify Date
2021:02:22 01:34:19
2021:02:22 01:34:19
2021:02:22 03:29:41
2021:02:22 01:57:51
Time Scale
600
600
600
600
Duration
14.63 s
14.63 s
14.63 s
14.63 s
Preferred Rate
1
1
1
1
Preferred Volume
100.00%
100.00%
100.00%
100.00%
Preview Time
0 s
0 s
0 s
0 s
Preview Duration
0 s
0 s
0 s
0 s
Poster Time
0 s
0 s
0 s
0 s
Selection Time
0 s
0 s
0 s
0 s
Selection Duration
0 s
0 s
0 s
0 s
Current Time
0 s
0 s
0 s
0 s
Next Track ID
3
3
3
3
46
012
Extracted from
iPhone
Dropbox
Gmail
Extracted from
Android
Track Header
Version
0
0
0
0
Track Create Date
2021:02:22 01:34:19
2021:02:22 01:34:19
2021:02:22 03:29:41
2021:02:22 01:57:50
Track Modify Date
2021:02:22 01:34:19
2021:02:22 01:34:19
2021:02:22 03:29:41
2021:02:22 01:57:51
Track ID
1
1
1
1
Track Duration
14.57 s
14.57 s
14.57 s
14.57 s
Track Layer
0
0
0
0
Track Volume
100.00%
100.00%
100.00%
100.00%
Balance
0
0
0
0
Audio Format
mp4a
mp4a
mp4a
samr
Audio Channels
2
2
1
2
Audio Bits Per
Sample
16
16
16
16
Audio Sample Rate
44100
44100
44100
8000
Encoder Vendor
appl
Encoder Version
1
Purchase File
Format
mp4a
Matrix Structure
1 0 0 0 1 0 0 0 1
1 0 0 0 1 0 0 0 1
1 0 0 0 1 0 0 0 1
1 0 0 0 1 0 0 0 1
Image Width
656
656
256
320
Image Height
1232
1232
480
240
Clean Aperture
Dimensions
256x480
Production Aperture
Dimensions
256x480
Encoded Pixels
Dimensions
256x480
Media Header
Version
0
0
0
0
Media Create Date
2021:02:22 01:34:19
2021:02:22 01:34:19
2021:02:22 03:29:41
2021:02:22 01:57:50
Media Modify Date
2021:02:22 01:34:19
2021:02:22 01:34:19
2021:02:22 03:29:41
2021:02:22 01:57:51
Media Time Scale
600
600
600
600
Media Duration
14.69 s
14.69 s
14.63 s
14.67 s
Media Language
Code
und
und
und
und
Handler Type
Video Track
Video Track
Alias Data
Video Track
Handler Description
Core Media Video
Core Media Video
Core Media Data
Handler
Core Media Video
Handler Class
Data Handler
Handler Vendor ID
Apple
Graphics Mode
srcCopy
srcCopy
ditherCopy
srcCopy
Op Color
0 0 0
0 0 0
32768 32768 32768
0 0 0
Compressor ID
avc1
avc1
avc1
avc1
Compressor Name
H.264
Source Image Width
656
656
256
320
Source Image Height
1232
1232
480
240
X Resolution
72
72
72
72
Y Resolution
72
72
72
72
Bit Depth
24
24
24
24
47
012
Extracted from
iPhone
Dropbox
Gmail
Extracted from
Android
Video Frame Rate
30.014
30.014
30.014
15
Image Size
656x1232
656x1232
256x480
320x240
Megapixels
0.808
0.808
0.123
0.077
Avg Bitrate
7.11 Mbps
7.11 Mbps
717 kbps
137 kbps
Rotation
0
0
0
0
ExifTool Metadata of iPhone Snapchat Video 013
013
Extracted from
iPhone
Dropbox
Gmail
Extracted from
Android
File Name
7AB4BBB0-9EF7-
48C0-BC0C-
DF6DB30AEDB2.MP
4
IMG_3573.MP4
IMG_257523635.MO
V
7AB4BBB0-1.3gp
File Size
10 MiB
10 MiB
1072 KiB
208 KiB
File Modification
Date/Time
2021:02:21 18:41:24-
07:00
2021:02:21 20:23:49-
07:00
2021:02:21 20:33:00-
07:00
2021:02:21 22:44:40-
07:00
File Access
Date/Time
2021:02:27 16:16:52-
07:00
2021:03:02 22:10:24-
07:00
2021:03:02 22:36:46-
07:00
2021:02:27 15:17:52-
07:00
File Creation
Date/Time
2021:02:23 23:29:49-
07:00
2021:02:27 17:25:17-
07:00
2021:02:27 17:25:43-
07:00
2021:02:23 23:29:49-
07:00
File Permissions
rw-rw-rw-
rw-rw-rw-
rw-rw-rw-
rw-rw-rw-
File Type
MP4
MP4
MOV
3GP
File Type Extension
mp4
mp4
mov
3gp
MIME Type
video/mp4
video/mp4
video/quicktime
video/3gpp
Major Brand
MP4 v2 [ISO 14496-
14]
MP4 v2 [ISO 14496-
14]
Apple QuickTime
(.MOV/QT)
3GPP Media (.3GP)
Release 6 Streaming
Servers
Minor Version
0.0.1
0.0.1
0.0.0
0.1.0
Compatible Brands
isom, mp41, mp42
isom, mp41, mp42
qt
3gp6, isom
Media Data Size
10832448
10832448
1089382
210468
Media Data Offset
44
44
36
2681
Movie Header
Version
0
0
0
0
Create Date
2021:02:22 01:41:23
2021:02:22 01:41:23
2021:02:22 03:31:31
2021:02:22 01:58:05
Modify Date
2021:02:22 01:41:24
2021:02:22 01:41:24
2021:02:22 03:31:31
2021:02:22 01:58:05
Time Scale
600
600
600
600
Duration
11.46 s
11.46 s
11.46 s
11.46 s
Preferred Rate
1
1
1
1
Preferred Volume
100.00%
100.00%
100.00%
100.00%
Preview Time
0 s
0 s
0 s
0 s
Preview Duration
0 s
0 s
0 s
0 s
Poster Time
0 s
0 s
0 s
0 s
Selection Time
0 s
0 s
0 s
0 s
Selection Duration
0 s
0 s
0 s
0 s
Current Time
0 s
0 s
0 s
0 s
Next Track ID
3
3
3
3
48
013
Extracted from
iPhone
Dropbox
Gmail
Extracted from
Android
Track Header
Version
0
0
0
0
Track Create Date
2021:02:22 01:41:23
2021:02:22 01:41:23
2021:02:22 03:31:31
2021:02:22 01:58:05
Track Modify Date
2021:02:22 01:41:24
2021:02:22 01:41:24
2021:02:22 03:31:31
2021:02:22 01:58:05
Track ID
1
1
1
1
Track Duration
11.46 s
11.46 s
11.46 s
11.46 s
Track Layer
0
0
0
0
Track Volume
100.00%
100.00%
100.00%
100.00%
Balance
0
0
0
0
Audio Format
mp4a
mp4a
mp4a
samr
Audio Channels
2
2
1
2
Audio Bits Per
Sample
16
16
16
16
Audio Sample Rate
44100
44100
44100
8000
Encoder Vendor
appl
Encoder Version
1
Purchase File
Format
mp4a
Matrix Structure
1 0 0 0 1 0 0 0 1
1 0 0 0 1 0 0 0 1
1 0 0 0 1 0 0 0 1
1 0 0 0 1 0 0 0 1
Image Width
656
656
256
320
Image Height
1232
1232
480
240
Clean Aperture
Dimensions
256x480
Production Aperture
Dimensions
256x480
Encoded Pixels
Dimensions
256x480
Media Header
Version
0
0
0
0
Media Create Date
2021:02:22 01:41:23
2021:02:22 01:41:23
2021:02:22 03:31:31
2021:02:22 01:58:05
Media Modify Date
2021:02:22 01:41:24
2021:02:22 01:41:24
2021:02:22 03:31:31
2021:02:22 01:58:05
Media Time Scale
600
600
600
600
Media Duration
11.53 s
11.53 s
11.46 s
11.47 s
Media Language
Code
und
und
und
und
Handler Type
Video Track
Video Track
Alias Data
Video Track
Handler Description
Core Media Video
Core Media Video
Core Media Data
Handler
Core Media Video
Handler Class
Data Handler
Handler Vendor ID
Apple
Graphics Mode
srcCopy
srcCopy
ditherCopy
srcCopy
Op Color
0 0 0
0 0 0
32768 32768 32768
0 0 0
Compressor ID
avc1
avc1
avc1
avc1
Compressor Name
H.264
Source Image Width
656
656
256
320
Source Image Height
1232
1232
480
240
X Resolution
72
72
72
72
Y Resolution
72
72
72
72
Bit Depth
24
24
24
24
49
013
Extracted from
iPhone
Dropbox
Gmail
Extracted from
Android
Video Frame Rate
30.009
30.009
30.009
15
Image Size
656x1232
656x1232
256x480
320x240
Megapixels
0.808
0.808
0.123
0.077
Avg Bitrate
7.56 Mbps
7.56 Mbps
760 kbps
147 kbps
Rotation
0
0
0
0
APPENDIX G
The following tables display the MediaInfo metadata for 001, 002, and 003, the original
Android Snapchat video files and their corresponding transferred files. The categories of interest
are highlighted.
MediaInfo Metadata of Android Snapchat Video 001
001
Extracted from
Android
Dropbox
Gmail
Extracted from
iPhone
General
Name
Snapchat-
196961414_1.mp4
Snapchat-
196961414.mp4
Snapchat-
196961414.mp4
Snapchat-
1969614141.mp4
Format
MPEG-4
MPEG-4
MPEG-4
MPEG-4
Format profile
Base Media /
Version 2
Base Media /
Version 2
Base Media /
Version 2
Base Media /
Version 2
Codec ID
mp42 (isom/mp42)
mp42 (isom/mp42)
mp42 (isom/mp42)
mp42 (isom/mp42)
File size
14.8 MiB
14.8 MiB
14.8 MiB
546 KiB
Duration
15 s 370 ms
15 s 370 ms
15 s 370 ms
15 s 361 ms
Overall bit rate
8 069 kb/s
8 069 kb/s
8 069 kb/s
291 kb/s
Encoded date
UTC 2021-02-22
00:41:27
UTC 2021-02-22
00:41:27
UTC 2021-02-22
00:41:27
UTC 2021-02-22
01:07:03
Tagged date
UTC 2021-02-22
00:41:27
UTC 2021-02-22
00:41:27
UTC 2021-02-22
00:41:27
UTC 2021-02-22
01:07:03
eng
-180
-180
-180
com.android.version
10
Video
ID
512
512
512
1
Format
AVC
AVC
AVC
H.263
Format/Info
Advanced Video
Codec
Advanced Video
Codec
Advanced Video
Codec
Format profile
High@L4
High@L4
High@L4
Format settings
CABAC / 1 Ref
Frames
CABAC / 1 Ref
Frames
CABAC / 1 Ref
Frames
Format settings, CABAC
Yes
Yes
Yes
Format settings, Reference
frames
1 frame
1 frame
1 frame
Format settings, GOP
M=1, N=30
M=1, N=30
M=1, N=30
Codec ID
avc1
avc1
avc1
s263
50
001
Extracted from
Android
Dropbox
Gmail
Extracted from
iPhone
Codec ID/Info
Advanced Video
Coding
Advanced Video
Coding
Advanced Video
Coding
Duration
15 s 363 ms
15 s 363 ms
15 s 363 ms
15 s 361 ms
Source duration
15 s 361 ms
15 s 361 ms
15 s 361 ms
Bit rate
7 938 kb/s
7 938 kb/s
7 938 kb/s
256 kb/s
Width
1 072 pixels
1 072 pixels
1 072 pixels
176 pixels
Height
1 920 pixels
1 920 pixels
1 920 pixels
144 pixels
Display aspect ratio
0.558
0.558
0.558
1.222
Original display aspect ratio
0.16875
Frame rate mode
Variable
Variable
Variable
Variable
Frame rate
27.732 FPS
27.732 FPS
27.732 FPS
13.866 FPS
Minimum frame rate
17.513 FPS
17.513 FPS
17.513 FPS
11.058 FPS
Maximum frame rate
57.143 FPS
57.143 FPS
57.143 FPS
19.672 FPS
Standard
NTSC
NTSC
NTSC
Color space
YUV
YUV
YUV
YUV
Chroma subsampling
0.168055556
0.168055556
0.168055556
0.168055556
Bit depth
8 bits
8 bits
8 bits
8 bits
Scan type
Progressive
Progressive
Progressive
Compression mode
Lossy
Bits/(Pixel*Frame)
0.139
0.139
0.139
0.729
Stream size
14.5 MiB (98%)
14.5 MiB (98%)
14.5 MiB (98%)
480 KiB (88%)
Source stream size
14.5 MiB (98%)
14.5 MiB (98%)
14.5 MiB (98%)
Title
Snap Video
Snap Video
Snap Video
VideoHandle
Writing library
0x00000000
Language
English
English
English
English
Encoded date
UTC 2021-02-22
00:41:27
UTC 2021-02-22
00:41:27
UTC 2021-02-22
00:41:27
UTC 2021-02-22
01:07:03
Tagged date
UTC 2021-02-22
00:41:27
UTC 2021-02-22
00:41:27
UTC 2021-02-22
00:41:27
UTC 2021-02-22
01:07:03
Color range
Full
Full
Full
Limited
colour_range_Original
Limited
Limited
Limited
Color primaries
BT.601 PAL
BT.601 PAL
BT.601 PAL
BT.601 PAL
Transfer characteristics
BT.601
BT.601
BT.601
BT.709
Matrix coefficients
BT.470 System B/G
BT.470 System B/G
BT.470 System B/G
BT.601
matrix_coefficients_Original
BT.601
BT.601
BT.601
mdhd_Duration
15364
15364
15364
Codec configuration box
avcC
avcC
avcC
Audio
ID
256
256
256
2
Format
AAC LC
AAC LC
AAC LC
AAC LC
Format/Info
Advanced Audio
Codec Low
Complexity
Advanced Audio
Codec Low
Complexity
Advanced Audio
Codec Low
Complexity
Advanced Audio
Codec Low
Complexity
Codec ID
mp4a-40-2
mp4a-40-2
mp4a-40-2
mp4a-40-2
51
001
Extracted from
Android
Dropbox
Gmail
Extracted from
iPhone
Duration
15 s 370 ms
15 s 370 ms
15 s 370 ms
15 s 348 ms
Bit rate mode
Constant
Constant
Constant
Constant
Bit rate
132 kb/s
132 kb/s
132 kb/s
32.0 kb/s
Channel(s)
1 channel
1 channel
1 channel
1 channel
Channel layout
C
C
C
C
Sampling rate
44.1 kHz
44.1 kHz
44.1 kHz
44.1 kHz
Frame rate
43.066 FPS (1024
SPF)
43.066 FPS (1024
SPF)
43.066 FPS (1024
SPF)
43.066 FPS (1024
SPF)
Compression mode
Lossy
Lossy
Lossy
Lossy
Stream size
246 KiB (2%)
246 KiB (2%)
246 KiB (2%)
60.3 KiB (11%)
Title
Snap Audio
Snap Audio
Snap Audio
SoundHandle
Language
English
English
English
English
Encoded date
UTC 2021-02-22
00:41:27
UTC 2021-02-22
00:41:27
UTC 2021-02-22
00:41:27
UTC 2021-02-22
01:07:03
Tagged date
UTC 2021-02-22
00:41:27
UTC 2021-02-22
00:41:27
UTC 2021-02-22
00:41:27
UTC 2021-02-22
01:07:03
MediaInfo Metadata of Android Snapchat Video 002
002
Extracted from
Android
Dropbox
Gmail
Extracted from
iPhone
General
Name
Snapchat-
340788319_1.mp4
Snapchat-
340788319.mp4
Snapchat-
340788319.mp4
Snapchat-
3407883191.mp4
Format
MPEG-4
MPEG-4
MPEG-4
MPEG-4
Format profile
Base Media /
Version 2
Base Media /
Version 2
Base Media /
Version 2
Base Media /
Version 2
Codec ID
mp42 (isom/mp42)
mp42 (isom/mp42)
mp42 (isom/mp42)
mp42 (isom/mp42)
File size
14.4 MiB
14.4 MiB
14.4 MiB
549 KiB
Duration
14 s 750 ms
14 s 750 ms
14 s 750 ms
14 s 816 ms
Overall bit rate
8 171 kb/s
8 171 kb/s
8 171 kb/s
304 kb/s
Encoded date
UTC 2021-02-22
00:36:53
UTC 2021-02-22
00:36:53
UTC 2021-02-22
00:36:53
UTC 2021-02-22
01:07:59
Tagged date
UTC 2021-02-22
00:36:53
UTC 2021-02-22
00:36:53
UTC 2021-02-22
00:36:53
UTC 2021-02-22
01:07:59
eng
-180
-180
-180
com.android.version
10
Video
ID
512
512
512
1
Format
AVC
AVC
AVC
H.263
Format/Info
Advanced Video
Codec
Advanced Video
Codec
Advanced Video
Codec
Format profile
High@L4
High@L4
High@L4
Format settings
CABAC / 1 Ref
Frames
CABAC / 1 Ref
Frames
CABAC / 1 Ref
Frames
Format settings, CABAC
Yes
Yes
Yes
Format settings, Reference
frames
1 frame
1 frame
1 frame
52
002
Extracted from
Android
Dropbox
Gmail
Extracted from
iPhone
Format settings, GOP
M=1, N=30
M=1, N=30
M=1, N=30
Codec ID
avc1
avc1
avc1
s263
Codec ID/Info
Advanced Video
Coding
Advanced Video
Coding
Advanced Video
Coding
Duration
14 s 750 ms
14 s 750 ms
14 s 750 ms
14 s 816 ms
Bit rate
8 037 kb/s
8 037 kb/s
8 037 kb/s
269 kb/s
Width
1 072 pixels
1 072 pixels
1 072 pixels
176 pixels
Height
1 920 pixels
1 920 pixels
1 920 pixels
144 pixels
Display aspect ratio
0.558
0.558
0.558
1.222
Original display aspect ratio
4:03
Frame rate mode
Variable
Variable
Variable
Variable
Frame rate
29.560 FPS
29.560 FPS
29.560 FPS
9.854 FPS
Minimum frame rate
19.920 FPS
19.920 FPS
19.920 FPS
7.653 FPS
Maximum frame rate
49.423 FPS
49.423 FPS
49.423 FPS
11.507 FPS
Standard
NTSC
NTSC
NTSC
Color space
YUV
YUV
YUV
YUV
Chroma subsampling
4:02:00
4:02:00
4:02:00
4:02:00
Bit depth
8 bits
8 bits
8 bits
8 bits
Scan type
Progressive
Progressive
Progressive
Compression mode
Lossy
Bits/(Pixel*Frame)
0.132
0.132
0.132
1.077
Stream size
14.1 MiB (98%)
14.1 MiB (98%)
14.1 MiB (98%)
486 KiB (89%)
Title
Snap Video
Snap Video
Snap Video
VideoHandle
Writing library
0x00000000
Language
English
English
English
English
Encoded date
UTC 2021-02-22
00:36:53
UTC 2021-02-22
00:36:53
UTC 2021-02-22
00:36:53
UTC 2021-02-22
01:07:59
Tagged date
UTC 2021-02-22
00:36:53
UTC 2021-02-22
00:36:53
UTC 2021-02-22
00:36:53
UTC 2021-02-22
01:07:59
Color range
Full
Full
Full
Limited
colour_range_Original
Limited
Limited
Limited
Color primaries
BT.601 PAL
BT.601 PAL
BT.601 PAL
BT.601 PAL
Transfer characteristics
BT.601
BT.601
BT.601
BT.709
Matrix coefficients
BT.470 System B/G
BT.470 System B/G
BT.470 System B/G
BT.601
matrix_coefficients_Original
BT.601
BT.601
BT.601
mdhd_Duration
14751
14751
14751
Codec configuration box
avcC
avcC
avcC
Audio
ID
256
256
256
2
Format
AAC LC
AAC LC
AAC LC
AAC LC
Format/Info
Advanced Audio
Codec Low
Complexity
Advanced Audio
Codec Low
Complexity
Advanced Audio
Codec Low
Complexity
Advanced Audio
Codec Low
Complexity
Codec ID
mp4a-40-2
mp4a-40-2
mp4a-40-2
mp4a-40-2
53
002
Extracted from
Android
Dropbox
Gmail
Extracted from
iPhone
Duration
14 s 720 ms
14 s 720 ms
14 s 720 ms
14 s 698 ms
Bit rate mode
Constant
Constant
Constant
Constant
Bit rate
132 kb/s
132 kb/s
132 kb/s
32.0 kb/s
Channel(s)
1 channel
1 channel
1 channel
1 channel
Channel layout
C
C
C
C
Sampling rate
44.1 kHz
44.1 kHz
44.1 kHz
44.1 kHz
Frame rate
43.066 FPS (1024
SPF)
43.066 FPS (1024
SPF)
43.066 FPS (1024
SPF)
43.066 FPS (1024
SPF)
Compression mode
Lossy
Lossy
Lossy
Lossy
Stream size
236 KiB (2%)
236 KiB (2%)
236 KiB (2%)
57.8 KiB (11%)
Title
Snap Audio
Snap Audio
Snap Audio
SoundHandle
Language
English
English
English
English
Encoded date
UTC 2021-02-22
00:36:53
UTC 2021-02-22
00:36:53
UTC 2021-02-22
00:36:53
UTC 2021-02-22
01:07:59
Tagged date
UTC 2021-02-22
00:36:53
UTC 2021-02-22
00:36:53
UTC 2021-02-22
00:36:53
UTC 2021-02-22
01:07:59
MediaInfo Metadata of Android Snapchat Video 003
003
Extracted from
Android
Dropbox
Gmail
Extracted from
iPhone
General
Name
Snapchat-
533796126_1.mp4
Snapchat-
533796126.mp4
Snapchat-
533796126.mp4
Snapchat-
5337961261.mp4
Format
MPEG-4
MPEG-4
MPEG-4
MPEG-4
Format profile
Base Media /
Version 2
Base Media /
Version 2
Base Media /
Version 2
Base Media /
Version 2
Codec ID
mp42 (isom/mp42)
mp42 (isom/mp42)
mp42 (isom/mp42)
mp42 (isom/mp42)
File size
8.32 MiB
8.32 MiB
8.32 MiB
309 KiB
Duration
8 s 683 ms
8 s 683 ms
8 s 683 ms
8 s 661 ms
Overall bit rate
8 037 kb/s
8 037 kb/s
8 037 kb/s
292 kb/s
Encoded date
UTC 2021-02-22
02:20:24
UTC 2021-02-22
02:20:24
UTC 2021-02-22
02:20:24
UTC 2021-02-22
02:22:25
Tagged date
UTC 2021-02-22
02:20:24
UTC 2021-02-22
02:20:24
UTC 2021-02-22
02:20:24
UTC 2021-02-22
02:22:25
eng
-180
-180
-180
com.android.version
10
Video
ID
512
512
512
1
Format
AVC
AVC
AVC
H.263
Format/Info
Advanced Video
Codec
Advanced Video
Codec
Advanced Video
Codec
Format profile
High@L4
High@L4
High@L4
Format settings
CABAC / 1 Ref
Frames
CABAC / 1 Ref
Frames
CABAC / 1 Ref
Frames
Format settings, CABAC
Yes
Yes
Yes
Format settings, Reference
frames
1 frame
1 frame
1 frame
54
003
Extracted from
Android
Dropbox
Gmail
Extracted from
iPhone
Format settings, GOP
M=1, N=30
M=1, N=30
M=1, N=30
Codec ID
avc1
avc1
avc1
s263
Codec ID/Info
Advanced Video
Coding
Advanced Video
Coding
Advanced Video
Coding
Duration
8 s 618 ms
8 s 618 ms
8 s 618 ms
8 s 647 ms
Source duration
8 s 647 ms
8 s 647 ms
8 s 647 ms
Bit rate
7 935 kb/s
7 935 kb/s
7 935 kb/s
257 kb/s
Width
1 072 pixels
1 072 pixels
1 072 pixels
176 pixels
Height
1 920 pixels
1 920 pixels
1 920 pixels
144 pixels
Display aspect ratio
0.558
0.558
0.558
1.222
Original display aspect ratio
4:03
Frame rate mode
Variable
Variable
Variable
Variable
Frame rate
16.306 FPS
16.306 FPS
16.306 FPS
16.306 FPS
Minimum frame rate
12.568 FPS
12.568 FPS
12.568 FPS
12.568 FPS
Maximum frame rate
23.885 FPS
23.885 FPS
23.885 FPS
23.885 FPS
Standard
NTSC
NTSC
NTSC
Color space
YUV
YUV
YUV
YUV
Chroma subsampling
4:02:00
4:02:00
4:02:00
4:02:00
Bit depth
8 bits
8 bits
8 bits
8 bits
Scan type
Progressive
Progressive
Progressive
Compression mode
Lossy
Bits/(Pixel*Frame)
0.236
0.236
0.236
0.621
Stream size
8.18 MiB (98%)
8.18 MiB (98%)
8.18 MiB (98%)
271 KiB (88%)
Source stream size
8.18 MiB (98%)
8.18 MiB (98%)
8.18 MiB (98%)
Title
Snap Video
Snap Video
Snap Video
VideoHandle
Writing library
0x00000000
Language
English
English
English
English
Encoded date
UTC 2021-02-22
02:20:24
UTC 2021-02-22
02:20:24
UTC 2021-02-22
02:20:24
UTC 2021-02-22
02:22:25
Tagged date
UTC 2021-02-22
02:20:24
UTC 2021-02-22
02:20:24
UTC 2021-02-22
02:20:24
UTC 2021-02-22
02:22:25
Color range
Full
Full
Full
Limited
colour_range_Original
Limited
Limited
Limited
Color primaries
BT.601 PAL
BT.601 PAL
BT.601 PAL
BT.601 PAL
Transfer characteristics
BT.601
BT.601
BT.601
BT.709
Matrix coefficients
BT.470 System B/G
BT.470 System B/G
BT.470 System B/G
BT.601
matrix_coefficients_Original
BT.601
BT.601
BT.601
mdhd_Duration
8619
8619
8619
Codec configuration box
avcC
avcC
avcC
Audio
ID
256
256
256
2
Format
AAC LC
AAC LC
AAC LC
AAC LC
55
003
Extracted from
Android
Dropbox
Gmail
Extracted from
iPhone
Format/Info
Advanced Audio
Codec Low
Complexity
Advanced Audio
Codec Low
Complexity
Advanced Audio
Codec Low
Complexity
Advanced Audio
Codec Low
Complexity
Codec ID
mp4a-40-2
mp4a-40-2
mp4a-40-2
mp4a-40-2
Duration
8 s 683 ms
8 s 683 ms
8 s 683 ms
8 s 661 ms
Bit rate mode
Constant
Constant
Constant
Constant
Bit rate
132 kb/s
132 kb/s
132 kb/s
32.0 kb/s
Channel(s)
1 channel
1 channel
1 channel
1 channel
Channel layout
C
C
C
C
Sampling rate
44.1 kHz
44.1 kHz
44.1 kHz
44.1 kHz
Frame rate
43.066 FPS (1024
SPF)
43.066 FPS (1024
SPF)
43.066 FPS (1024
SPF)
43.066 FPS (1024
SPF)
Compression mode
Lossy
Lossy
Lossy
Lossy
Stream size
139 KiB (2%)
139 KiB (2%)
139 KiB (2%)
34.1 KiB (11%)
Title
Snap Audio
Snap Audio
Snap Audio
SoundHandle
Language
English
English
English
English
Encoded date
UTC 2021-02-22
02:20:24
UTC 2021-02-22
02:20:24
UTC 2021-02-22
02:20:24
UTC 2021-02-22
02:22:25
Tagged date
UTC 2021-02-22
02:20:24
UTC 2021-02-22
02:20:24
UTC 2021-02-22
02:20:24
UTC 2021-02-22
02:22:25
APPENDIX H
The following tables display the MediaInfo metadata for 011, 012, and 013, the original
iPhone Snapchat video files and their corresponding transferred files. The categories of interest
are highlighted.
MediaInfo Metadata of iPhone Snapchat Video 011
011
Extracted from
iPhone
Dropbox
Gmail
Extracted from
Android
General
Name
EA334448-85EE-
4BB8-82E0-
962BBE848EC3.MP4
IMG_3575.MP4
IMG_16065091.MOV
EA334448-1.3gp
Format
MPEG-4
MPEG-4
MPEG-4
MPEG-4
Format profile
Base Media / Version
2
Base Media / Version
2
QuickTime
3GPP Media Release
6 Basic
Codec ID
mp42
(isom/mp41/mp42)
mp42
(isom/mp41/mp42)
qt 0000.00 (qt )
3gp6 (3gp6/isom)
File size
15.8 MiB
15.8 MiB
1.61 MiB
321 KiB
Duration
17 s 387 ms
17 s 387 ms
17 s 387 ms
17 s 387 ms
Overall bit rate
7 600 kb/s
7 600 kb/s
777 kb/s
151 kb/s
Encoded date
UTC 2021-02-22
01:42:53
UTC 2021-02-22
01:42:53
UTC 2021-02-22
03:32:00
UTC 2021-02-22
01:58:08
56
011
Extracted from
iPhone
Dropbox
Gmail
Extracted from
Android
Tagged date
UTC 2021-02-22
01:42:53
UTC 2021-02-22
01:42:53
UTC 2021-02-22
03:32:01
UTC 2021-02-22
01:58:09
Writing library
Apple QuickTime
Video
ID
2
2
2
2
Format
AVC
AVC
AVC
AVC
Format/Info
Advanced Video
Codec
Advanced Video
Codec
Advanced Video
Codec
Advanced Video
Codec
Format profile
Format settings
CABAC / 2 Ref
Frames
CABAC / 2 Ref
Frames
CABAC / 2 Ref
Frames
1 Ref Frames
Format settings,
CABAC
Yes
Yes
Yes
No
Format settings,
Reference frames
2 frames
2 frames
2 frames
1 frame
Format settings, GOP
M=1, N=15
Codec ID
avc1
avc1
avc1
avc1
Codec ID/Info
Advanced Video
Coding
Advanced Video
Coding
Advanced Video
Coding
Advanced Video
Coding
Duration
17 s 387 ms
17 s 387 ms
17 s 387 ms
17 s 387 ms
Source duration
17 s 453 ms
17 s 453 ms
17 s 400 ms
Bit rate
7 500 kb/s
7 500 kb/s
707 kb/s
137 kb/s
Width
656 pixels
656 pixels
256 pixels
320 pixels
Height
1 232 pixels
1 232 pixels
480 pixels
240 pixels
Display aspect ratio
0.532
0.532
0.533
4:03
Frame rate mode
Variable
Variable
Variable
Constant
Frame rate
30.000 FPS
30.000 FPS
30.000 FPS
15.000 FPS
Minimum frame rate
30.000 FPS
30.000 FPS
30.000 FPS
Maximum frame rate
35.294 FPS
35.294 FPS
35.294 FPS
Color space
YUV
YUV
YUV
YUV
Chroma subsampling
4:02:00
4:02:00
4:02:00
4:02:00
Bit depth
8 bits
8 bits
8 bits
8 bits
Scan type
Progressive
Progressive
Progressive
Progressive
Bits/(Pixel*Frame)
0.309
0.309
0.192
0.119
Stream size
15.6 MiB (99%)
15.6 MiB (99%)
1.47 MiB (91%)
291 KiB (90%)
Source stream size
15.6 MiB (99%)
15.6 MiB (99%)
291 KiB (90%)
Title
Core Media Video
Core Media Video
Core Media Video
Core Media Video
Encoded date
UTC 2021-02-22
01:42:53
UTC 2021-02-22
01:42:53
UTC 2021-02-22
03:32:00
UTC 2021-02-22
01:58:08
Tagged date
UTC 2021-02-22
01:42:53
UTC 2021-02-22
01:42:53
UTC 2021-02-22
03:32:01
UTC 2021-02-22
01:58:09
Color range
Full
Full
Full
Full
Color primaries
BT.709
BT.709
Transfer characteristics
BT.709
BT.709
Matrix coefficients
BT.709
BT.709
Codec configuration
box
avcC
avcC
avcC
avcC
57
011
Extracted from
iPhone
Dropbox
Gmail
Extracted from
Android
Audio
ID
1
1
1
1
Format
AAC LC
AAC LC
AAC LC
AMR
Format/Info
Advanced Audio
Codec Low
Complexity
Advanced Audio
Codec Low
Complexity
Advanced Audio
Codec Low
Complexity
Adaptive Multi-Rate
Format profile
Narrow band
Codec ID
mp4a-40-2
mp4a-40-2
mp4a-40-2
samr
Duration
17 s 373 ms
17 s 373 ms
17 s 373 ms
17 s 372 ms
Source duration
17 s 392 ms
17 s 392 ms
17 s 392 ms
17 s 400 ms
Bit rate mode
Constant
Constant
Constant
Constant
Bit rate
64.0 kb/s
64.0 kb/s
64.0 kb/s
12.8 kb/s
Channel(s)
1 channel
1 channel
1 channel
1 channel
Channel layout
C
C
C
Sampling rate
44.1 kHz
44.1 kHz
44.1 kHz
8 000 Hz
Frame rate
43.066 FPS (1024
SPF)
43.066 FPS (1024
SPF)
43.066 FPS (1024
SPF)
Bit depth
13 bits
Compression mode
Lossy
Lossy
Lossy
Stream size
134 KiB (1%)
134 KiB (1%)
134 KiB (8%)
27.2 KiB (8%)
Source stream size
135 KiB (1%)
135 KiB (1%)
135 KiB (8%)
27.2 KiB (8%)
Title
Core Media Audio
Core Media Audio
Core Media Audio
Core Media Audio
Writing library
Apple Revision 1
Encoded date
UTC 2021-02-22
01:42:53
UTC 2021-02-22
01:42:53
UTC 2021-02-22
03:32:00
UTC 2021-02-22
01:58:08
Tagged date
UTC 2021-02-22
01:42:53
UTC 2021-02-22
01:42:53
UTC 2021-02-22
03:32:01
UTC 2021-02-22
01:58:09
MediaInfo Metadata of iPhone Snapchat Video 012
012
Extracted from
iPhone
Dropbox
Gmail
Extracted from
Android
General
Name
98F95CC8-62E2-
489C-8E9A-
1FBBBF830AA9.MP4
IMG_3567.MP4
IMG_27744659.MOV
98F95CC8-1.3gp
Format
MPEG-4
MPEG-4
MPEG-4
MPEG-4
Format profile
Base Media / Version
2
Base Media / Version
2
QuickTime
3GPP Media Release
6 Basic
Codec ID
mp42
(isom/mp41/mp42)
mp42
(isom/mp41/mp42)
qt 0000.00 (qt )
3gp6 (3gp6/isom)
File size
12.4 MiB
12.4 MiB
1.26 MiB
249 KiB
Duration
14 s 627 ms
14 s 627 ms
14 s 627 ms
14 s 627 ms
Overall bit rate
7 111 kb/s
7 111 kb/s
722 kb/s
139 kb/s
Encoded date
UTC 2021-02-22
01:34:19
UTC 2021-02-22
01:34:19
UTC 2021-02-22
03:29:41
UTC 2021-02-22
01:57:50
58
012
Extracted from
iPhone
Dropbox
Gmail
Extracted from
Android
Tagged date
UTC 2021-02-22
01:34:19
UTC 2021-02-22
01:34:19
UTC 2021-02-22
03:29:41
UTC 2021-02-22
01:57:51
Writing library
Apple QuickTime
Video
ID
2
2
2
2
Format
AVC
AVC
AVC
AVC
Format/Info
Advanced Video
Codec
Advanced Video
Codec
Advanced Video
Codec
Advanced Video
Codec
Format profile
Format settings
CABAC / 2 Ref
Frames
CABAC / 2 Ref
Frames
CABAC / 2 Ref
Frames
1 Ref Frames
Format settings,
CABAC
Yes
Yes
Yes
No
Format settings,
Reference frames
2 frames
2 frames
2 frames
1 frame
Format settings, GOP
M=1, N=15
Codec ID
avc1
avc1
avc1
avc1
Codec ID/Info
Advanced Video
Coding
Advanced Video
Coding
Advanced Video
Coding
Advanced Video
Coding
Duration
14 s 627 ms
14 s 627 ms
14 s 627 ms
14 s 627 ms
Source duration
14 s 693 ms
14 s 693 ms
14 s 667 ms
Bit rate
7 016 kb/s
7 016 kb/s
654 kb/s
125 kb/s
Width
656 pixels
656 pixels
256 pixels
320 pixels
Height
1 232 pixels
1 232 pixels
480 pixels
240 pixels
Display aspect ratio
0.532
0.532
0.533
4:03
Frame rate mode
Variable
Variable
Variable
Constant
Frame rate
30.000 FPS
30.000 FPS
30.000 FPS
15.000 FPS
Minimum frame rate
30.000 FPS
30.000 FPS
30.000 FPS
Maximum frame rate
33.333 FPS
33.333 FPS
33.333 FPS
Color space
YUV
YUV
YUV
YUV
Chroma subsampling
4:02:00
4:02:00
4:02:00
4:02:00
Bit depth
8 bits
8 bits
8 bits
8 bits
Scan type
Progressive
Progressive
Progressive
Progressive
Bits/(Pixel*Frame)
0.289
0.289
0.177
0.108
Stream size
12.2 MiB (99%)
12.2 MiB (99%)
1.14 MiB (91%)
222 KiB (89%)
Source stream size
12.3 MiB (99%)
12.3 MiB (99%)
223 KiB (90%)
Title
Core Media Video
Core Media Video
Core Media Video
Core Media Video
Encoded date
UTC 2021-02-22
01:34:19
UTC 2021-02-22
01:34:19
UTC 2021-02-22
03:29:41
UTC 2021-02-22
01:57:50
Tagged date
UTC 2021-02-22
01:34:19
UTC 2021-02-22
01:34:19
UTC 2021-02-22
03:29:41
UTC 2021-02-22
01:57:51
Color range
Full
Full
Full
Full
Color primaries
BT.709
BT.709
Transfer characteristics
BT.709
BT.709
Matrix coefficients
BT.709
BT.709
Codec configuration
box
avcC
avcC
avcC
avcC
59
012
Extracted from
iPhone
Dropbox
Gmail
Extracted from
Android
Audio
ID
1
1
1
1
Format
AAC LC
AAC LC
AAC LC
AMR
Format/Info
Advanced Audio
Codec Low
Complexity
Advanced Audio
Codec Low
Complexity
Advanced Audio
Codec Low
Complexity
Adaptive Multi-Rate
Format profile
Narrow band
Codec ID
mp4a-40-2
mp4a-40-2
mp4a-40-2
samr
Duration
14 s 575 ms
14 s 575 ms
14 s 575 ms
14 s 573 ms
Source duration
14 s 629 ms
14 s 629 ms
14 s 629 ms
14 s 600 ms
Bit rate mode
Constant
Constant
Constant
Constant
Bit rate
64.0 kb/s
64.0 kb/s
64.0 kb/s
12.8 kb/s
Channel(s)
1 channel
1 channel
1 channel
1 channel
Channel layout
C
C
C
Sampling rate
44.1 kHz
44.1 kHz
44.1 kHz
8 000 Hz
Frame rate
43.066 FPS (1024
SPF)
43.066 FPS (1024
SPF)
43.066 FPS (1024
SPF)
Bit depth
13 bits
Compression mode
Lossy
Lossy
Lossy
Stream size
111 KiB (1%)
111 KiB (1%)
111 KiB (9%)
22.8 KiB (9%)
Source stream size
112 KiB (1%)
112 KiB (1%)
112 KiB (9%)
22.8 KiB (9%)
Title
Core Media Audio
Core Media Audio
Core Media Audio
Core Media Audio
Writing library
Apple Revision 1
Encoded date
UTC 2021-02-22
01:34:19
UTC 2021-02-22
01:34:19
UTC 2021-02-22
03:29:41
UTC 2021-02-22
01:57:50
Tagged date
UTC 2021-02-22
01:34:19
UTC 2021-02-22
01:34:19
UTC 2021-02-22
03:29:41
UTC 2021-02-22
01:57:51
MediaInfo Metadata of iPhone Snapchat Video 013
013
Extracted from
iPhone
Dropbox
Gmail
Extracted from
Android
General
Name
7AB4BBB0-9EF7-
48C0-BC0C-
DF6DB30AEDB2.MP4
IMG_3573.MP4
IMG_257523635.MOV
7AB4BBB0-1.3gp
Format
MPEG-4
MPEG-4
MPEG-4
MPEG-4
Format profile
Base Media / Version 2
Base Media /
Version 2
QuickTime
3GPP Media
Release 6 Basic
Codec ID
mp42
(isom/mp41/mp42)
mp42
(isom/mp41/mp42)
qt 0000.00 (qt )
3gp6 (3gp6/isom)
File size
10.3 MiB
10.3 MiB
1.05 MiB
208 KiB
Duration
11 s 463 ms
11 s 463 ms
11 s 463 ms
11 s 463 ms
Overall bit rate
7 566 kb/s
7 566 kb/s
766 kb/s
149 kb/s
Encoded date
UTC 2021-02-22
01:41:23
UTC 2021-02-22
01:41:23
UTC 2021-02-22
03:31:31
UTC 2021-02-22
01:58:05
60
013
Extracted from
iPhone
Dropbox
Gmail
Extracted from
Android
Tagged date
UTC 2021-02-22
01:41:24
UTC 2021-02-22
01:41:24
UTC 2021-02-22
03:31:31
UTC 2021-02-22
01:58:05
Writing library
Apple QuickTime
Video
ID
2
2
2
2
Format
AVC
AVC
AVC
AVC
Format/Info
Advanced Video Codec
Advanced Video
Codec
Advanced Video
Codec
Advanced Video
Codec
Format profile
Format settings
CABAC / 2 Ref
Frames
CABAC / 2 Ref
Frames
CABAC / 2 Ref
Frames
1 Ref Frames
Format settings,
CABAC
Yes
Yes
Yes
No
Format settings,
Reference frames
2 frames
2 frames
2 frames
1 frame
Format settings, GOP
M=1, N=15
Codec ID
avc1
avc1
avc1
avc1
Codec ID/Info
Advanced Video
Coding
Advanced Video
Coding
Advanced Video
Coding
Advanced Video
Coding
Duration
11 s 463 ms
11 s 463 ms
11 s 463 ms
11 s 463 ms
Source duration
11 s 530 ms
11 s 530 ms
11 s 467 ms
Bit rate
7 444 kb/s
7 444 kb/s
697 kb/s
134 kb/s
Width
656 pixels
656 pixels
256 pixels
320 pixels
Height
1 232 pixels
1 232 pixels
480 pixels
240 pixels
Display aspect ratio
0.532
0.532
0.533
4:03
Frame rate mode
Variable
Variable
Variable
Constant
Frame rate
30.000 FPS
30.000 FPS
30.000 FPS
15.000 FPS
Minimum frame rate
28.571 FPS
28.571 FPS
28.571 FPS
Maximum frame rate
31.579 FPS
31.579 FPS
31.579 FPS
Color space
YUV
YUV
YUV
YUV
Chroma subsampling
4:02:00
4:02:00
4:02:00
4:02:00
Bit depth
8 bits
8 bits
8 bits
8 bits
Scan type
Progressive
Progressive
Progressive
Progressive
Bits/(Pixel*Frame)
0.307
0.307
0.189
0.116
Stream size
10.2 MiB (98%)
10.2 MiB (98%)
976 KiB (91%)
188 KiB (90%)
Source stream size
10.2 MiB (99%)
10.2 MiB (99%)
188 KiB (90%)
Title
Core Media Video
Core Media Video
Core Media Video
Core Media Video
Encoded date
UTC 2021-02-22
01:41:23
UTC 2021-02-22
01:41:23
UTC 2021-02-22
03:31:31
UTC 2021-02-22
01:58:05
Tagged date
UTC 2021-02-22
01:41:24
UTC 2021-02-22
01:41:24
UTC 2021-02-22
03:31:31
UTC 2021-02-22
01:58:05
Color range
Full
Full
Full
Full
Color primaries
BT.709
BT.709
Transfer
characteristics
BT.709
BT.709
Matrix coefficients
BT.709
BT.709
Codec configuration
box
avcC
avcC
avcC
avcC
61
013
Extracted from
iPhone
Dropbox
Gmail
Extracted from
Android
Audio
ID
1
1
1
1
Format
AAC LC
AAC LC
AAC LC
AMR
Format/Info
Advanced Audio
Codec Low
Complexity
Advanced Audio
Codec Low
Complexity
Advanced Audio
Codec Low
Complexity
Adaptive Multi-Rate
Format profile
Narrow band
Codec ID
mp4a-40-2
mp4a-40-2
mp4a-40-2
samr
Duration
11 s 460 ms
11 s 460 ms
11 s 460 ms
11 s 458 ms
Source duration
11 s 517 ms
11 s 517 ms
11 s 517 ms
11 s 500 ms
Bit rate mode
Constant
Constant
Constant
Constant
Bit rate
64.0 kb/s
64.0 kb/s
64.0 kb/s
12.8 kb/s
Channel(s)
1 channel
1 channel
1 channel
1 channel
Channel layout
C
C
C
Sampling rate
44.1 kHz
44.1 kHz
44.1 kHz
8 000 Hz
Frame rate
43.066 FPS (1024 SPF)
43.066 FPS (1024
SPF)
43.066 FPS (1024 SPF)
Bit depth
13 bits
Compression mode
Lossy
Lossy
Lossy
Stream size
87.4 KiB (1%)
87.4 KiB (1%)
87.4 KiB (8%)
18.0 KiB (9%)
Source stream size
87.5 KiB (1%)
87.5 KiB (1%)
87.5 KiB (8%)
18.0 KiB (9%)
Title
Core Media Audio
Core Media Audio
Core Media Audio
Core Media Audio
Writing library
Apple Revision 1
Encoded date
UTC 2021-02-22
01:41:23
UTC 2021-02-22
01:41:23
UTC 2021-02-22
03:31:31
UTC 2021-02-22
01:58:05
Tagged date
UTC 2021-02-22
01:41:24
UTC 2021-02-22
01:41:24
UTC 2021-02-22
03:31:31
UTC 2021-02-22
01:58:05
APPENDIX I
The following tables represent the audio samples calculated in each tool for the Android
snap video files 002, 003, and 004 extracted from the Android and the video files sent via MMS
message and extracted from the iPhone.
Audio Samples of Android Snapchat Video 002
002 Audio Samples
iZotope RX 8
mp4dump
mp4info
FAAS
Extracted from Android
648192
649216
649216
649216
Extracted from iPhone
647168
648192
648192
648192
Audio Samples of Android Snapchat Video 003
003 Audio Samples
iZotope RX 8
mp4dump
mp4info
FAAS
Extracted from Android
381952
382976
382976
382976
Extracted from iPhone
380928
381952
381952
381952
62
APPENDIX J
Audio Samples of iPhone Snapchat Video 012
012 Audio Samples
iZotope RX 8
mp4dump
mp4info
FAAS
Extracted from iPhone
641024
645120
645120
641920
Gmail
641024
645120
645120
641920
Extracted from Android
116640
116800
116800
116600
Audio Samples of iPhone Snapchat Video 013
013 Audio Samples
iZotope RX 8
mp4dump
mp4info
FAAS
Extracted from iPhone
503808
507904
507904
504704
Gmail
503808
507904
507904
504704
Extracted from Android
91840
92000
92000
91800
