The document discusses analyzing disk images from mobile phones to recover metadata and personal information from Snapchat and Tinder. It found that Snapchat notification information, .nomedia files, and an AES encrypted database could be recovered, as well as story information. For Tinder, it recovered user and matched user personal details, photos, match details like creation date and last activity date, and photo metadata. It concludes that deleted information can still be recovered and encourages being mindful of personal information shared on apps.

1. I SWIPED RIGHT ON YOUR
METADATA LAST SUMMER
@drunkrhin0

2. Who Am I?
#BSidesMelb19

3. Background
• Minimal research • Interest in smartphone forensics
#BSidesMelb19

4. Applications
• Lack of research • .nomedia files
• AES encrypted databases
#BSidesMelb19

5. Challenges faced
#BSidesMelb19

6. Entities involved
#BSidesMelb19

8. Process
#BSidesMelb19
Setup smartphones
Acquire mobile
phones
Analyse disk
images

9. Structure
Tinder Snapchat
#BSidesMelb19

10. Key Findings - Snapchat
Recovered:
– Notification information
– .nomedia files
– AES encrypted DB
– Story information
#BSidesMelb19

11. Key Findings - Snapchat
#BSidesMelb19

12. Key Findings – Tinder
tinder-3.db 17378-legacy_tinder-1.db
Personal details – User &
Matched user
Photos (account and
matched
Match - Tinder details
• Creation date
• Last activity date
Photo metadata
Message details User information
Android metadata SQLite sequence data
#BSidesMelb19

13. Takeaways
• Just because it’s “gone” it doesn’t mean it’s gone…
• Be mindful of your personal information
• My dog got more super likes on Tinder than me
#BSidesMelb19

14. Further Work
#BSidesMelb19

15. Questions?
#BSidesMelb19
@drunkrhin0