Snapchat Functionality Analysis in Criminal Investigation

In a criminal case involving two co-defendants, IntaForensics was instructed to provide expert evidence on the operation of the Snapchat platform. The central issue concerned a disputed communication involving a photograph with a caption, that had been shared between the individuals via Snapchat. Our role was to determine whether the caption had been added by the sender or recipient. Through controlled testing, we were able to demonstrate the message’s origin and support the investigation with a clear technical conclusion. 

Snapchat is a widely used social media platform that allows users to send disappearing photos, videos, and messages (“Snaps”) with minimal data retention. Its design often presents challenges in forensic investigations due to the automatic deletion of content, user control over visibility, and limited access to historical communications. 

This case involved two individuals alleged to have used Snapchat to coordinate unlawful activity. During a forensic examination of their devices, several communications were recovered, including one Snap of relevance with an image and a caption that one defendant claimed had been added by the other.

The dispute centred around the origin of a caption embedded in a photo sent via Snapchat. One defendant asserted they had sent only an image, without text, and that the caption must have been added by the recipient. The other maintained they received the Snap with the caption already present and took a screenshot to preserve it. 

Given Snapchat’s ephemeral nature and limited server-side retention, the available evidence could not independently confirm the sequence of events. The question became a technical one: was it possible for a recipient to add a caption to a Snap sent by someone else and then screenshot it as if it had come that way? 

IntaForensics conducted a controlled, comparative analysis using test devices and Snapchat accounts to determine how captions are handled when sending and receiving images. Our process included:

Platform behaviour analysis
We examined Snapchat’s current design and functionality, focusing on how captions are applied to photos, how they appear to the recipient, and what is included when a screenshot is taken.

Controlled account testing
Using two test devices and active Snapchat accounts, we recreated the scenario under investigation. This included sending Snaps with and without captions and observing the options available to recipients.

Screenshot behaviour examination
We reviewed how Snapchat handles screenshots, including the preservation of image layout, caption overlay, and sender metadata. Particular attention was paid to whether recipients could alter content prior to screenshotting.

Forensic comparison of recovered Snap
The Snap in question, as recovered during the device examination, was reviewed and compared to our test results to assess consistency with the sender’s or recipient’s version of events.

Expert reporting for court presentation
We documented our methodology, test results, and expert opinion in a formal report, suitable for court submission and structured to be understood by a legal audience.

Our analysis determined that the caption was added by the sender and could not have been inserted by the recipient in the way claimed. 

Our investigation confirmed that recipients of Snapchat messages cannot edit or add captions to an image they receive and then screenshot it as though it originated that way. The caption appears as part of the original Snap as sent by the sender, and screenshots taken by the recipient preserve that exact layout. Therefore, the Snap recovered during the investigation, showing the captioned image, had been sent in that form by the first offender. 

This case illustrates the value of technical understanding in social media-related investigations. Snapchat’s design poses unique challenges for digital forensic interpretation, and expert insight is essential to ensure accurate conclusions are drawn from recovered communications. 

Contact IntaForensics to discover how our digital investigation services can support your case with integrity, accuracy, and expert insight. Get in touch at sales@intaforensics.com or call us on: 0247 77 17780.