| App Name | Snapchat |
| Bundle ID | com.toyopagroup.picaboo |
| Developer | Snap, inc |
| Category | Communication |
| Initial Release | July 8, 2011 |
| Analyzed Version | 13.77.0 |
| Platform | iOS |
| Date performed | 01-29-2026 |
| Verified? | True |
| Horizon Added? | True |
Base Path
/private/var/mobile/Containers/Data/Application/.*
/private/var/mobile/Containers/Shared/AppGroup/.*
File paths of interest with short notes of type of data:
Data:
| Artifact Type | Path | Notes | New Artifact | Tags |
|---|---|---|---|---|
| plist | /private/var/mobile/Containers/Data/Application/.*/Documents/auth-.*.plist | authServiceSnapTokenRefresh that is stored in Keychain as well. | NEW T/P | |
| plist | /private/var/mobile/Containers/Data/Application/.*/Documents/ClientEncryptionService.plist | TODO: needs for RE, but seems to hold some kind of encryption key/info. | NEW T/P | |
| media | /private/var/mobile/Containers/Data/Application/.*/Documents/com.snap.file_manager_3_SCContent_.*/.* | Cached images from both user profile pictures as well as stories, can also hold actor images | NEW T/P | |
| media | /private/var/mobile/Containers/Data/Application/.*/Documents/com.snap.file_manager_4_SCContent_/.* | Cached images mainly from user profile pictures/avatars | NEW T/P | |
| sqlite | /private/var/mobile/Containers/Data/Application/.*/Documents/friending_badge_data.db.* | Database containing userID's, timestamp and unviewed and incoming friend requests | NEW T/P | |
| sqlite | /private/var/mobile/Containers/Data/Application/.*/Documents/friending_notification_snapchatter.db.* | TODO: Contains info on snapchatters, not sure why they showed up yet | NEW T/P | |
| sqlite | /private/var/mobile/Containers/Data/Application/.*/Documents/gallery_data_object/.*/.*/scdb-.*.sqlite3.* | Appears to be Cloud information, actor id | NEW T/P | |
| sqlite | /private/var/mobile/Containers/Data/Application/.*/Documents/gallery_encrypted_db/.*/.*/gallery.encrypteddb.* | TODO: Encryped DB. research where key is for db | NEW P | |
| sqlite | /private/var/mobile/Containers/Data/Application/.*/Documents/global_scoped/cachedcontroller/cache_controller.db.* | DB used to map cache key to external key (media reference keys), creation timestamp, metadata on files | NEW T | |
| sqlite | /private/var/mobile/Containers/Data/Application/.*/Documents/global_scoped/cups/cups.db.* | TODO: somethign about backgrounds, try to generate data | NEW T/P | |
| sqlite | /private/var/mobile/Containers/Data/Application/.*/Documents/global_scoped/global-scoped-preferences/preferences.sqlite.* | Preferences info. Can contain actor id, actor username, device/OS info, system boot time, last login username, some encrypted data | NEW T/P | |
| sqlite | /private/var/mobile/Containers/Data/Application/.*/Documents/user_scoped/.*/arroyo/arroyo.db.* | Contains chat messages, conversation id, sender id, last "login" timestamp, locations, Calls Groups and participant Actors | location, pol | |
| sqlite | /private/var/mobile/Containers/Data/Application/.*/Documents/user_scoped/.*/databases/convo_safety.db.* | TODO: generate more data, need to see if messages that are flagged are saved here. Contains conversation ids | NEW T/P | |
| sqlite | /private/var/mobile/Containers/Data/Application/.*/Documents/user_scoped/.*/databases/memories_asset_repository.sqlite.* | TODO: generate memories. Can contain snap memories, some of it might be encrypted. | TODO | |
| sqlite | /private/var/mobile/Containers/Data/Application/.*/Documents/user_scoped/.*/databases/spotlight_recent_story.sqlite.* | TODO: generate data. Can contain records on stories | TODO | |
| sqlite | /private/var/mobile/Containers/Data/Application/.*/Documents/user_scoped/.*/databases/spotlight_usage.sqlite.* | TODO: generate data. Not super sure, need to confirm info. | TODO | |
| sqlite | /private/var/mobile/Containers/Data/Application/.*/Documents/user_scoped/.*/DocObjects/primary.docobjects.* | Can contain actor id, some feed info, snapchat user names (Find Friends/Added Me/ai/teamsnapchat), contact info with hashed phonenumber, list of snapchat users and their id's | NEW T | pol |
| sqlite | /private/var/mobile/Containers/Data/Application/.*/Documents/user_scoped/.*/my_stories_media | TODO: generate data. Might contain store images/media | TODO | |
| plist | /private/var/mobile/Containers/Data/Application/.*/Documents/user.plist | User details file containing Source Actor details. May hold encryption info | ||
| sqlite | /private/var/mobile/Containers/Data/Application/.*/Documents/Valdi/sqlite/.*/CallLog.db.* | TODO: confirm data. May hold call log info, empty currently | TODO | |
| sqlite | /private/var/mobile/Containers/Data/Application/.*/Documents/Valdi/sqlite/.*/communities_db.* | TODO: confirm data. May hold group chat info, empty currently | TODO | |
| media | /private/var/mobile/Containers/Data/Application/.*/Library/Caches/.*.jpg | Images taken with snapchat | TODO | |
| media | /private/var/mobile/Containers/Data/Application/.*/Library/Caches/SCCache/com.pinterest.PINDiskCache.search.image.data/.* | Cached profile images of suggested friends | TODO | |
| plist | /private/var/mobile/Containers/Data/Application/.*/Library/Preferences/com.toyopagroup.picaboo.plist | Preferences file, first install date, updated date, last session date, source actor details | pol | |
| media | /private/var/mobile/Containers/Data/Application/.*/Library/Preferences/SplashBoard/Snapshots/sceneID/com.toyopagroup.picaboo-default/.*.ktx | Can be random screenshots during app usage | NEW T/P |
Shared:
| Artifact Type | Path | Notes | New Artifact | Tags |
|---|---|---|---|---|
| plist | /private/var/mobile/Containers/Shared/AppGroup/.*/app_group_plist_storage | User id | NEW T/P | |
| plist | /private/var/mobile/Containers/Shared/AppGroup/.*/Library/Preferences/group.snapchat.picaboo.plist | Preferences file containing the Source Actor and other Actors | ||
| media | /private/var/mobile/Containers/Shared/AppGroup/.*/User/.*/camera-lock-screen-widget/.* | Actor bitmoji | NEW T/P | |
| sqlite | /private/var/mobile/Containers/Shared/AppGroup/.*/User/.*/databases/notif_db.sqlite.* | Notifications ex: friend added, "is typing" in chat, someone sent chat, and timestamps | NEW T/P | pol |
| sqlite | /private/var/mobile/Containers/Shared/AppGroup/.*/User/.*/databases/nse_db.sqlite.* | Notifications ex: friend added, "is typing" in chat, someone sent chat, and timestamps | NEW T/P | pol |
| media | /private/var/mobile/Containers/Shared/AppGroup/.*/User/.*/extensionGeneralCache | Friends profile pic/bitemoji | NEW T/P | |
| media | /private/var/mobile/Containers/Shared/AppGroup/.*/WidgetExtension/snapcode | Actors QR code image for inviting | NEW T/P |