Snapchat recovery is similar to what was described previously, but not all Snapchat data is encrypted. In order to view Memories, the encryption key value from the egocipher.key.avoidkeyderivation account must be sourced from the iOS keychain and used to decrypt the content.

Data that is not encrypted includes:

•  Received videos, messages, conversations, and stories. Consistent with other time-bombing capable applications, those messages with images set to expire are not recoverable if the acquisition occurs after the expiry window.

Snapchat support has been incorporated into all of your main forensic utilities.