2024.12.25

• Videos in "Keep in Chat" mode
• Videos in "View Once" mode
• Videos in "Allow Replay" mode
• Voice recordings
• Videos from Reels and Stories

• Rooted Android device
• RS File Manager or any file explorer with root access
• Termux or another Android terminal emulator

This is, of course, for educational purposes to demonstrate that our messages may not be as secure as we think.

Recently, Instagram prohibited screen recording while viewing "one-time" media, prompting me to find another solution. Recovering videos is particularly tricky because videos are sent to users in fragments that must be stitched together. Additionally, the files are scattered across various directories, but this guide explains everything step by step.

First, open Instagram, play the video you’re interested in (it must be played in full), and then close the app immediately.

As shown, using the previous method would only give us a video thumbnail.

Navigate to /data/data/com.instagram.android/cache/ExoPlayerCacheDir/videocache/ and sort by modification date (newest first). You’ll see several directories named with numbers. The most recently modified directory is the one you need.

Inside the directory, ensure sorting is still set to newest first. Check the first file; its modification date should match the time you played the video. If not, keep looking. Note that these video files won’t play yet because, as mentioned, they’re in fragments.

Copy part of the filename up to ".null...".

Return to the videocache directory and search for all files starting with the copied fragment. Wait patiently for the explorer to find all the files; otherwise, you won’t be able to reconstruct the video.

Copy the found files to a working directory in external storage, sort them again by modification date, and enable detailed view to see the long filenames.

One of the files will have a different number after ".null." than the others — this is the audio track. Leave it aside (I don’t yet know how to recover audio), and rename the remaining files in order from oldest to newest, changing their extensions to .mp4.

These files are the video fragments. The oldest one (1.mp4) should play at least partially before a playback error occurs.

Now, switch to Termux. Enter su to enter root mode and cd /storage/emulated/0/ to navigate to the device’s external storage, then use cd to access your working directory.

Create the final video. Start by copying 1.mp4 using cp 1.mp4 final.mp4, then append each subsequent fragment (excluding the audio file) to the final video — cat 2.mp4 >> final.mp4, cat 3.mp4 >> final.mp4, and so on. After each operation, return to the file explorer to play the video. If adding a fragment causes the video to glitch, freeze or skip, the fragments are out of order. In that case, delete the final file (rm final.mp4) and start over, testing a different fragment (usually the next one). In my case, fragments 4.mp4 and 5.mp4 were swapped.

Done! The final.mp4 video should now play in full. You can move it elsewhere and delete the working directory.