2024.12.18
- Photos in "Keep in Chat" mode
- Photos in "View Once" mode
- Photos in "Allow Replay" mode
- First frames of videos
- Stories
- Original media (sent by the user)
- Videos
- Video stories
- Voice recordings
- Rooted Android device
- RS File Manager or any file explorer with root access
This is, of course, for educational purposes to demonstrate that our messages may not be as secure as we think.
Recently, Instagram prohibited screen recording while viewing "one-time" media, which led me to look for another solution.
The steps are similar to those for Snapchat and countless other apps, meaning they’re simple. Navigate to the path /data/data/com.instagram.android/cache/images.stash/clean/ and sort by the last modification date.
Inside the directory, you'll find numerous files. The most interesting ones are usually those whose names do *not* start with https or emoji. For a quick process, you can simply select the first several files using the range selection option.
Copy these files to a working directory in external storage.
Now, change the file extensions to .jpg using the "New name + number" option (since names may repeat) and select the files you're interested in. Again, you’ll need to sift through a lot of junk because Instagram seems to store everything remotely classified as an image in this location.
Done!
Images and (possibly) videos sent by the user (so-called original media) can be found in /data/data/com.instagram.android/cache/original_images/ and original_media/.