Files of interest:
contentpics directories in
/cache contain images that were sent and received with the application. The files in
contentpics contain what appears to be Kik metadata embedded before the image. The
.jpg has to be carved out of these files. In our testing, all of the files in
contentpics were also stored in
chatPicsBig, though this may change with more extensive app usage. The user's profile picture is found in the
Data storage method 8 is using basic steganography, which means, a file is stored within a larger file.
/files/staging/thumbs directory contains thumbnails of images sent and received with the application. Our testing found the same images in this location...