Within the Digital Forensics Discord server, a user asked:

Does anyone know what MEDIA_CONTEXT_TYPE = "5" mean in Snapchat cache_controller.db?

Answer: TL;DR

MEDIA_CONTEXT_TYPE is a numeric field stored in Snapchat's cache_controller.db that categorises cached media by type. Here's how you can decode what each value represents. Tools required:

• JADX
• IDE/Powerful Text Editor (VS Code in my case)
• DB Browser for SQLite

The main method of operation is:

1. Verify source data
2. Locate artefacts of interest and explore
3. Identify and extract application base
4. Decoding and searching
5. Refining results

You'll need some sample data too. I found The Binary Hick's public images (in this case the Android 14 image) work well for testing. Don't forget to verify your file!

Matching SHA-256 hash of: 4e1698460550e20f3b334ae9df96ee1cd78314bdc0fe5de5183fd5d7e1c8967e

Now let's navigate to the cache_controller.db in question:

Folder Directory: \data\data\com.snapchat.android\databases\native_content_manager\

Files of Interest with MD5 Hashes.

We're not too interested in carving data or seeing change commits staged in the write ahead log, so let's just open up the database in an SQLite browser and see what we are working with:

cache_controller.db - Tables of Interest

There are three tables that have the MEDIA_CONTEXT_TYPE field:

• CACHE_FILE_CLAIM
• CACHE_FILE_SAMPLED_TOMBSTONE
• MEDIA_CONTEXT_TYPE_CACHE_POLICIES

A quick SQL query and we can see what tables we should look into further:

SELECT
    'CACHE_FILE_CLAIM' AS table_name,
    (SELECT COUNT(*) FROM CACHE_FILE_CLAIM) AS row_count
UNION ALL

SELECT
    'CACHE_FILE_SAMPLED_TOMBSTONE',
    (SELECT COUNT(*) FROM CACHE_FILE_SAMPLED_TOMBSTONE)
UNION ALL

SELECT
    'MEDIA_CONTEXT_TYPE_CACHE_POLICIES',
    (SELECT COUNT(*) FROM MEDIA_CONTEXT_TYPE_CACHE_POLICIES);

Results:

We can then see what MEDIA_CONTEXT_TYPE values we are working with:

SELECT
    *
FROM
    CACHE_FILE_CLAIM
GROUP BY
    MEDIA_CONTEXT_TYPE 

There are 12 sample points we can work from:

The EXTERNAL_KEY will be a good indicator for us later to validate the findings.

Now let's obtain the Snapchat APK file. There's a few methods, but I'll mention two:

• Method 1: Extract the base.apk file directly from the forensic extraction.
• Method 2: Download a (potentially untrusted) version from a 3rd party provider.

For method 1, if we open the \data\system\packages.xml we can see the Snapchat has the package name com.snapchat.android, installed under the directory /data/app/~~2OYI3NWAqov2Kgvu3KzgEw==/com.snapchat.android-LPpMfTzCI5PeRvfBpoFFrA==/, and inside this directory we can find the base.apk file (MD5 e87e1e308b72d209950f660a62dd5877). This is the primary android application package; the other apk files are supporting resources to the primary application, also referred to as a split APK. This is the best and most forensically sound way to analyse an Android package installed on a device. It's the exact evidence, no break in chain-of-custody, and repeatable.

The alternative method, but perfectly valid for research purposes, is to download a copy of the application's APK file from a 3rd party source such as from APKMirror. Be wary, the integrity of these files can not always be traced back to the original authors, and it may not exactly match the version installed on the device in question resulting in different features, modes of operations, and artefacts.

For this situation, we will stay with the base.apk version. Extract it out into a working directory, verifying of course, and let's continue.

Open Jadx, import the base.apk file, and then export out the source code:

jadx user interface and steps to export the source code.

Then import it into a text editor of your choice. We'll use VSCode:

Export of decoded base.apk loaded into VSCode.

Perform a global regex search for MEDIA.?CONTEXT.?TYPE (using .? to allow for variations in compiled code, such as camelCasing, snake_casing, kebab-casing, etc.) and we will see a collection of hits where the context type is referenced. One of them being a [enlighter lang="java"]public enum MediaContextType[/enlighter] in \sources\com\snapchat\client\mdp_common\MediaContextType.java:

Keyword search hits for the media context type.

Java enums are 0 indexed, so we can easily parse them out to determine what they represent in our original database:

Now we can create a simple SQL query to apply these enum values to our cache_controller.db file. Only a handful have been provided above to give an idea on how to do it:

SELECT
    CASE MEDIA_CONTEXT_TYPE
    WHEN 0 THEN "BITMOJIIMAGES"
    WHEN 1 THEN "LENSIMAGES"
    WHEN 2 THEN "STICKERS"
    WHEN 3 THEN "CHAT"
    WHEN 5 THEN "TEMPUNASSIGNED"
    WHEN 6 THEN "FRIENDSTORYTHUMBNAIL"
    WHEN 7 THEN "RECOMMENDEDSTORYTHUMBNAIL"
    WHEN 11 THEN "COMPOSERIMAGES"
    WHEN 12 THEN "LENS"
    WHEN 13 THEN "ONDEMAND"
    WHEN 25 THEN "GEOFILTER"
    WHEN 29 THEN "MAPS"
    ELSE MEDIA_CONTEXT_TYPE
    END AS "MediaContextTypeEnum",
    EXTERNAL_KEY
    --,*
FROM
    CACHE_FILE_CLAIM
GROUP BY
    MEDIA_CONTEXT_TYPE

See the results below:

So, to answer the original question - MEDIA_CONTEXT_TYPE = 5 in Snapchat's cache_controller.db represents TEMPUNASSIGNED: a cache bucket for media not yet assigned to a specific context type.

The above method of figuring out the media context can be applied to later versions of the application. This is also not just limited to the media context, or even just Snapchat, but can be applied to all Android applications for:

• Database naming
• Folder/file name conventions
• Logic operations
• URL parsing

TL;DR

With the current version of Snapchat (com.snapchat.android_14.10.0.47-293972, as of 13/06/2026) the MediaContextType enum maps to:

Here's a SQL template to build from with the above values:

SELECT
    CASE MEDIA_CONTEXT_TYPE
      WHEN 1 THEN CONCAT(MEDIA_CONTEXT_TYPE, " - BITMOJIIMAGES")
      WHEN 2 THEN CONCAT(MEDIA_CONTEXT_TYPE, " - LENSIMAGES")
      WHEN 3 THEN CONCAT(MEDIA_CONTEXT_TYPE, " - STICKERS")
      WHEN 4 THEN CONCAT(MEDIA_CONTEXT_TYPE, " - CHAT")
      WHEN 5 THEN CONCAT(MEDIA_CONTEXT_TYPE, " - FRIENDSTORYSNAP")
      WHEN 6  THEN CONCAT(MEDIA_CONTEXT_TYPE, " - TEMPUNASSIGNED")
      WHEN 7 THEN CONCAT(MEDIA_CONTEXT_TYPE, " - FRIENDSTORYTHUMBNAIL")
      WHEN 8 THEN CONCAT(MEDIA_CONTEXT_TYPE, " - RECOMMENDEDSTORYTHUMBNAIL")
      WHEN 9 THEN CONCAT(MEDIA_CONTEXT_TYPE, " - COGNACIMAGES")
      WHEN 10 THEN CONCAT(MEDIA_CONTEXT_TYPE, " - COMMERCEIMAGES")
      WHEN 11 THEN CONCAT(MEDIA_CONTEXT_TYPE, " - ADS")
      WHEN 12 THEN CONCAT(MEDIA_CONTEXT_TYPE, " - COMPOSERIMAGES")
      WHEN 13 THEN CONCAT(MEDIA_CONTEXT_TYPE, " - LENS")
      WHEN 14 THEN CONCAT(MEDIA_CONTEXT_TYPE, " - ONDEMAND")
      WHEN 15 THEN CONCAT(MEDIA_CONTEXT_TYPE, " - ONBOARDING")
      WHEN 16 THEN CONCAT(MEDIA_CONTEXT_TYPE, " - BLOOPS")
      WHEN 17 THEN CONCAT(MEDIA_CONTEXT_TYPE, " - RECOMMENDEDUSERSTORYSNAP")
      WHEN 18 THEN CONCAT(MEDIA_CONTEXT_TYPE, " - LOCALIZATIONSTRINGS")
      WHEN 19 THEN CONCAT(MEDIA_CONTEXT_TYPE, " - MUSIC")
      WHEN 20 THEN CONCAT(MEDIA_CONTEXT_TYPE, " - MEMORIESSNAP")
      WHEN 21 THEN CONCAT(MEDIA_CONTEXT_TYPE, " - PUBLISHERSTORYSNAP")
      WHEN 22 THEN CONCAT(MEDIA_CONTEXT_TYPE, " - GIPHYSTICKERS")
      WHEN 23 THEN CONCAT(MEDIA_CONTEXT_TYPE, " - UGCLENSASSETS")
      WHEN 24 THEN CONCAT(MEDIA_CONTEXT_TYPE, " - FRIENDSTORYFIRSTFRAME")
      WHEN 25 THEN CONCAT(MEDIA_CONTEXT_TYPE, " - RECOMMENDEDUSERSTORYFIRSTFRAME")
      WHEN 26 THEN CONCAT(MEDIA_CONTEXT_TYPE, " - GEOFILTER")
      WHEN 27 THEN CONCAT(MEDIA_CONTEXT_TYPE, " - MEMORIESTHUMBNAIL")
      WHEN 28 THEN CONCAT(MEDIA_CONTEXT_TYPE, " - LENSBITMOJI")
      WHEN 29 THEN CONCAT(MEDIA_CONTEXT_TYPE, " - PUBLISHERSTORYFIRSTFRAME")
      WHEN 30 THEN CONCAT(MEDIA_CONTEXT_TYPE, " - MAPS")
      WHEN 31 THEN CONCAT(MEDIA_CONTEXT_TYPE, " - SNAPSHOTS")
      WHEN 32 THEN CONCAT(MEDIA_CONTEXT_TYPE, " - SYSTEMTESTIMAGES")
      WHEN 33 THEN CONCAT(MEDIA_CONTEXT_TYPE, " - SYSTEMTESTVIDEOS")
      WHEN 34 THEN CONCAT(MEDIA_CONTEXT_TYPE, " - ARBUSINESS")
      WHEN 35 THEN CONCAT(MEDIA_CONTEXT_TYPE, " - PREVIEWSNAP")
      WHEN 36 THEN CONCAT(MEDIA_CONTEXT_TYPE, " - SPECTACLES")
      WHEN 37 THEN CONCAT(MEDIA_CONTEXT_TYPE, " - CHEERIOS")
      WHEN 38 THEN CONCAT(MEDIA_CONTEXT_TYPE, " - EXPORTEDMEDIASHARE")
      WHEN 39 THEN CONCAT(MEDIA_CONTEXT_TYPE, " - INCLUSIONPANELSURVEY")
      WHEN 40 THEN CONCAT(MEDIA_CONTEXT_TYPE, " - COMMUNITIES")
      WHEN 41 THEN CONCAT(MEDIA_CONTEXT_TYPE, " - SPOTLIGHTSNAP")
      WHEN 42 THEN CONCAT(MEDIA_CONTEXT_TYPE, " - TOSHTML")
      WHEN 43 THEN CONCAT(MEDIA_CONTEXT_TYPE, " - VALDIMODULESARCHIVE")
      WHEN 44 THEN CONCAT(MEDIA_CONTEXT_TYPE, " - NOTIFICATIONS")
      WHEN 45 THEN CONCAT(MEDIA_CONTEXT_TYPE, " - TINSEL")
      ELSE CONCAT(MEDIA_CONTEXT_TYPE, " - UNKNOWN")
   END AS "MediaContextTypeEnumWithId"
    ,*
FROM
    CACHE_FILE_CLAIM