These snapshots-- so how these are created--
If you think about using your phone,
any time you're doing something on your phone-- let's say,
you're texting someone.
And if I get a call that comes, in and I answer it,
that text message goes into the background.
Any time an application goes into the background
of your device, a snapshot is taken.
That snapshot will exist until you re-use that application.
What you will find are apps that do a really good job
at protecting your privacy, like Telegram Plus in this example.
This is what we call the gray screen, where
you can see Telegram Plus, it has nothing on it.
We don't see any messages.
We see nothing.
It literally just goes to a blank screen.
Banking applications are supposed to do that.
Secure chat applications are supposed to do that.
Notice I say supposed.
Doesn't always happen.
On the left-hand side, you can see
I must have been looking at my gallery
at older historical pictures.
And when we're looking at these pictures,
we can see, if you look very closely at that top picture,
by January 18, it has what looks like an icon of an SD card.
Why is that there?
That picture is probably stored on an SD card.
You can see snippets of videos, something
that looks like a map, a Dunkin' Donuts cup,
and what looks like people sitting around
with some beer bottles.
Root checker basic-- why is this relevant?
The fact that you see something that says,
congratulations, root access is properly
installed on this device.
If you are examining that device, that Nexus 6,
you have root access.
You better try to get a physical acquisition of that device.
Now, here is where this gets tricky.
It's running Android version 7.
Remember, Android version 7 could
have been full-disk encryption or file-based encryption.
Because it's rooted, chances are good that's
going to be a full-disk-encrypted device.
You could physically acquire that.
Snapshots are super important.
You're going to be looking at those during this course.