Snapshots-- just like we saw in section 2 with Android, Apple--
every time you're interrupted or you minimize an app,
a snapshot is taken.
Now, the issue is you may need full file system
access to get access to all of these snapshots--
not all of them, but some of them.
So we could see the person is playing, it looks like,
Words with Friends.
Why stuff like this is important--
if you think back to section 1, this person
is suddenly running on a 3G network.
That's rare.
Where are they that they are running on such a low network?
Are they in the middle of the woods are they doing something
in a place that they typically aren't?
What's also interesting is, when you look at snapshots,
you can tell if someone's on Wi-Fi or cellular.
It can put a person in a location.
We have a timestamp.
We don't have a date.
But you also see a chat bubble.
People will chat within games.
Your tools will not parse it.
If you see a screenshot of text messages,
you may get indications of other things
that exist on that device.
So here we can see T-Mobile message--
welcome to Czech Republic.
We can see something with Facebook, your Apple ID
verification code.
So it looks like they're verifying their code twice,
and we have a date and time of that.
That's interesting.
Facebook Messenger indications, Instagram messages,
all the posts that people have here--
so everything could be captured in a snapshot.
These will be stored as KTX if the phone takes it, PNG
if the user takes it.
If your tool is not supporting it or carving it,
use another tool.
They should be doing this.
The file paths, if captured by Apple,
are listed there under Library/Caches/Snapshot,
or mobile/Containers.
If it's captured by the user, it goes
to where all photos that are taken by the user
or intentionally saved will be.
ApplicationState.db is going to store information
in these binary large objects that
are going to tell us information about the snapshots.
They could be amazing at what you get.
Now, I will tell you this.
It seems as if Android is more respectful at doing
that gray blank screen versus Apple.
So you will see, even if you're doing Safari
in private browsing, if you minimize,
you will get a snapshot of it.