Now, let's look at when you're not rooted
or jailbroken versus when you are.
And this is something you have to be very cautious on.
So here, we can see that we are looking at Telegram.
So we see telegra.Telegraph.
This is Telegram.
We have all of these pictures in here.
Now, what I want you to do is look where they're coming from.
They are coming from caches.
You cannot say that the user ever saw a photo if it's only
in caches.
You have to provide some context to that.
Now, where I'm cautioning you--
Lee and I both used to do application analysis full-time.
So we would literally create app data,
see if the tools parsed it.
If they didn't, write queries and scripts
so that it could be parsed by the customer we worked for.
In caches-- I remember, once, I provided some sample data.
And someone I worked with was like, wow,
you're getting a little risky there.
And I'm like, what are you talking about?
And he's like, there were pictures of scandalous women.
I'm like, what's that even supposed to mean?
I'm not kidding.
You can see here, that's a picture of a remote control.
Most of my pictures are like, my Chapstick, my coffee cup,
my keyboard, my clicker.
So I was like, what are you talking about,
scandalous women?
I don't understand.
I looked at the data.
In cache or in people's stories, all that information
could exist on your device.
So think about Instagram.
All the stories that people share,
even if you never see it, it could be cached to your device.
Think of all the people on Snapchat that go live
or have things that are just public,
that could all end up on your device.
Make sure you are certain that the person saw that graphic.
And I'm going to show you how you can do this.