Android applications store snapshots in the USERDATA/data/<application> directory, but these are controlled by the application and not the user. Access to these snapshots may require root access. While application information can be recovered from this location, another interesting location for recently used application snapshots, which are created when a user minimizes an app or something kicks them away from that screen, is USERDATA/system/recent_images/*.png. (NOTE: you may find that this exists in system_ce or system_de depending on the device.). Here, the examiner will find screenshots of recently used applications that were either interrupted by another action, minimized, or just navigated away from by the user. In this example, the screenshot on the left show graphics and a video in the users Gallery that were being viewed. If the user deletes a photo or video, this screenshot will not be modified. Keep this in mind for child exploitation type cases where the user may have forgotten to clean up graphics from the entire device. The screenshot on the right is the perfect example of what privacy features look like for some applications. If the application is secure, the screen is supposed to “go blank” when it is no longer in use. Here, Telegram Plus did the job and we cannot see any user data in this screenshot. You may also find recent activity in USERDATA/system_recent_tasks, which also tracks recent activity suspended by the Android device (application interrupted or moved into the background). You will notice that the name of the recent_image (###_task_thumbnail.png) will match the name of the recent_tasks (###_task.xml). These items may be cleaned up when the application is closed by the user.