As we discussed in Section 2 on Android, iOS snapshots may be your best evidence. With jailbreaks now available, chances are good that we can recover screenshots from iOS devices! You never know what you may get. Having some relevant information supporting the screenshot may prove to be fruitful. A good blog to read about this is: https://for585.com/iossnaps and the script to parse it is: https://github.com/abrignoni/iOS-Snapshot-Triage-Parser/blob/master/SnapshotTriage.py.

Snapshots are taken on iOS devices when the application in use is minimized by the user or is interrupted by another activity. For example, if I am playing Words With Friends and a call comes in, my application will snapshot itself and fade into the background while I take the call. The format is .png for iOS 10 and earlier and .ktx for iOS 11+.

If Apple saves the screenshot, it will be stored in:

Library/Caches/Snapshots/<bundleID>/<bundleID>/

or

/mobile/Containers/Data/Application/<ApplicationUUID>/Library/Caches/Snapshots/<bundleID>

If the user creates the screenshot, which is shown on the slide above where we see Instagram from my iOS 15 device, the file would be saved as .png in the /Media/DCIM/101APPLE directory because I (the user) chose to save it to photos.