How to Audit Android Apps (for screenshot activity)

Question

How do I audit my android's apps to determine which apps are taking screenshots of my activity?

I recently installed & ran diskdigger to undelete an image I had accidentally deleted, but the image remnants that diskdigger found were shocking. There were dozens (maybe >100?) screenshots of my activity--ranging from innocuous shots of my home screen to images taken when I was inside my (encrypted) chat apps and bitcoin wallet.

Needless to say, I did not take or delete these screenshots.

My phone is a rooted Nexus 5X running Lineage OS 15-1 (Android 8.1.0). I'm using mostly software from fdroid, though I do have a few sideloaded from yalp (I don't have gapps installed), such as whatsapp and diskdigger.

How do I audit the apps that I have installed to determine what is responsible for taking (then deleting) these screenshots of my activity? To start, how do I:

1. List all of my apps, sorted by number of times the app has taken a
   screenshot since installed
2. List all of my apps, sorted by number of times the app has written a file to disk since installed
3. Generate a log and/or toast every time a screenshot is taken--recording the timestamp, app responsible, and filename
4. Generate a log and/or toast every time an app writes a file to disk--recording the timestamp, app responsible, and filename
5. Generate a log and/or toast every time an app deletes a file from disk--recording the timestamp, app responsible, and filename

TIA!

Answer 1

Taking a screenshot requires root or system permissions (or an root exploit). I assume your ROM is a official Lineage release. Assuming further that their signing key has not leaked the app you are searching for should use root permissions is part of the OS. Therefore a first step would be revoke all allowances for apps to use root permissions.

1. List all of my apps, sorted by number of times the app has taken a screenshot since installed

Android is an OS optimized for Smartphones with flash memory. Flash memory degrades by writing to it, therefore Android is optimized to reduce write operations. Therefore Android does not create extensive log files. Only some small logs in RAM exists (e.g. logcat). Hence AFAIK there is no such thing like a log that records which app has created a screenshot.

2. List all of my apps, sorted by number of times the app has written a file to disk since installed

Again there is no such log. However if the app is still active you can monitor "disk" activity using the inotifywait-for-Android - a command-line application that can record read and/or write access to certain folder on your phone. It looks like you have to compile it yourself using NDK before using it - I did not found an pre-compiled version.

A similar API as used by inotifytools is available to Android apps, therefore there may be apps providing similar functionality.

3. Generate a log and/or toast every time a screenshot is taken--recording the timestamp, app responsible, and filename

If the screenshots you found were created using the screencap binary (the android tool for creating screenshots which is included in Android) you could try to replace this binary with some other binary.

However if the screenshots were created using a different way I don't see a way to detect or prevent this.

4. Generate a log and/or toast every time an app writes a file to disk--recording the timestamp, app responsible, and filename.
5. Generate a log and/or toast every time an app deletes a file from disk--recording the timestamp, app responsible, and filename

-> See what I wrote in (2.) about inotifytools

Answer 2

You can also use selinux policy rules in permissive mode to audit an android application, but Google intentionally makes this extremely difficult.

In case anyone is interested, I ended up finding the source of the screenshot images: it is Android's built-in "recent apps" switcher. For more info, I documented my investigation process and findings on my blog

• https://tech.michaelaltfield.net/2018/11/09/android-security-auditing-investigating-unauthorized-screenshots/