App Snapshots

When the user presses the Home button on the iOS device, it places the current app in to the background. To give the illusion of re loading the app to the foreground, iOS will take a snapshot image of the running app. When the user re-opens the app, iOS loads this stored image first while it really loads the app in the background. Once the app is fully open, the image disappears, and the user never knows the difference.

If the user presses the Home button while the app is displaying sensitive data, then that sensitive data is captured in the image and stored locally on the device. Look for these images and review them for sensitive information.

App: $DATA_DIR/Library/Caches/Snapshots/<subdirs>

System: /private/var/mobile/Library/Caches/Snapshots