How to Audit Android Apps (for screenshot activity) How do I audit my android's apps to determine which apps are taking screenshots of my activity?

I recently installed &amp; ran diskdigger to undelete an image I had accidentally deleted, but the image remnants that diskdigger found were shocking. There were dozens (maybe >100?) screenshots of my activity--ranging from innocuous shots of my home screen to images taken when I was inside my (encrypted) chat apps and bitcoin wallet.

Needless to say, I did not take or delete these screenshots.

My phone is a rooted Nexus 5X running Lineage OS 15-1 (Android 8.1.0). I'm using mostly software from fdroid, though I do have a few sideloaded from yalp (I don't have gapps installed), such as whatsapp and diskdigger.

How do I audit the apps that I have installed to determine what is responsible for taking (then deleting) these screenshots of my activity? To start, how do I:


List all of my apps, sorted by number of times the app has taken a
screenshot since installed
List all of my apps, sorted by number of times the app has written a
file to disk since installed
Generate a log and/or toast every time a screenshot is
taken--recording the timestamp, app responsible, and filename
Generate a log and/or toast every time an app writes a file to
disk--recording the timestamp, app responsible, and filename
Generate a log and/or toast every time an app deletes a file from
disk--recording the timestamp, app responsible, and filename


TIA!
Taking a screenshot requires root or system permissions (or an root exploit). I assume your ROM is a official Lineage release. Assuming further that their signing key has not leaked the app you are searching for should use root permissions is part of the OS. Therefore a first step would be revoke all allowances for apps to use root permissions.


  
  List all of my apps, sorted by number of times the app has taken a
  screenshot since installed
  


Android is an OS optimized for Smartphones with flash memory. Flash memory degrades by writing to it, therefore Android is optimized to reduce write operations. Therefore Android does not create extensive log files. Only some small logs in RAM exists (e.g. logcat). Hence AFAIK there is no such thing like a log that records which app has created a screenshot.


  
  List all of my apps, sorted by number of times the app has written a file to disk since installed
  


Again there is no such log. However if the app is still active you can monitor "disk" activity using the inotifywait-for-Android - a command-line application that can record read and/or write access to certain folder on your phone. It looks like you have to compile it yourself using NDK before using it - I did not found an pre-compiled version. 

A similar API as used by inotifytools is available to Android apps, therefore there may be apps providing similar functionality.


  
  Generate a log and/or toast every time a screenshot is taken--recording the timestamp, app responsible, and filename
  


If the screenshots you found were created using the screencap binary (the android tool for creating screenshots which is included in Android) you could try to replace this binary with some other binary. 

However if the screenshots were created using a different way I don't see a way to detect or prevent this.


  
  Generate a log and/or toast every time an app writes a file to disk--recording the timestamp, app responsible, and filename.
  Generate a log and/or toast every time an app deletes a file from disk--recording the timestamp, app responsible, and filename
  


-> See what I wrote in (2.) about inotifytools