How to Audit Android Apps (for screenshot activity)

Taking a screenshot requires root or system permissions (or an root exploit). I assume your ROM is a official Lineage release. Assuming further that their signing key has not leaked the app you are searching for should use root permissions is part of the OS. Therefore a first step would be revoke all allowances for apps to use root permissions.

1. List all of my apps, sorted by number of times the app has taken a
   screenshot since installed

Android is an OS optimized for Smartphones with flash memory. Flash memory degrades by writing to it, therefore Android is optimized to reduce write operations. Therefore Android does not create extensive log files. Only some small logs in RAM exists (e.g. logcat). Hence AFAIK there is no such thing like a log that records which app has created a screenshot.

2. List all of my apps, sorted by number of times the app has written a file to disk since installed

Again there is no such log. However if the app is still active you can monitor "disk" activity using the inotifywait-for-Android - a command-line application that can record read and/or write access to certain folder on your phone. It looks like you have to compile it yourself using NDK before using it - I did not found an pre-compiled version.

A similar API as used by inotifytools is available to Android apps, therefore there may be apps providing similar functionality.

3. Generate a log and/or toast every time a screenshot is taken--recording the timestamp, app responsible, and filename

If the screenshots you found were created using the screencap binary (the android tool for creating screenshots which is included in Android) you could try to replace this binary with some other binary.

However if the screenshots were created using a different way I don't see a way to detect or prevent this.

4. Generate a log and/or toast every time an app writes a file to disk--recording the timestamp, app responsible, and filename.


5. Generate a log and/or toast every time an app deletes a file from disk--recording the timestamp, app responsible, and filename

-> See what I wrote in (2.) about inotifytools