The Philadelphia police department has recently received reports of a possible sexual predator roaming around Shopping Malls taking explicit pictures of women's underskirts without their consent. Based on a recent analysis of mall surveillance cameras, the man was last identified at the mall on December 4th, 2020 at around 11:20 AM Easter Standard Time Zone (EST) (4 PM UTC). This finding provided grounds to grant a search warrant for his cell phone. Investigators were then able to acquire a forensic image of the suspect's cell phone, a Samsung Galaxy S6 SM-G920T.

Immediate analysis of the device's acquired forensic image revealed that the default Digital Camera Images (DCIM) media directory contained only digital pictures and videos that were not illicit or labeled illegal as they were unrelated to the investigation.

Furthermore, while analyzing data extracted from the other applications, two Calculator applications were discovered installed in the device, and one of them was found to be masquerading as a Calculator. In reality, this was discovered to be a Calculator Vault - Gallery Lock (version 15) application, which provides users with a "secure" space to hide personal files in the device.

As part of the forensics investigations team, it is your task to follow the leads to find any explicit media in the suspect's device. Any evidence found may determine whether to move the case forward in order to prosecute the suspect for the alleged crime.

• In order to move the case forward, more substantial evidence must be discovered. As of now, based on the media found stored in the DCIM directory, it may seem that the suspect has nothing to hide. However, the next location you will need to investigate is the directory housing the fake Calculator Vault's data. It is possible the suspect may have deleted any media evidence files completely from the device and/or moved them to the Vault. Find the directory the application uses to hide files. (Answer format: /path/).