Thank you, ChitlinsCC. I've searched for a good while myself, hence my last ditch effort in hopes that someone here would have an answer. 😟 The user in this case does have personal knowledge and, although my password is not easily guessed, it comes down to a matter of criminality here. The phone was taken last night and then discreetly returned to a lost & found this morning. I know, if I were to question them, they would say they accidentally picked it up or something, but I have good reason to believe otherwise. If they made any log-in attempts (successful or failed), we have proof that their intent was to gain access to and/or use the information found on the phone and can pursue criminal charges. If not, we have little more than a gut feeling to go on.
As I mentioned previously, I have found posts about using 3rd party developler/configuration software to gain access to information of this nature, but no real guidance on where to look within the programs. Being configuration software, I don't want to play with them too much. I found a video on one of the software programs that appears to possibly support your theory that it would only be a temporary file if it does, indeed, exist. I haven't found much yet on the other software, but will continue to look. I appreciate your input!