The evidence is all over the place.
Can't you see? He didn't know how that app was installed and the 2nd screenshot displayed that it has been used or still active.