Today, Widgets, & Ignored Apps in iOS

This week I had what I would consider a “happy accident.” It happened while I was trying to answer a question that someone had asked me about CarPlay. While I was looking around for CarPlay data I found data about Today, the area that resides to the left of the iOS home screen. It is fairly well known that Springboard gives us information about an iOS device’s home screen layout, but it also gives us information about Today’s content and layout, and about “ignored” apps.

For this blog post, I will be skipping the usual pleasantries and getting straight to the forensics. For everything in this post, I used my personal iPhone XS, which was running iOS 14.7.

Widgets & Today’s View

In iOS 14 (not iPadOS 14), Widgets can be placed in Today or on the home screen (no Android jokes please), and can be various sizes. When setting up a new widget, a user picks the size of the widget. See Figures 1, 2, and 3.

Note that all sizes are not available to all apps. For example, Fitness is only available (on my phone, at least) as a small or medium-sized widget.

One the size is chosen, a widget can be placed in Today or somewhere on the home screen, and iOS will arrange the surrounding widgets, apps, or folders to compensate. Figure 4 shows the home screen from my phone, which has one widget, Weather.

Figure 5 shows my Today, which has a few widgets.

Just below Spotlight, you can see the first widget, which is what Apple calls a Smart Stack. This widget is actually a container for multiple widgets. The contents of a Smart Stack are either automatically generated, or a user can create a custom Smart Stack in much the same way they would create a folder full of apps (press, hold, wiggle, drag & drop). Throughout the day, Smart Stack will show the widget it thinks is most relevant to you based on day/time/location.  Just like other widgets, a Smart Stack can live in Today, or somewhere on the home screen. Figure 6 through 12 show the contents of my Smart Stack (red box).

Just below the Smart Stack is a widget that shows the battery levels of my phone and AppleWatch, and a separate Calendar widget to the right of it. Just below those, is the News widget and a separate Word Press widget (Figure 13).

Springboard

As previously mentioned, Springboard is the go-to for determining the layout of an iPhone’s (and iPad’s) home screen, but it also tells us about Today. The file IconState.plist contains the information, and it is available in an encrypted iTunes backup or a full file system extraction. In the former, the file is located in /HomeDomain/Library/Preferences, and in the latter it is located in /private/var/mobile/Library/Springboard/.  Figure 14 shows the root of IconState.plist.

There are two entries we are interested in: “today” (red box) and “iconLists” (blue box). The latter is where the layout of the Home Screen is located, so we’ll start there first since that is were the Weather widget is located. Because I tend to be a bit of a neat-freak, I only have one (1) Home Screen page (everything is in folders), so my lone Home Screen page is represented by “Item 0.” If I had more than one (1) Home Screen page, the second page would be “Item 1,” the next would be “Item 2,” followed by “Item 3” so on and so forth. See Figure 15.

Back in Figure 4 my Weather widget was to the left of Maps, Passbook, and Calendar. So, my Weather widget is represented here as Item 0 (items are read left-to-right, starting with 0). Figure 16 shows my lone home screen page, and Figure 17 shows Item 0, which is my Weather widget (red box).

In Figure 17, there are three highlighted key/key values. The key in the green box, gridSize, shows the size of the widget (key value = small). The key/key value in the blue box, containerBundleIdentifier, shows the app displaying the information in the widget (key value = com.apple.weather), and the key elementType shows that it is a widget (key value = widget).

Now that we know how the plist key/key values look for widgets, let’s have a look at Today in the plist (blue box in Figure 14). If you recall, I had 5 widgets in my Today (Smart Stack, Battery, Calendar, News, and Word Press). See Figure 18.

To understand how the layout is done, see Figure 19.

Widgets in Today are ordered in the plist top-down and left-to-right. So, Smart Stack is Item 0 (red box), Battery is Item 1 (blue box), Calendar is Item 2 (green box), News is Item 3 (purple box), and Word Press is Item 4 (not pictured here but seen in Figure 13).

Expanding Item 0 reveals 7 elements. See Figure 20. Note that the gridSize for this widget is in the red box.

Since this is a Smart Stack widget, this makes sense since it was the top-most widget. Figure 21 shows the Siri Suggestions (red box), Slide Show (Photos – blue box), Apple Music (green box), and Calendar (I use Outlook for iOS – purple box).

Notice that each entry in Figures 21 and 22 have the plist key of elementType with a corresponding value of “widget.”

Item 1 is the battery widget. See Figure 23.

Note that the value for the key gridSize is “small,” but look at the key value for the key elementType. It’s just “battery,” which leads me to speculate this is not a true “widget” as far as iOS is concerned, even though it can be placed anywhere in Today or on the Home Screen. Purely speculation, but interesting nonetheless.

Figure 24 shows the plist entry for the Calendar widget (small widget), Figure 25 shows the plist entry for the News widget (extraLarge widget), and Figure 26 shows the plist entry for the Word Press widget (medium widget). Note that in each figure, the package name is highlighted in the red box, and the widget size is highlighted in the blue box.

A couple of notes about widget size as it relates to the Home Screen. First, I have only observed three sizes of widgets in IconState.plist: small, medium, extraLarge. I have not seen a “large” widget value. That’s not to say that one doesn’t exist, but just that I have not seen one. Second, the size of a widget determines how much space it takes up on the Home Screen (if the widget is placed there). A small widget takes up four (4) spots (think four app icons or four folder icons), a medium widget takes up eight (8) spots, and an extraLarge widget takes up sixteen (16) spots. Understanding the size of the widget can help reconstruct a home screen that has them if and when it is needed.

I’m Not Gonna Be Ignored

Widgets were not the only new thing Apple introduced to the home screen in iOS 14. App Library was also introduced, which is Apple’s attempt to help us de-clutter our home screens without deleting apps from the phone. Using myself as an example, I have a few apps on my phone that I haven’t deleted, but I still need them from time to time. Instead of completely deleting them from my phone, I had the option to merely delete the app from the home screen. Figure 27 shows what this operation looks like.

If I were to choose “Remove from Home Screen,” the icon would be removed from view, but the app and all its data would still reside on my iPhone. If I wanted to get to the app, I would swipe as far as I could to the right to get to App Library and find the app in one of the pre-categorized folders. Two of the apps that I have banished from the home screen (but kept on the phone) are Warby Parker and the new iOS Translate app. Figure 28 highlights both apps in the App Libary (blue arrows).

Interestingly enough, IconState.plist keeps track of these apps, too. In the root of the plist file, there is a key “ignored.” Exposing the sub-keys shows the apps that are in the App Library but not shown on the home screen. See the red box in Figure 29.

Both Translate and Warby Parker are seen in the red box in Figure 29. You can also see two more apps, Rocketbook and Sleep Cycle, which are the other two that I have removed from the home screen, but left on the phone.

While it certainly is not the most elaborate or efficient way, App Library could be used to hide apps on iOS from the untrained or unsuspecting eye. If you find yourself having to do a manual review of an iOS device, make sure you check the App Library. Most forensic tools use other artifacts to determine what apps are on an iOS device, but this can certainly be one more location.

Wrap Up

IconState.plist has been used by examiners for a long time to determine what apps were displayed on the iOS Home Screen. However, it can be used to determine what is displayed in Today, and, with the arrival of iOS 14, to determine what apps are still on the phone, but not located on the home screen. This can help examiners reconstruct how the phone looked to a user, which could be very powerful on a report or inside a courtroom.