Today, Widgets, & Ignored Apps in iOS

Bob Ross.  Painter.  ASMR Pioneer.  DFIR thought leader?

This week I had what I would consider a “happy accident.” It happened while I was trying to answer a question that someone had asked me about CarPlay. While I was looking around for CarPlay data I found data about Today, the area that resides to the left of the iOS home screen. It is fairly well known that Springboard gives us information about an iOS device’s home screen layout, but it also gives us information about Today’s content and layout, and about “ignored” apps.

For this blog post, I will be skipping the usual pleasantries and getting straight to the forensics. For everything in this post, I used my personal iPhone XS, which was running iOS 14.7.

Widgets & Today’s View

In iOS 14 (not iPadOS 14), Widgets can be placed in Today or on the home screen (no Android jokes please), and can be various sizes. When setting up a new widget, a user picks the size of the widget. See Figures 1, 2, and 3.

Figure 1
Figure 1.  Small widget.
Figure 2.PNG
Figure 2.  Medium widget.
Figure 3.PNG
Figure 3.  Large widget.

Note that all sizes are not available to all apps. For example, Fitness is only available (on my phone, at least) as a small or medium-sized widget.

One the size is chosen, a widget can be placed in Today or somewhere on the home screen, and iOS will arrange the surrounding widgets, apps, or folders to compensate. Figure 4 shows the home screen from my phone, which has one widget, Weather.

Figure 4.jpg
Figure 4.  Weather.  The lone widget on my home screen.

Figure 5 shows my Today, which has a few widgets.

Figure 5
Figure 5.  My Today.

Just below Spotlight, you can see the first widget, which is what Apple calls a Smart Stack. This widget is actually a container for multiple widgets. The contents of a Smart Stack are either automatically generated, or a user can create a custom Smart Stack in much the same way they would create a folder full of apps (press, hold, wiggle, drag & drop). Throughout the day, Smart Stack will show the widget it thinks is most relevant to you based on day/time/location.  Just like other widgets, a Smart Stack can live in Today, or somewhere on the home screen. Figure 6 through 12 show the contents of my Smart Stack (red box).

Figure 6.PNG
Figure 6.  Siri Suggestions.
Figure 7.jpg
Figure 7.  Slideshow.
Figure 8.PNG
Figure 8.  Apple Music.
Figure 9.jpg
Figure 9.  Calendar (from Outlook).
Figure 10.PNG
Figure 10.  Word Press.
Figure 11.PNG
Figure 11.  State Farm Drive Safe & Save.
Figure 12.PNG
Figure 12.  Maps.

Just below the Smart Stack is a widget that shows the battery levels of my phone and AppleWatch, and a separate Calendar widget to the right of it. Just below those, is the News widget and a separate Word Press widget (Figure 13).

Figure 13.PNG
Figure 13.  News and Word Press widgets.

Springboard

As previously mentioned, Springboard is the go-to for determining the layout of an iPhone’s (and iPad’s) home screen, but it also tells us about Today. The file IconState.plist contains the information, and it is available in an encrypted iTunes backup or a full file system extraction. In the former, the file is located in /HomeDomain/Library/Preferences, and in the latter it is located in /private/var/mobile/Library/Springboard/.  Figure 14 shows the root of IconState.plist.

Figure 14
Figure 14.  Root of IconState.plist.

There are two entries we are interested in: “today” (red box) and “iconLists” (blue box). The latter is where the layout of the Home Screen is located, so we’ll start there first since that is were the Weather widget is located. Because I tend to be a bit of a neat-freak, I only have one (1) Home Screen page (everything is in folders), so my lone Home Screen page is represented by “Item 0.” If I had more than one (1) Home Screen page, the second page would be “Item 1,” the next would be “Item 2,” followed by “Item 3” so on and so forth. See Figure 15.

Figure 15.png
Figure 15.  Item 0.  My lone Home screen page.

Back in Figure 4 my Weather widget was to the left of Maps, Passbook, and Calendar. So, my Weather widget is represented here as Item 0 (items are read left-to-right, starting with 0). Figure 16 shows my lone home screen page, and Figure 17 shows Item 0, which is my Weather widget (red box).

Figure 16.png
Figure 16.  Home screen.
Figure 17.png
Figure 17.  Weather widget entry.

In Figure 17, there are three highlighted key/key values. The key in the green box, gridSize, shows the size of the widget (key value = small). The key/key value in the blue box, containerBundleIdentifier, shows the app displaying the information in the widget (key value = com.apple.weather), and the key elementType shows that it is a widget (key value = widget).

Now that we know how the plist key/key values look for widgets, let’s have a look at Today in the plist (blue box in Figure 14). If you recall, I had 5 widgets in my Today (Smart Stack, Battery, Calendar, News, and Word Press). See Figure 18.

Figure 18.png
Figure 18.  Five entries under “today.”

To understand how the layout is done, see Figure 19.

Figure 19.PNG
Figure 19. Item layout in Today.

Widgets in Today are ordered in the plist top-down and left-to-right. So, Smart Stack is Item 0 (red box), Battery is Item 1 (blue box), Calendar is Item 2 (green box), News is Item 3 (purple box), and Word Press is Item 4 (not pictured here but seen in Figure 13).

Expanding Item 0 reveals 7 elements. See Figure 20. Note that the gridSize for this widget is in the red box.

Figure 20.png
Figure 20.  Item 0.  Seven…things.

Since this is a Smart Stack widget, this makes sense since it was the top-most widget. Figure 21 shows the Siri Suggestions (red box), Slide Show (Photos – blue box), Apple Music (green box), and Calendar (I use Outlook for iOS – purple box).

Figure 21.png
Figure 21.  First half of Smart Stack.
Figure 22.png
Figure 22.  Second half of Smart Stack.

Notice that each entry in Figures 21 and 22 have the plist key of elementType with a corresponding value of “widget.”

Item 1 is the battery widget. See Figure 23.

Figure 23.png
Figure 23.  Battery “widget.”

Note that the value for the key gridSize is “small,” but look at the key value for the key elementType. It’s just “battery,” which leads me to speculate this is not a true “widget” as far as iOS is concerned, even though it can be placed anywhere in Today or on the Home Screen. Purely speculation, but interesting nonetheless.

Figure 24 shows the plist entry for the Calendar widget (small widget), Figure 25 shows the plist entry for the News widget (extraLarge widget), and Figure 26 shows the plist entry for the Word Press widget (medium widget). Note that in each figure, the package name is highlighted in the red box, and the widget size is highlighted in the blue box.

Figure 24.png
Figure 24.  Plist entry for Calendar.
Figure 25.png
Figure 25.  Plist entry for News.
Figure 26.png
Figure 26.  Plist entry for Word Press.

A couple of notes about widget size as it relates to the Home Screen. First, I have only observed three sizes of widgets in IconState.plist: small, medium, extraLarge. I have not seen a “large” widget value. That’s not to say that one doesn’t exist, but just that I have not seen one. Second, the size of a widget determines how much space it takes up on the Home Screen (if the widget is placed there). A small widget takes up four (4) spots (think four app icons or four folder icons), a medium widget takes up eight (8) spots, and an extraLarge widget takes up sixteen (16) spots. Understanding the size of the widget can help reconstruct a home screen that has them if and when it is needed.

I’m Not Gonna Be Ignored

Widgets were not the only new thing Apple introduced to the home screen in iOS 14. App Library was also introduced, which is Apple’s attempt to help us de-clutter our home screens without deleting apps from the phone. Using myself as an example, I have a few apps on my phone that I haven’t deleted, but I still need them from time to time. Instead of completely deleting them from my phone, I had the option to merely delete the app from the home screen. Figure 27 shows what this operation looks like.

Figure 27.PNG
Figure 27.  Removing an app from the home screen.

If I were to choose “Remove from Home Screen,” the icon would be removed from view, but the app and all its data would still reside on my iPhone. If I wanted to get to the app, I would swipe as far as I could to the right to get to App Library and find the app in one of the pre-categorized folders. Two of the apps that I have banished from the home screen (but kept on the phone) are Warby Parker and the new iOS Translate app. Figure 28 highlights both apps in the App Libary (blue arrows).

Figure 28.jpg
Figure 28.  Exiled apps.

Interestingly enough, IconState.plist keeps track of these apps, too. In the root of the plist file, there is a key “ignored.” Exposing the sub-keys shows the apps that are in the App Library but not shown on the home screen. See the red box in Figure 29.

Figure 29.png
Figure 29.  Ignored apps in IconState.plist.

Both Translate and Warby Parker are seen in the red box in Figure 29. You can also see two more apps, Rocketbook and Sleep Cycle, which are the other two that I have removed from the home screen, but left on the phone.

While it certainly is not the most elaborate or efficient way, App Library could be used to hide apps on iOS from the untrained or unsuspecting eye. If you find yourself having to do a manual review of an iOS device, make sure you check the App Library. Most forensic tools use other artifacts to determine what apps are on an iOS device, but this can certainly be one more location.

Wrap Up

IconState.plist has been used by examiners for a long time to determine what apps were displayed on the iOS Home Screen. However, it can be used to determine what is displayed in Today, and, with the arrival of iOS 14, to determine what apps are still on the phone, but not located on the home screen. This can help examiners reconstruct how the phone looked to a user, which could be very powerful on a report or inside a courtroom.

One thought on “Today, Widgets, & Ignored Apps in iOS

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s