Opening the Phone app in the Apple Unified Log (iOS)

Key finding

A tap on the Phone icon produces three SpringBoard entries within three milliseconds. First the tap is allowed for com.apple.mobilephone, then the icon tap is registered (the icon itself is redacted), and then a transition request from HomeScreen starts the launch. I focus on native Apple apps because third-party apps decide for themselves what they log.

It’s Friday again. I’m working through the final to-do’s for my thesis. The end is near, which means long days, plenty of words on paper, and just as many being scrapped again.

So, let’s dive into today’s topic: the standard applications on iOS.

Why didn’t I choose any other applications?

Well, third-party apps can decide what they log in the AUL. With every update, the artefacts may change. That’s why I chose these standard apps, hoping Apple keeps their AUL artifacts consistent.

So let’s dive in!

Phone Application:

Artefact – User interaction: tap on the Phone icon

2025-03-09 14:52:02.178784+0100  localhost SpringBoard[34]: (SpringBoardHome) [com.apple.SpringBoard:Icon] Allowing tap for icon view 'com.apple.mobilephone'

Timestamp: 2025-03-09 14:52:02.178784

Process: SpringBoard

SpringBoard manages the home screen, app launches, and interaction with app icons.

Subsystem: SpringBoardHome

Part of SpringBoard specifically responsible for the home screen and icon display.

EventMessage: (SpringBoardHome) [com.apple.SpringBoard:Icon] Allowing tap for icon view ‘com.apple.mobilephone’

The system allows a tap on the Phone app icon (com.apple.mobilephone). This is a pre-validation of user input.

Artefact – Physical tap registered on app icon

2025-03-09 14:52:02.180390+0100  localhost SpringBoard[34]: (SpringBoardHome) [com.apple.SpringBoard:Icon] Icon tapped: <private>Process: SpringBoard

Timestamp: 2025-03-09 14:52:02.180390

Process: SpringBoard

SpringBoard registers the user’s action on the home screen.

Subsystem: SpringBoardHome

Handles the actual tapping of icons.

EventMessage: (SpringBoardHome) [com.apple.SpringBoard:Icon] Icon tapped:

The user physically tapped an app icon. Although the exact icon is anonymized (), it logically aligns with the previously allowed tap on the Phone app

Artefact – App activation: Phone app launch from home screen

2025-03-09 14:52:02.181496+0100  localhost SpringBoard[34]: (SpringBoard) [com.apple.SpringBoard:Common] Executing request: <SBMainWorkspaceTransitionRequest: 0x30105c280; eventLabel: SBUIApplicationIconLaunchEventLabel; display: Main; source: HomeScreen>Artefact – App activation: Phone app launch from home screen

Timestamp: 2025-03-09 14:52:02.181496

Process: SpringBoard

SpringBoard handles app activations triggered by user interaction.

Subsystem: Common

Includes generic components of SpringBoard responsible for transitions between apps.

EventMessage: (SpringBoard) [com.apple.SpringBoard:Common] Executing request: <SBMainWorkspaceTransitionRequest: … source: HomeScreen>

SpringBoard executes a transition to open a new app from the home screen. This marks the beginning of the Phone app launch.

More to come soon: Mail and Camera.

© 2026 Tim Korver — Thesis Friday. Licensed under CC BY-NC-ND 4.0. Method: Anchored Log Reconstruction (ALR). Commercial or training use requires written permission. See Copyright and Use.