It isn’t even Friday, but I decided to make an early artifact explanation. Today’s topic is about the pattern of the native iOS application with the mail application as a example.

Why the native apps?

Just like I mentioned earlier: third-party applications decide what they log in the Apple Unified Logs (AUL). Their artefacts can change with every update, making them less reliable in a forensic context. Apple’s native apps, on the other hand, tend to have more consistent and structured log behaviour. That’s why I’m focusing on these.

Let’s dive in!

Artefact – User interaction: tap icon mail application

2025-03-09 14:52:24.378566+0100 localhost SpringBoard[34]: (SpringBoardHome) [com.apple.SpringBoard:Icon] Allowing tap for icon view 'com.apple.mobilemail'

Timestamp: 2025-03-09 14:52:24.378566 (UTC +1)

Process: SpringBoard

SpringBoard manages the home screen, app launches, and interaction with app icons.

Subsystem: SpringBoardHome

Part of SpringBoard specifically responsible for the home screen and icon display.

EventMessage: (SpringBoardHome) [com.apple.SpringBoard:Icon] Allowing tap for icon view ‘com.apple.mobilemail’

The system allows a tap on the Phone app icon (com.apple.mobilephone). This is a pre-validation of user input.

Artefact – User interaction: execution mail application

2025-03-09 14:52:24.380765+0100 localhost SpringBoard[34]: (SpringBoard) [com.apple.SpringBoard:Icon] Launching application com.apple.mobilemail from icon , location: SBIconLocationRoot

Timestamp: 2025-03-09 14:52:24.380765 (UTC +1)

Process: SpringBoard

SpringBoard handles app activations triggered by user interaction.

Subsystem: Icon

Handles icon-specific actions and metadata, such as app launches triggered by icon taps.

EventMessage:

(SpringBoard) [com.apple.SpringBoard:Icon] Launching application com.apple.mobilemail from icon <private>, location: SBIconLocationRoot

SpringBoard initiates the launch of the Mail application (com.apple.mobilemail) from the home screen (location: SBIconLocationRoot). Although the icon object is anonymized (<private>), the application bundle identifier unambiguously refers to the native iOS Mail app.

This artefact marks the actual execution of the app launch, directly following the permitted and registered user tap.

Artefact – User interaction: mail application final stage launching

2025-03-09 14:52:24.382405+0100  localhost SpringBoard[34]: (SpringBoard) [com.apple.SpringBoard:TraitsArbiter] [SwitcherOrientation] transition source: HomeScreen

imestamp: 2025-03-09 14:52:24.382405

Process: SpringBoard

SpringBoard coordinates interface transitions and application state changes.

Subsystem: TraitsArbiter

Handles UI and orientation traits for interface transitions between apps or system states.

EventMessage:

[SwitcherOrientation] transition source: HomeScreen

This log entry shows that a transition away from the home screen has been initiated — in this context, due to the launch of the Mail app. The orientation switcher confirms the visual transition, marking the moment the UI starts handing over from the SpringBoard interface to the Mail application.

Interpretation:

This artefact confirms the final stage of launching the Mail app from the home screen. It provides strong support that the transition was not only triggered but also tied to a visual interface handover, which is crucial when proving user interaction and app visibility.

Conclusion

The three artefacts discussed — “Allowing tap”, “Launching application”, and “Transition source: HomeScreen” — together illustrate the typical process of launching a native iOS application from the home screen.

From a forensic perspective, these log entries allow us to reconstruct a user’s interaction with high precision. They move from pre-validation, to confirmed app launch, to a visual interface transition. While each artifact on its own is valuable, it’s their sequence and correlation that provide strong evidence of user intent and action.

In short: this is the Apple Unified Log pattern of a standard application being opened.

More coming soon: artifacts from the Camera app

This work is licensed under the Creative Commons Attribution-ShareAlike 4.0 International License.