One of the capabilities found in iOS devices is the Shortcuts application. This native application can be used to create shortcuts for different types of functionalities in the system. This article examines the homescreen of an iOS device after a shortcut to open a URL was created using the Shortcut application. The article also addresses artifacts indicating that a shortcut was used to accomplish a particular task in the system. The test shortcut created for this article opens a webpage, https://thisweekin4n6.com, using the Safari browser.
Apple  describes the Shortcuts application as "a quick way to get one or more tasks done with your apps." Meaning that the Shrotcut application allows users to custom-create shortcuts capable of completing specific tasks when users activate them. Users are also able to have sutom names and icons for the shortcuts.
Creating Test Shortcut
As mentioned, a test shortcut was created to open the This Week in 4n6 website, https://thisweekin4n6.com/, in Safari. An iPhone 7 Plus, Model: A1784, running iOS Version 15.7.5 was used during testing. Figures 1 through 3 show the creation of a URL opening shortcut.
Analysis of Homescreen
A full filesystem was acquired from the test device. The acquired image was examined to show the newly created shortcut and any information indicating that the shortcut was activated. The first file analyzed was the /private/var/mobile/Library/SpringBoard/IconState.plist, which shows the icons found on the homescreen of an iOS device. A review of the file did not show the “Test_Shortcut” but it showed a GUID, 41FE26DF37214EBABE491A0AE6C7894D. Table 1 shows a comparison between the list of applications as they appear in IconStat.plist and the icons as they appear on the homescreen. The last entry in the IconStat.plist and the last icon shown in the homescreen is the test shortcut.
Table 1. Comparison between IconStat.plist and the homescreen of the iOS device.
A quick search of the filesystem image for the referenced GUID revealed a directory with the same name was located in /private/var/mobile/Library/WebClips/41FE26DF37214EBABE491A0AE6C7894D.webclip. Figure 4 shows the files found in the referenced directory. The directory contained the following files of interest:
- icon.png: The icon chosen by the user for the shortcut.
- Info.plist: This file contains information about the icon, including the shortcut name, “Test_Shortcut.” Figure 5 shows the contents of the Info.plist file.
Testing the Shortcut
The shortcut was activated in the device to determine whether the system would log activities to indicate that Safari was used when the shortcut was activated in the system. For this task, a timeline was reviewed around the timeframe when the shortcut was activated. The resulting activities indicated that the KnowledgeC database logged an entry related to com.apple.shortcuts.runtime when the shortcut was activated. The following entries from KnowledgeC were related to Safari and a web visit to the This Week In 4n6 website. Figure 6 shows the timeline of events when the Test_Shortcut was activated.
iOS has an application that allows users to create their own shortcuts to automate tasks within the system. These shortcuts would not appear in the IconStat.plist as a shortcut, but they appear as a GUID. This GUID is associated with a directory that contains the icon file assigned to the shortcut and a plist file, Info.plist, that has more information about the shortcut, including its name. When a shortcut is activated in the system, the KnoweldgeC database would log an entry for com.apple.shortcuts.runtime, which indicates that the activity resulted from a shortcut.
 Shortcuts User Guide. https://support.apple.com/guide/shortcuts/welcome/ios