Recent reports indicate that iPhones running iOS 18 are auto-rebooting after a period of disconnection, complicating forensic analysis for law enforcement agencies. Multiple iPhone units in forensic labs have unexpectedly restarted, potentially due to a built-in auto-reboot timer in iOS 18. This feature is reportedly pushing devices into a more secure state, rendering data retrieval significantly harder for forensic experts.
According to an AppleInsider report, the devices were delivered to a Detroit-based forensic lab on October 3, 2024, as detailed in an internal law enforcement memo. Analysts noticed that iPhones running iOS 18, including models like the iPhone 16 Pro and iPhone 16 Pro Max, began rebooting after extended periods without cellular access. Importantly, some of the devices had been placed in Airplane Mode or isolated within Faraday cages to block any external signals. However, this isolation didn’t prevent them from rebooting.
When an iPhone undergoes a reboot, it transitions from an “after first unlock” (AFU) to a “before first unlock” (BFU) state. In AFU mode, law enforcement can access a significant portion of the device's encrypted data through certain lawful extraction techniques. In BFU mode, however, decryption becomes nearly impossible without the user’s passcode, dramatically limiting forensic access. According to experts, the BFU state essentially locks down user data in a way that restricts device and system access to an unprecedented level of security.
iPhones auto-rebooting every four days
Initially, the reboot phenomenon was thought to be a bug exclusive to specific iPhone 16 models running iOS 18.0, as users of these models had also reported spontaneous restarts. However, security experts and privacy advocates, such as those from GrapheneOS, pointed out that iOS 18.1, released on October 28, 2024, includes a structured auto-reboot function.
As confirmed by GrapheneOS, this feature uses a preset timer — allegedly defaulting to four days — which prompts a device reboot if it has been locked and inactive for a given period. While such a mechanism can bolster security by frequently pushing the phone back to BFU mode, the lack of configuration options for users in iOS contrasts with more customizable security-focused systems like GrapheneOS, where users can set the reboot timer from as short as 10 minutes to as long as 72 hours.
@jiska | Mastodon
The possibility that Apple deliberately integrated this feature has stirred controversy. Some experts in the field have voiced skepticism over the timing and implementation of this feature, suggesting it could be a bug or unintended side effect. Others, however, view it as a logical extension of Apple’s commitment to user privacy and device security.
For law enforcement agencies, this feature could lead to significant challenges in data retrieval for investigations. The alleged internal memo suggests that law enforcement might now need to adopt new handling protocols, possibly including routine power source connections and even device firmware downgrades to prevent unexpected reboots.
Leave a Reply