An unusual situation has been reported by Detroit law enforcement regarding iPhones running iOS 18. Devices stored for forensic analysis are mysteriously resetting themselves, significantly complicating the work of police investigators.
An unexplained phenomenon that reinforces security
Authorities have found that iPhones placed in secure storage restart spontaneously within 24 hours of being disconnected from the cellular network. This reboot has the effect of moving the device from an “After First Unlock” (AFU) state to “Before First Unlock” (BFU), making access to data much more difficult for digital forensic tools. To put it simply, the iPhone restarts completely and requires a more complex unlocking since it is a first turn on. This situation blocks unlocking and data extraction systems like Celerite for example.
Experts add:
The specific conditions that must exist for these reboots to occur are unknown, and additional testing and research would need to be conducted to add more detail to this new hurdle we now face. What is known is that this new “feature” of some sort has increased the difficulty of forensically preserving digital evidence.
Even more intriguing, this behavior has been observed even on devices in airplane mode or placed in Faraday cages, supposed to block all communication. Investigators suspect a new security feature introduced with iOS 18, allowing iPhones to communicate with each other to trigger these protective reboots.
An innovation hailed by experts
Matthew Green, a cryptographer and professor at Johns Hopkins University, although skeptical of the hypothesis of communication between devices, welcomes the concept: “The idea of a phone periodically resetting itself after a long period of time without a network is absolutely brilliant”
This situation perfectly illustrates Apple’s position regarding the protection of personal data. Since the 2016 FBI case involving unlocking an iPhone, the company has continued to strengthen the security of its devices, sometimes to the dismay of law enforcement. If this function is intentional, it fits perfectly into this philosophy of maximum protection of user privacy.
