close
close

Association-anemone

Bite-sized brilliance in every update

iPhones stored for forensic analysis reboot causing problems
asane

iPhones stored for forensic analysis reboot causing problems

iPhones stored for forensic analysis started restarting on their own.


iPhones stored for forensic analysis reboot causing problems

Multiple iPhone drives stored for forensic analysis have restarted, prompting concern among law enforcement officials that Apple has a new security feature.

The phones in question had a few things in common, they were all running iOS 18.0 and had been disconnected from cellular networks for some time. They were sent to a forensics lab on October 3, 2024.

Affected devices even included one that was in Airplane Mode and another that was kept in a Faraday cage, which prevents electrical signals from accessing the device. While it’s most likely that the devices started looping or running out of battery, officials believe the reboots were caused by something else entirely.

According to an alleged law enforcement act obtained of 404 Averageofficers suspect that iPhone units may restart due to changes in iOS 18 update. Officials speculate that an iPhone running iOS 18 can send signals that cause nearby units to reboot if the device has been kept disconnected from cellular networks.

…iOS 18.0 iPhones brought into the lab, if conditions were available, communicated with the other iPhones that were booted into the vault in the AFU. That communication sent a signal to the devices to reboot after so much time has passed since the device has been inactive or no network.

According to the leaked document, once an iPhone reboots, it enters the so-called BFU or “before first unlock” state, which is more secure than the AFU or “after first unlock” state. An iPhone that turns on but is never unlocked by anyone is a device in BFU state, while an iPhone unlocked by its owner via the passcode, Touch IDor Make ID it is considered an AFU status device.

Rebooting iPhones and switching from AFU to BFU presents a significant problem for law enforcement officials and forensics teams, as device data cannot be easily accessed after a reboot. This is according to the alleged law enforcement document.

The document referenced in the report was allegedly created by law enforcement officers in the Detroit, Michigan area. It is intended to spread awareness of the problem and provide instructions on how to isolate devices prone to rebooting.

What most likely happened to iPhones that restarted on their own

While the prospect of Apple implementing such a security measure seems interesting at first glance, that’s probably not what happened here.

A silver smartphone with a triple-lens camera setup rests on a brown leather surface.

iPhone 16 Pro and iPhone 16 Pro Max units running iOS 18.0 are prone to random restarts.

In October 2024, several iPhone 16 Pro and iPhone 16 Pro Max users reported their devices restarting for no apparent reason. This is one known issue that occurred during normal use and one that Apple fixed with iOS 18.1 update.

This time frame would also align with the creation of the alleged law enforcement document. Specifically, the document says that three iPhones running iOS 18.0 were brought to a forensics lab on October 3, after which they restarted on their own.

iOS 18.1 was not ISSUED until October 28, meaning the devices could have been affected by the same bug experienced by regular users, assuming at least one of them was an iPhone 16 Pro or iPhone 16 Pro Max.

Matthew Green, a cryptographer and associate professor at Johns Hopkins University, said the assumption in the paper was “deeply suspect” but that he would also be “deeply surprised” if Apple deliberately made iPhones restart after a period of disconnection from the cell phone. networks.

iPhones can also restart if the battery is low or if it’s not working properly. Hardware failures, such as a faulty baseband chip, can also cause devices to reboot indefinitely in some cases. While there are a number of reasons why iPhones may have restarted, a software update causing this seems unlikely.