close
close

Association-anemone

Bite-sized brilliance in every update

iPhones seized by cops keep rebooting, and no one knows for sure why
asane

iPhones seized by cops keep rebooting, and no one knows for sure why

Detroit cops are spooked by a wave of iPhones in their custody rebooting without warning. The reboot makes it much more difficult for law enforcement to search devices for evidence.

404 The media broke the story based on documents he obtained that appear to be written by police officers in Detroit, Michigan. The documents include a memo describing the problem and warning other law enforcement officials to be on the lookout for the problem.

“The purpose of this notification is to spread awareness of a situation involving iPhones that causes iPhones to restart within a short period of time (observations are possible within 24 hours) when removed from a cellular network,” it said. says the document. “If iPhone was in After First Unlock (AFU) state, the device reverts to Before First Unlock (BFU) state after reboot. This can be very detrimental to the acquisition of digital evidence from devices that are not supported in any state outside of AFU.”

The lock status of an iPhone determines how easy it is for police to use third party tools like Cellebrite to penetrate and root around. When an iPhone turns on after a power loss, it is in BFU and much harder to get into. Cops can still brute force your phone, but it’s harder and the data they can extract is limited.

“The information contained in a BFU extraction mainly includes system data; However, it is possible to find a small amount of user-generated data in the extraction that may provide new leads for certain cases.” an article from the Dakota State University Digital Forensics Lab explained. “This type of extraction is small and most of the information is system/app data as well as cached images and videos that are not user generated.”

In Detroit, police have no idea why the iPhones are restarting, but they suspect it could be a security feature of iOS 18.0. Stranger still, the reboot occurred in phones that were in airplane mode and one that was in a Faraday box that usually blocks outside signals. Police suspect the phones may have been communicating with each other somehow.

“The iOS 18.0 iPhones brought into the lab are believed to have, if conditions existed, communicated with the other iPhones that were booted into the vault in the AFU,” the documents published by 404 Media state. “That communication sent a signal to the devices to restart after so much time has passed since the device has been inactive or no network.”

In one case, police speculated that an investigator’s personal device triggered the other phones to reboot. But they are confused. “The specific conditions that must exist for these restarts to occur are unknown, and further testing and research would need to be done to add more details to the new obstacle we now face. What is known is that this new ‘feature’ of some kind has increased the difficulty of forensically preserving digital evidence,” the documents state.

Police warned other investigators to take precautions. “If a lab’s AFU devices have not been exposed to iOS 18 devices, take steps to isolate those devices before doing so,” the documents state. “Labs should take a running inventory of their AFU devices and identify if any have rebooted and lost their AFU states.”

Apple did not return Gizmodo’s request for comment.