iPhones stored for forensic analysis unexpectedly reboot, causing problems for police

AppleInsider

Multiple iPhone units stored for forensic analysis have rebooted themselves, causing concern among law enforcement officials that Apple has a new security feature.

iPhones stored for forensic analysis have reportedly begun rebooting themselves.

The phones in question had a few things in common, they were all running iOS 18.0, and they had been disconnected from cellular networks for some time. They were sent into a forensics lab on October 3, 2024.

The affected devices even included one that was in Airplane Mode and another that was kept in a Faraday cage, which prevents electrical signals from accessing the device. While it's most likely that the devices began boot-looping or that they ran low on battery, officials believe the restarts were caused by something else entirely.

According to an alleged law enforcement document obtained by 404 Media, officers suspect that the iPhone units might be restarting themselves because of changes in the iOS 18 update. The officials hypothesize that an iPhone running iOS 18 can send signals that make nearby units reboot if the device has been kept disconnected from cellular networks.

...iPhone devices with iOS 18.0 brought into the lab, if conditions were available, communicated with the other iPhone devices that were powered on in the vault in AFU. That communication sent a signal to devices to reboot after so much time had transpired since device activity or being off network.

According to the leaked document, once an iPhone restarts, it enters the so-called BFU or "before first unlock state," which is more secure than the AFU or "after first unlock" state. An iPhone that boots up but is never unlocked by anyone is a BFU-state device, while an iPhone unlocked by its owner via passcode, Touch ID, or Face ID is considered an AFU-state device.

iPhones rebooting and switching from AFU to BFU presents a significant problem for law enforcement officials and forensics teams, as the device data cannot be accessed easily after a restart. This is according to the supposed law enforcement document.

The document referenced in the report was allegedly created by law enforcement officers in the Detroit, Michigan area. It is intended to spread awareness of the issue and offer instructions on how to isolate the reboot-prone devices.

What most likely happened with the iPhones that rebooted themselves

Though the prospect of Apple implementing such a security measure seems interesting at first glance, it's also probably not what happened here.

iPhone 16 Pro and iPhone 16 Pro Max units running iOS 18.0 are prone to random reboots.

In October of 2024, multiple users of iPhone 16 Pro and iPhone 16 Pro Max units reported that their devices kept restarting themselves for no apparent reason. This is a known issue that occurred during normal use and one that Apple fixed with the iOS 18.1 update.

This timeframe would also align with the creation of the alleged law enforcement document. Specifically, the document says that three iPhones with iOS 18.0 were brought into a forensics lab on October 3, after which they rebooted themselves.

iOS 18.1 was not released until October 28, meaning that the devices could have been affected by the same bug experienced by everyday users, assuming at least one of them was an iPhone 16 Pro or iPhone 16 Pro Max.

Matthew Green, a cryptographer and associate professor at Johns Hopkins University, said that the hypothesis from the document was "deeply suspect," but that he would also be "deeply amazed" if Apple deliberately made iPhones reboot after a period of being disconnected from cellular networks.

iPhones can also reboot if the battery is drained or if it isn't working properly. Hardware malfunctions, such as a defective baseband chip, can also cause devices to reboot indefinitely in some instances. While there are multiple reasons as to why the iPhones may have rebooted, a software update causing this seems unlikely.







Read on AppleInsider

DAalseth

Police make a mistake and try to blame somebody else, News at 11. 

ashsaturday

Well I never restart my iPhone, from time to time it requires me to put in my pin code, as though the device has restarted at some point during a long period of an activity. Note that this happens at other times, other than overnight, I tend to use sleep monitoring software that runs tasks overnight so the phone never restarts at that point, it finds another point during the day to do. It’s internal updates. I’ve rarely if ever seeing the iPhone crash restart, I have pushed the limits of it before and sometimes it nearly locks up, but that is an unruly app normally, this is an older SE 2020 model.

aross99

...iPhone devices with iOS 18.0 brought into the lab, if conditions were available, communicated with the other iPhone devices that were powered on in the vault in AFU. That communication sent a signal to devices to reboot after so much time had transpired since device activity or being off network.

How exactly would the phones brought into the lab communicate with the phone in Airplane mode, or especially the one in the faraday cage?

Far more likely that that version of iOS 18 has a bug that causes a reboot - especially in unusual conditions like a long time without network connectivity.

citpeks

aross99 said:

How exactly would the phones brought into the lab communicate with the phone in Airplane mode, or especially the one in the faraday cage?

Not hard to dismiss the theory when they include tidbits like that undermine the whole premise.  Or maybe, Apple has secretly found a way to violate the laws of physics.

Oh, wait -- I know -- Walter White lives, and is still driving around in a van with a junkyard magnet, wreaking havoc on police evidence storage rooms.

Does the original story out the masterminds or agency that authored this document?  It's behind a paywall.

Bel.Air

ashsaturday said:

Well I never restart my iPhone,

Call me old fashioned but I've actually been restarting my iPhone quite regularly (say monthly) and find it quite beneficial, definitely much better than force quitting apps (which I see people doing obsessively  ALL the time, even on brand new 16 Pros). Of course those that crash I do force quit, but on a case by case basis.

It's incredible how stable and reliable iOS has been since its inception, especially compared to the software landscape that came before it. Even more impressive is how this is still the case even as the system has become so more complex and feature packed.

And amazingly (compared to Windows, Samsung and the Chinese offerings) there is still zero sense of bloat, what a blessing (I mean, we get what we pay for I guess).

eriamjh

Didn’t know the iphone is harder to hack if it’s been restarted and not unlocked after a reboot compared to just locked after being used generally.  

I’m guessing that none of the phones have know unlock codes.  

Unless cops are uninformed, I would expect standard phone practice to be to plug any evidence phones into chargers to prevent battery drain, but what do I know?

retrogusto

Maybe Apple should add a security feature that automatically reboots the phone if it isn’t unlocked at least once in 24 hours. 

beltsbear

The author of this story should not have allowed the comments about how this could happen without stating the impossibility of some of them.  If the phone is in a faraday cage or on airplane mode, it is not communicating with phones nearby.  IOS does not have a mesh mode either for anything other than the findmy feature.  And they mention the possibility of running out of power?  Then that is probably what happened.  Someone screwed up in the evidence room.  A charger block was probably an amazon special and broke most likely.  

mike1

Bel.Air said:

ashsaturday said:

Well I never restart my iPhone,

Call me old fashioned but I've actually been restarting my iPhone quite regularly (say monthly) and find it quite beneficial, definitely much better than force quitting apps (which I see people doing obsessively  ALL the time, even on brand new 16 Pros). Of course those that crash I do force quit, but on a case by case basis.

I force quit apps regularly because it makes it easier to switch between the apps that I am actually using on a regular basis.

hmlongco

What's probably happening is the new feature that Apple added that allows boxed phones to attempt to update themselves to current versions of iOS. I believe that feature was called "Presto," 

Would still be a bug though, since it probably shouldn't be doing that with activated hardware.

MplsP

So now the police are propagating conspiracy theories, too? And just how is a phone in a faraday cage supposed to communicate with other phones to reboot?  Apple has historically prioritized security and privacy but they don't actively obstruct law enforcement and readily comply with subpoenas and requests when technically able to do so. Postulating that Apple is sending remote reboot requests to thwart law enforcement is reaching trumpian levels of delusion.

danox

Call 1 (800) Cellebrite…..  

dewme

It's not a feature, it's a bug.

appleinsideruser

aross99 said:

How exactly would the phones brought into the lab communicate with the phone in Airplane mode, or especially the one in the faraday cage?

beltsbear said:

If the phone is in a faraday cage or on airplane mode, it is not communicating with phones nearby.  IOS does not have a mesh mode either for anything other than the findmy feature.   

Airplane mode doesn’t disable all the radios — just cellular. GPS still works on a plane. WiFi still works in airplane mode, as does Bluetooth. 

appleinsideruser

I use a shortcut to activate airplane mode when my phone connects to WiFi at a regular location I visit. This location has bad cellular service, so this trick stops my battery from draining quickly. Everything still works normally, as WiFi calling takes care of phone calls and WiFi sorts everything else. Bluetooth still works for triggering Airdrop.

A second shortcut turns off airplane mode when my phone disconnects from that location’s WiFi.

retrogusto

appleinsideruser said:

Airplane mode doesn’t disable all the radios — just cellular. GPS still works on a plane. WiFi still works in airplane mode, as does Bluetooth. 

For many years I have been using Airplane Mode overnight to make sure that I’m not disturbed by any calls, texts or notifications. I know that now there are other ways to solve that problem, but I haven’t bothered switching because I don’t see the need. But it does look like my WiFi disconnects (the WiFi icon goes gray with a slash through it), and if it didn’t, wouldn’t I still get messages from iMessage, WhatsApp and Signal? Maybe if you toggle WiFi on in Airplane Mode, it remembers that you want it left on when you reactivate the mode subsequently?

dewme

I was wrong, it’s not a bug, it’s a feature! For once, the universal excuse is correct. I like it. 

appleinsideruser

retrogusto said:

appleinsideruser said:

Airplane mode doesn’t disable all the radios — just cellular. GPS still works on a plane. WiFi still works in airplane mode, as does Bluetooth. 

For many years I have been using Airplane Mode overnight to make sure that I’m not disturbed by any calls, texts or notifications. I know that now there are other ways to solve that problem, but I haven’t bothered switching because I don’t see the need. But it does look like my WiFi disconnects (the WiFi icon goes gray with a slash through it), and if it didn’t, wouldn’t I still get messages from iMessage, WhatsApp and Signal? Maybe if you toggle WiFi on in Airplane Mode, it remembers that you want it left on when you reactivate the mode subsequently?

Yes, you’re quite right! It works that way for me because I’d previously turned wifi back on whilst in Airplane mode and the device respects that next time you use airplane mode. See https://support.apple.com/en-us/108785

But I discovered GPS works on a plane when I noticed a photo was tagged with an accurate location.

eriamjh

Airplane mode doesn’t block GPS because GPS data isn’t transmitted by the phone, it’s received and interpreted by the phone.   The are everywhere and come from satellites from outer space, but I’m sure everyone already knew that.   

puiz666

Not that AppleInsider or other media will be around for long with the advent of generative AI, but things that could slow down your inevitable demise are things like making sense, and trying to understand what's going on and then explaining it properly to your readers.

For instance, is it a period of inactivity, or other iPhones magically talking to each other (even in Airplane mode somehow) that supposedly triggers the reboot?