iPhones stored for forensic analysis unexpectedly reboot, causing problems for police

Multiple iPhone units stored for forensic analysis have rebooted themselves, causing concern among law enforcement officials that Apple has a new security feature.

The phones in question had a few things in common, they were all running iOS 18.0, and they had been disconnected from cellular networks for some time. They were sent into a forensics lab on October 3, 2024.

The affected devices even included one that was in Airplane Mode and another that was kept in a Faraday cage, which prevents electrical signals from accessing the device. While it's most likely that the devices began boot-looping or that they ran low on battery, officials believe the restarts were caused by something else entirely.

According to an alleged law enforcement document obtained by 404 Media, officers suspect that the iPhone units might be restarting themselves because of changes in the iOS 18 update. The officials hypothesize that an iPhone running iOS 18 can send signals that make nearby units reboot if the device has been kept disconnected from cellular networks.

...iPhone devices with iOS 18.0 brought into the lab, if conditions were available, communicated with the other iPhone devices that were powered on in the vault in AFU. That communication sent a signal to devices to reboot after so much time had transpired since device activity or being off network.

According to the leaked document, once an iPhone restarts, it enters the so-called BFU or "before first unlock state," which is more secure than the AFU or "after first unlock" state. An iPhone that boots up but is never unlocked by anyone is a BFU-state device, while an iPhone unlocked by its owner via passcode, Touch ID, or Face ID is considered an AFU-state device.

iPhones rebooting and switching from AFU to BFU presents a significant problem for law enforcement officials and forensics teams, as the device data cannot be accessed easily after a restart. This is according to the supposed law enforcement document.

The document referenced in the report was allegedly created by law enforcement officers in the Detroit, Michigan area. It is intended to spread awareness of the issue and offer instructions on how to isolate the reboot-prone devices.

What most likely happened with the iPhones that rebooted themselves

Though the prospect of Apple implementing such a security measure seems interesting at first glance, it's also probably not what happened here.

iPhone 16 Pro and iPhone 16 Pro Max units running iOS 18.0 are prone to random reboots.

In October of 2024, multiple users of iPhone 16 Pro and iPhone 16 Pro Max units reported that their devices kept restarting themselves for no apparent reason. This is a known issue that occurred during normal use and one that Apple fixed with the iOS 18.1 update.

This timeframe would also align with the creation of the alleged law enforcement document. Specifically, the document says that three iPhones with iOS 18.0 were brought into a forensics lab on October 3, after which they rebooted themselves.

iOS 18.1 was not released until October 28, meaning that the devices could have been affected by the same bug experienced by everyday users, assuming at least one of them was an iPhone 16 Pro or iPhone 16 Pro Max.

Matthew Green, a cryptographer and associate professor at Johns Hopkins University, said that the hypothesis from the document was "deeply suspect," but that he would also be "deeply amazed" if Apple deliberately made iPhones reboot after a period of being disconnected from cellular networks.

iPhones can also reboot if the battery is drained or if it isn't working properly. Hardware malfunctions, such as a defective baseband chip, can also cause devices to reboot indefinitely in some instances. While there are multiple reasons as to why the iPhones may have rebooted, a software update causing this seems unlikely.