November 8, 2024 at 12:06PM
Detroit police are alarmed by iPhones in their custody rebooting unexpectedly, complicating digital evidence retrieval. A memo warns that devices switch from an accessible state (AFU) to a restricted state (BFU) after rebooting, making forensics more challenging. The cause, suspected to relate to iOS 18.0, remains unclear.
### Meeting Notes Summary
**Issue:**
– Detroit law enforcement is experiencing issues with iPhones in custody that are rebooting unexpectedly. This problem hinders their ability to search these devices for digital evidence.
**Background:**
– The issue was reported by 404 Media, based on internal documents from Detroit police.
– A memo warns other law enforcement officials to be aware of devices rebooting within 24 hours of being removed from a cellular network.
**Technical Details:**
– The reboot process transitions the device from After First Unlock (AFU) state to Before First Unlock (BFU) state, complicating forensic investigations.
– In BFU state, while some system data may be extracted, access to user-generated data is severely limited.
**Current Understanding:**
– Police do not know why the reboots are happening but suspect it may be linked to a security feature in iOS 18.0.
– Reboots have occurred even in airplane mode and within Faraday boxes, suggesting unexpected communication between devices.
**Recommendations:**
– Labs should isolate any AFU devices not exposed to iOS 18 devices to prevent reboots.
– Conduct an inventory of AFU devices to identify any that have rebooted and lost their AFU state.
**Next Steps:**
– Request further testing and research to understand the reboot phenomenon better.
– Secure additional precautions for handling iPhones in evidence collection.
**Note:**
– Apple has not provided a comment on the situation when contacted by media.