A newly discovered security feature in Apple's iOS 18 operating system automatically reboots inactive iPhones after 72 hours, making it substantially harder to access locked devices. Security researcher Jiska Classen from the Hasso Plattner Institute recently demonstrated this functionality in action.
In a video documentation, Classen showed how an iPhone running iOS 18 automatically restarts after remaining unused for three days, with no warning notifications or user prompts. This feature, introduced quietly by Apple in iOS 18.1, has particularly caught the attention of law enforcement agencies and forensic investigators.
The automatic reboot places iPhones in their most secure state, known as Before First Unlock (BFU). In this condition, user data remains fully encrypted and practically inaccessible. This differs from the After First Unlock (AFU) state, where certain data becomes unencrypted and potentially retrievable using specialized forensic tools.
Law enforcement agencies have reported discovering their evidence phones unexpectedly rebooting while in storage. Forensic tool provider Magnet Graykey has advised law enforcement to extract data from seized devices within the initial 72-hour window before the automatic reboot occurs.
The feature originally debuted in iOS 18 with a 7-day inactivity timer, which Apple subsequently shortened to 72 hours in version 18.1. This development aligns with Apple's established stance on user privacy and security, reminiscent of their previous refusal to assist the FBI in unlocking the iPhone belonging to one of the San Bernardino shooting suspects.
This latest security implementation reinforces Apple's commitment to user privacy, though it creates additional challenges for law enforcement agencies conducting authorized device investigations.