Recently Apple released iOS 18 with a new feature that causes iPhones to reboot if they have been inactive for 72 hours (3 days). Specifically, if the passcode has not been entered into the device for 72 hours, the phone will reboot, causing the phone to go from an After First Unlock (AFU) state to a Before First Unlock (BFU) state, potentially losing access to crucial user data. This affects all devices that are capable of running iOS 18 including iPhone XR/XS through the newest iPhone 16 series, iPhone SE 2nd and 3rd gen, iPad mini 5th and 6th gen, standard iPad 7th-10th gen, iPad Air 3rd – 5th gen and iPad Pro all versions.
This does not affect phones when the passcode has been confirmed to successfully unlock the device.
This also does not affect phones that have already been powered off.
What can you do to ensure the preservation of the data on these phones?
1) Get the passcode for the device! We understand this is not always an option.
2) Get the proper paperwork completed as soon as you are able.
3) Get the phone to an examiner with access to industry standard tools that have the ability to disable the inactivity timer.
If you submit evidence to DSU for examination but are concerned about shipping times, here are options for you:
~Overnight shipping—the phone can be shipped immediately while you are working on your paperwork then email the paperwork to DSU.
~Deliver the device in-person to DSU.
~Deliver the device to another agency with industry standard tools that have the ability to disable the inactivity timer, then ship to DSU for extraction and analysis.
To determine if an iPhone in an AFU state
To determine if an iPhone in an AFU state is running iOS 18, swipe down from the upper right. (See screenshot below):
~Power symbol in the upper right corner of the screen.
~Plus sign in upper left corner of the screen.
~Round symbols on icons.
~Heart, music and cellular icon on the right side of the screen.
