Apple’s New Security Feature: iPhones Now Auto-Restart After 72 Hours

Apple has introduced a new feature in iOS 18 that automatically restarts an iPhone if it remains inactive and locked for 72 hours, cybersecurity researchers have reported.

Recently, law enforcement officials and digital forensics experts encountered a puzzling issue where iPhones mysteriously rebooted, complicating data access on the devices. It was later revealed that the auto-restart function in iOS 18 activates after a specific period of inactivity.

Researcher Yiska Klassen recently shared a video demonstrating the feature in action. In the footage, the iPhone automatically restarts after remaining locked and unused for 72 hours.

Further confirmation came from Magnet Forensics, a company specializing in forensic tools for extracting data from iPhones and Android devices, such as GrayKey. The company confirmed that the timer for the automatic restart is indeed set to 72 hours.

According to Klassen, this new feature enhances device security by locking encryption keys within the Secure Enclave chip. This makes it more challenging to use outdated tools to access data, even if attackers keep the device powered on. However, Klassen noted that the 72-hour window provides sufficient time for forensic experts to take swift, coordinated action to access data.

The security of an iPhone depends on two states: Before First Unlock (BFU) and After First Unlock (AFU). In BFU mode, all data on the iPhone is fully encrypted, and access is possible only with the device’s passcode. In AFU mode, certain data remains unencrypted, which can simplify extraction using forensic tools, even if the phone is locked.

Researcher Tihmstar highlighted that iPhones in BFU state are referred to as “cold,” while those in AFU state are described as “hot.” Digital forensic companies tend to focus on “hot” devices because they contain data unlocked during a user’s previous session. In contrast, “cold” devices are far more difficult to breach, as their memory becomes virtually inaccessible following a restart.

Apple has declined to comment on this feature.

It is worth noting that in April 2024, Cellebrite, a leading mobile forensics company, encountered difficulties as many modern iPhones became impervious to their hacking tools.

With the release of iOS 18, Apple has taken yet another step toward combating the market for salvaged parts from stolen devices. The activation lock feature now extends beyond the iPhone itself to its core components, such as the battery, cameras, and display. This enhancement aims to prevent the resale of stolen parts and provides users with an added layer of protection.