⚙️ 🆕 Apple's new iOS 18.1 introduces a security feature that reboots the phone if it hasn't been unlocked for 72 hours. This feature is called the "Inactivity Reboot" and is implemented in keybagd and the AppleSEPKeyStore kernel extension.

The feature makes it more difficult for thieves, law enforcement, and forensic experts to extract data from iPhones.

The Inactivity Reboot effectively places iPhones in a more secure state called "Before First Unlock" (BFU) by locking the user’s encryption keys in the iPhone’s secure enclave chip.

Even if thieves leave your iPhone powered on for an extended period, they won’t be able to unlock it using outdated, less sophisticated forensic tools.

While the Inactivity Reboot makes it more challenging for law enforcement to extract data from devices belonging to criminals, it does not lock them out completely.

In iOS 18.2, users are now also prompted to enable Stolen Device Protection, a feature that was previously hidden deep in the Settings menu. This feature prevents thieves from accessing your phone and accounts using only the PIN by frequently prompting for biometric authentication.

iPhones have two different states that affect the ability of law enforcement, forensic experts, or hackers to unlock them by brute-forcing the passcode or extracting data by exploiting software vulnerabilities. These states are “Before First Unlock” (BFU) and “After First Unlock” (AFU).

When the iPhone is in the BFU state, the user's data is fully encrypted and nearly impossible to access unless the person trying to unlock it knows the passcode. In contrast, in the AFU state, certain data is unencrypted and may be more vulnerable to extraction by some forensic tools, even if the phone is locked.

The iPhones in these two states are also referred to as “hot” and “cold” devices. Many forensic companies focus on “hot” devices in the AFU state because, at some point, the user has entered their correct passcode, which is stored in the memory of the iPhone’s secure enclave. By contrast, “cold” devices are more difficult to compromise, as their memory cannot be easily extracted once the phone has restarted.

A video by Jiska, a security researcher, demonstrates how this new feature works.

Here is the law enforcement document obtained by 404 media house . It says that a bunch of iPhones were in an AFU state (easier to get data from). Then a bunch of them rebooted into a BFU state (much harder if not then impossible to get data from as per them)
This even applied to phones that were in Airplane mode, and even one in a faraday box.