iOS 11.4, currently in beta, includes a USB Restricted Mode that will prevent devices from being used with a Mac or PC after 7 days of the device not being unlocked.
In the iOS 11.4 Beta, Apple introduced a new called USB Restricted Mode. In fact, the feature made its first appearance in the iOS 11.3 Beta, but was later removed from the final release. This is how it works:
“To improve security, for a locked iOS device to communicate with USB accessories you must connect an accessory via lightning connector to the device while unlocked – or enter your device passcode while connected – at least once a week.”
If the device hasn’t been unlocked in a week’s time via either Touch ID, Face ID, or a passcode, the Lightning port on the device will be restricted to charging mode. This could help prevent the device from being unlocked by devices such as GrayKey’s device.
Restricted USB Mode requires an iPhone running 11.3 to be unlocked at least once every 7 days. Otherwise, the Lightning port will lock down to charge only mode. The iPhone or iPad will still charge, but it will no longer attempt to establish a data connection. Even the “Trust this computer?” prompt will not be displayed once the device is connected to the computer, and any existing lockdown records (iTunes pairing records) will not be honoured until the user unlocks the device with a passcode.
In other words, law enforcement will have at most 7 days from the time the device was last unlocked to perform the extraction using any known forensic techniques, be it logical acquisition or passcode recovery via GreyKey or other services . Even the 7 days are not a given, since the exact date and time the device was last unlocked may not be known.
As iOS 11.4 is still in beta, the USB Restricted Mode may not make the cut to the release version.
For more information about the new mode, visit the Elcomsoft website.