Thinking Apple is done with USB Restricted Mode? Not yet. They have at least one more deus ex machina to shake up the forensic community.

More than a month ago, we made a report iOS 11.4 to Disable USB Port After 7 Days: What It Means for Mobile Forensics. The feature was not included into the final release of iOS 11.4, but returned in a much different shape in iOS 11.4.1 beta (iOS 11.4.1 Beta: USB Restricted Mode Has Arrived). The feature is also part of the first iOS 12 beta introduced a a few days later.

Finally, Apple has officially confirmed the existence of USB Restricted Mode, and the law enforcement community is not happy about it. (Cops Are Predictably Pissed About Apple’s Plan to Turn Off USB Data Access on iPhones). Some sources speculated about LE being able to break into the phones without the warrant.

If that was not enough, Apple added insult to injury. Do you remember the S.O.S. mode we described in New Security Measures in iOS 11 and Their Forensic Implications?

I’ve got good news for you. Or bad news, depending on who you are. In the second beta of 11.4.1 released just days ago, activating the SOS mode enables USB restrictions, too. This feature was not present in the first 11.4.1 beta (and it is not part of any other version of iOS including iOS 12 beta). In all other versions of iOS, the SOS mode just disables Touch/Face ID. The SOS feature in iOS 11.4.1 beta 2 makes your iPhone behave exactly like if you did not unlock it for more than an hour, effectively blocking all USB communications until you unlock the device (with a passcode, as Touch ID/Face ID would be also disabled).