iOS 27 and iPadOS 27, currently in beta, add a bootable recovery menu to the iPhone and iPad. Hold the power button while the device starts up and you land in a small pre-boot environment with six options, one of which is the old “connect to computer” recovery mode. This is the same idea Apple silicon Macs have had for years, and it is overdue on the phone.

The feature is aimed at owners whose device hangs at the Apple logo or loops after a failed update. Our interest is different: this is new code that runs on a locked device before the data volume is unlocked, it talks to the network, and it can erase the device. All three matter to us.

How do you get into it?

Here’s the sequence:

1. Unplug the device from any cable. This matters; see below.
2. Power it off and wait until it has actually shut down. Thirty seconds to a minute is enough.
3. Press and hold the side button (top button on iPad). Keep holding past the Apple logo. You will see “Continue holding for recovery…”, then “Loading recovery options…”.
4. Release the button. The recovery screen appears.

The screen shows battery percentage, a globe icon for language, and a power button in the corner that restarts the device normally. It connects to a known Wi-Fi network automatically if one is in range.

If a cable is connected, the device tends to drop into classic recovery mode instead of the new menu. Disconnect first. This is the exact opposite of the iOS 26 procedure, where manually starting Recovery Assistant required the device to be plugged into a computer or a power source, followed by a double press of the side button on the connect-to-computer screen. Apple inverted the trigger.

What is on the menu?

Quite a lot actually, but most of that isn’t new. What is new is the way you get into this menu, not the menu itself.

• Recovery Assistant. Looks for startup and stability problems and tries to fix them. Apple’s own description says it downloads a software package to resolve startup issues and that it requires Wi-Fi.
• Software Update. Installs the latest firmware available for the device without wiping user data. Not present on every device; one tester did not see it on an iPhone 11 running beta 1 or beta 3.
• Diagnostics Mode. Apple’s diagnostics and repair flow, the one introduced in iOS 17. It can ask you to install a configuration profile and send data to Apple. It also displays hardware identifiers, including the serial number and IMEI.
• Erase All Content and Settings. Factory reset, same as the one in Settings.
• Recovery Mode. The classic recovery mode, reached from a menu item instead of a button sequence.
• Nearby Device Recovery. Hidden. Press and hold the power button while on the recovery screen to get it. It restores this device using another Apple device in the vicinity, not the other way round; some localized names read as if it worked in the other direction. It needs iPhone 15 Pro or later, iPhone 16e, iPhone Air, or a recent iPad, and the helper device must run iOS 18 or later and be unlocked.

Nearby Device Recovery is not new in iOS 27. Apple documented it in March 2026 for devices already sitting in recovery mode. What is new is that you can reach it deliberately from a menu.

What changed since iOS 26?

In iOS 26, Recovery Assistant appeared on its own when the device failed to start, and the manual trigger existed but was awkward; see About Recovery Assistant for iPhone and iPad – Apple Support. In iOS 27 the whole environment is a first-class boot target that any user can enter at any time, on a perfectly healthy device, with one button.

That is the entire change, and it is enough to change our threat model. Before, you needed a broken phone. Now you need a phone.

Does it give the examiner anything new?

Short answer: no.

Long answer: the recovery environment does not unlock the data volume, does not expose the file system, and does not weaken Activation Lock. Erase All Content and Settings is reported to require the device passcode, so it is not a path to a clean, resellable handset for someone who found the phone in a taxi. Remote lock and remote erase keep working. Recovery Mode from the menu is the same recovery mode we have always had, with the same BFU restrictions, and DFU still requires the button choreography. Nothing here changes what our tools can extract, and nothing here closes anything either.

The one useful item is Diagnostics Mode, which will read out the serial number and IMEIs of a device you cannot unlock and cannot pair with. That’s it, but it’s been there before; didn’t change much since at least 2020. If the SIM tray is gone, the back of the case is unreadable, and lockdown queries over USB give you nothing without a pairing record, this screen will tell you what the device is. Whether that is worth the effort is a separate question.

What it can destroy

Short version: it’s a full power cycle, which can mean going from AFU into BFU mode.

Long version: getting to this menu requires shutting the device down and booting it, which throws away AFU state and everything that depends on it. The oldest rule in mobile forensics applies without modification: do not reboot the evidence. If the device is already BFU and dead in your hands, the calculus changes, but on a live seizure this menu is off limits.

Worse, the menu contains at least two options that can wipe the device with a couple of taps, and one of them does not announce itself as destructive. Recovery Assistant is presented as the safe first thing to try. In at least one published test on an iPhone 11, the first Recovery Assistant run erased the device completely; the second run on the same phone reported no known issues. I would not treat “Recovery Assistant is non-destructive” as a fact.

Nearby Device Recovery is the other thing. Once you are in it there is no clean exit; you either complete the restore with a second device or force-restart out with the volume up, volume down, hold side button sequence. And the restore flow lets the helper device erase the target.

Put a curious first responder in front of a boot-looping iPhone and this menu is now three seconds away.

Why the Wi-Fi matters

The recovery environment joins known Wi-Fi networks automatically, with no passcode and no user session. It also lets you type a Wi-Fi password manually if there is no cellular connection. In the nearby-device flow, the helper phone shares its own Wi-Fi connection with the device in recovery after a six-digit code exchange.

So a locked device in BFU, with no SIM and no user interaction, can be online in a pre-boot environment. Isolation practice does not change, it just gets one more reason to exist: Faraday bag or shielded room from the moment of seizure, and no ad-hoc network in the lab that the device has ever seen. An unattended device that finds a network and pulls a firmware update out of this screen may move itself to a version your tooling does not support yet, and that is not a hypothetical failure mode with a fall release approaching.

Two small mercies: captive portals and 802.1X networks are not supported for the nearby-device restore, per Apple.

Do not send anything to Apple

Diagnostics Mode offers to transmit diagnostic and log data. Apple documents what Recovery Assistant collects: device metadata such as model, software version, disk size and free space, system stability logs, and recent system activity logs. Apple also states that shared logs include data from before the failure and may contain personal information such as the device serial number and file names.

Sending that from an evidence device is unacceptable on three counts: data leaves your control, the transfer is a modification you have to document, and the account holder may learn that the device is alive. If you use Diagnostics Mode at all, use it to read identifiers off the screen and nothing else. Declining to install the configuration profile is not optional.

Does it help the suspect?

Not much, and that is worth saying plainly, because the first reaction to this feature was that it is a gift to thieves. It is not. The destructive options need the passcode, and a person who has the passcode could always wipe from Settings faster. Nothing here is a new anti-forensic capability.

The genuinely effective anti-forensic move is still the boring one: hold the button and power the phone off. That was true in 2017 and it is true in iOS 27.

New code in front of the lock

For anyone who looks at attack surface rather than casework, this is the interesting part. The recovery environment runs before the user data volume is unlocked and, on a locked device, it now includes a Wi-Fi supplicant, a password entry UI, a network stack talking to Apple servers, an update downloader, and a peer-to-peer pairing protocol with the nearby-device flow. All of that is reachable by anyone holding the phone, without any credential.

Pre-boot components have historically been where the useful bugs live. Might not be the case here, but the reachable-while-locked surface got larger, full stop.

Still a beta

This is beta software; the version I am describing is beta 3 in July 2026, and Apple will change it before the autumn release. Specifically:

• How often Recovery Assistant repairs rather than erases is unknown. The sample of public tests is tiny.
• Published descriptions of Software Update disagree. Some say it downloads firmware over Wi-Fi directly; at least one says it works through a nearby device. It may depend on the model, or it may simply be a beta bug.
• The passcode requirement on Erase All Content and Settings is reported and consistent with the Settings-app behavior, but Apple has not documented it for this screen.
• Whether any of these actions leave a trace in the system logs after a successful boot is worth checking; we have not tested it yet.