iOS 11.4.1 Follow-up: Delaying USB Restricted Mode

by Chris Vance, MCFE, Magnet Forensics Manager, Training Curriculum Development

After our previous blog post and webinar talking about some changes that came to iOS 11, some of the examiners here at Magnet Forensics decided to dive in deeper to figure out ways to help delay the one-hour timer that comes along with USB Restricted Mode added in iOS 11.4.1.

As a reminder, to prevent the timer from enabling after one hour, an examiner must connect something to the iOS device BEFORE the timer has reached the end. With any device running iOS 11.4.1, this option is enabled by default. As a result, any phone discovered to be running this version that is left locked for more than one hour will have its USB port disabled for all but power.

Our Test Methodology

To prevent the timer, once an iOS device has been discovered, a “delay dongle” must be connected immediately. There are several on the market that work, and some that we tested that didn’t. In order to successfully work, we:

• Unlocked the device, ensured the mode was active.
• Locked the device.
• Waited several minutes, then connected one of our test devices.
• Waited at least 60 minutes, removed the test device, then connected to a forensic PC.
• Confirmed if “Unlock [DEVICE] to use USB Accessories” popped up on the screen.

Once the delay dongle was removed and the test device was connected to a forensic PC, connection was established by checking the windows registry for information.

Some Caveats: Prices and Functionality

Some of Apple’s official devices worked, while some didn’t. Because of these devices’ price point—ranging from US$39-49 apiece—they’re not very economical for in-field deployment, so it won’t be common for agencies to send a multitude of them out in the field.

Of the 3^rd party devices we tested, however, some were as low as only 6.99 USD a piece. While still not incredibly cheap for mass deployment, it’s a more appetizing price.

Should agencies buy these devices en masse and start tossing them out? It’ll depend on several factors like the agency and their policies. Anyone who is planning on seizing an iOS device should at least have the knowledge to be prepared.

As a very price-conscious option, remember that iOS devices can be connected to a Windows PC (with or without iTunes) in order to also delay that one-hour window. The only problem here is that maintaining Faraday isolation will be a lot more difficult. Proper Faraday isolation must still be followed in the field. Once the delay has been achieved, the mode will be delayed for seven days.

Our Test Results

In order to see our examiners’ successes and failures using purchased devices, we have prepared a list along with purchasing links to the products and whether or not they were successful, as well as if they could also allow the examiner to provide power during the delay period.

*These were the URLs at time of testing. Due to stock and the nature of counterfeit devices, some products may be unavailable, or links may not work. We recommend searching on product names if you find this is the case.
**At the time of this writing. Prices are subject to change.

A big thanks also go out to Director of Forensics Jessica Hyde and Director of Training Operations Jamey Tubbs for testing help on this project. As with any device, before in-field deployment it’s best to test it yourself, but hopefully this information can give examiners a good place to start.

Have you tested a device that we haven’t listed? A community version of the spreadsheet is located here if you would like to add another adapter.