The apparent target here are unlocking tools of the varieties offered by companies like GrayShift and Cellebrite, which have been used by law enforcement to access locked and encrypted devices. According to Elcomsoft, the most recent 11.4 beta beefed up the Restricted Mode even more, because once it kicks in, the device does not communicate or transfer data over USB at all. iTunes cannot see it and the device will only charge until it is unlocked with the owner's passcode.

Their research notes a possible workaround. By connecting the phone or tablet to a trusted device within an hour of the last time it was unlocked and keeping it connected, they can extend the start of the one hour window indefinitely.