Lockdown Mode is a sometimes overlooked feature of Apple devices that broadly make them harder to hack. A court record indicates the feature might be effective at stopping third parties unlocking someone's device. At least for now.
Rebooting your phone actually encrypts the device, and it will stay encrypted until the first unlock. But the side button simply disables biometrics. The phone is still unencrypted on the backend, so other workarounds (like some sort of exploit that allows them to bypass the PIN) will allow them to see the phone’s contents.
This is particularly important because cops can image a phone after they seize it, to try and hack later. If they manage to image the unencrypted phone, that whole process is much easier. But if the phone is encrypted when they image it, they’ll basically just get white noise.
Lock down will do things like disable biometrics, but the phone has still been unlocked and is no longer in a fully encrypted state like it is if powered off.
What’s the difference between lockdown and just rebooting your phone (putting it into the first-run state)?
Rebooting your phone actually encrypts the device, and it will stay encrypted until the first unlock. But the side button simply disables biometrics. The phone is still unencrypted on the backend, so other workarounds (like some sort of exploit that allows them to bypass the PIN) will allow them to see the phone’s contents.
This is particularly important because cops can image a phone after they seize it, to try and hack later. If they manage to image the unencrypted phone, that whole process is much easier. But if the phone is encrypted when they image it, they’ll basically just get white noise.
Lock down will do things like disable biometrics, but the phone has still been unlocked and is no longer in a fully encrypted state like it is if powered off.