Once the user activates the SOS mode, the following things happen:
Biometric identification (Touch ID/Face ID) is disabled and the user has to use screen lock code to unlock screen.
USB Restricted Mode is enabled, disabling data transmission over the USB port. If the iPhone is then connected to a computer, the computer will not recognize the device.
There's no current way to force iPhone back to Before First Unlock (BFU) state once the device is already in After First Unlock (AFU) state. However, iOS does evict one set of keys from memory whenever the screen is locked again regardless of SOS mode.
The set of keys that are evicted from memory on screen relock belongs to Complete Protection class of Data Protection API. There are 4 Data Protection Clasess in iOS:
Complete Protection (CP): Encryption keys for this data are evicted shortly after device lock (10 seconds).
Protected Unless Open (PUO): Using public-key encryption, PUO allows data files to be created and encrypted while the device is locked, but only decrypted when the device is unlocked, by keeping an ephemeral public key in memory but evicting the private key at device lock. Once the file has been created and closed, data in this class has properties similar to Complete Protection.
Protected Until First User Authentication (a.k.a. After First Unlock) (AFU): Encryption keys are decrypted into memory when the user first enters the device passcode, and remain in memory even if the device is locked.
No Protection (NP): Encryption keys are encrypted by the hardware UID keys only, not the user passcode, when the device is off. These keys are always available in memory when the device is on.
Only the data that is encrypted by CP is safe at locked screen. CP is a recommended protection but to maintain user experience and to keep user's important apps functional at locked screen, it is not strictly enforced by the app developers and apple itself. Calendar (excluding attachments), Contacts, Reminders, Notes, Messages and Photos are protected by Protected Until First User Authentication class and this is the data law enforcement agencies are interested in.
Spyware agencies have custom tools that can physically extract data from memory without disconnecting the battery. They may not need specific AFU vulnerabilities to extract keys, though it makes the job easier. Android also has SOS like mode called lockdown mode which is opt-in and it is no different. Android doesn't evict keys at locked screen which makes it more susceptible to keys extraction and data decryption.
I asked the author about partial AFU, he said:
I was trying to figure this out too but haven’t gotten anywhere. Current thinking is that it refers to the amount of data they could get, so assuming there’s another form of partial AFU access that allows for a larger extraction.
As far as I know, partial AFU is not a thing. The device can be either in BFU or in AFU. No intermediate state can exist because the change in state is bound to user authentication.
BFU: The device has not been unlocked since last reboot.
AFU: The device has been unlocked once since last reboot.
Android Pie Lockdown Option: a Match for iOS SOS Mode?
How police are breaking phone encryption
Data Security on Mobile Devices: Current State of the Art, Open Problems, and Proposed Solutions
