Also 20 hours should give you enough time to track down a device using Find My iPhone (or similar service) before they can unlock it and shut tracking down.
Couldn't you just put this whole operation in a faraday cage to bypass that?
9!/5! + 9!/4! + 9!/3! + 9!/2! + 9!/1! + 9!/0!
Which is just 985,824. And you could certainly search the more likely combinations first -- people almost always select adjacent spots consecutively.
Consider the "spots" labeled in rows from left to right as 1 2 3, 4 5 6, and 7 8 9.
If I start at 1, I can go to 2, 4, 5, 6, and 8 directly. Also, if I have used all spots except 1 and 9, I can go to 1 then directly to 9.
123
456
789
With that in mind, I wrote a quick search:
Adjacent only (can't go from 1 to 6 or 8)
1 9
2 40
3 160
4 496
5 1208
6 2240
7 2984
8 2384
9 784
total: 10305
total with length >= 4: 10096
Non-adjacent (knight-moves) allowed (can go from 1 to 6 or 8)
1 9
2 56
3 304
4 1400
5 5328
6 16032
7 35328
8 49536
9 32256
total: 140249
total with length >= 4: 139880
Pass through previous spots, no immediate backtracking (2513 but not 213)
1 9
2 56
3 304
4 1464
5 6136
6 21344
7 57184
8 105376
9 100928
total: 292801
total with length >= 4: 292432
Pass through previous spots, with immediate backtracking allowed (213)
1 9
2 56
3 320
4 1624
5 7152
6 26016
7 72912
8 140704
9 140704
total: 389497
total with length >= 4: 389112
More importantly, though, if you're using an unlock pattern, you can't be using disk encryption, so anyone who has physical possession of your phone need not bother brute-forcing the unlock pattern.