Magnet Forensics claims GrayKey tools defeat iPhone's inactivity reboot protection

What the leaked video shows

A training video obtained by 404 Media indicates that Magnet Forensics, the company behind the GrayKey extraction device, believes it has found a way around one of Apple's newer iPhone protections. The video, apparently produced in early 2025 for law enforcement audiences and leaked by a person who was not authorized to share it, describes two additions to the company's lineup: a device called GrayKey Preserve and a feature for existing GrayKey hardware named Evidence Preservation Mode.

The target is iOS's inactivity reboot. As 404 Media reported in November 2024, Apple quietly added a mechanism that restarts an iPhone if it has not been unlocked for 72 hours. The restart moves the handset into a hardened state that is far harder for forensic tools to crack, and it frustrated investigators who often cannot attempt an unlock immediately because they are waiting on a warrant or working through a backlog of seized devices.

In the video, a Magnet employee describes the new capability as "an absolute game changer for iOS forensics" and says it was built specifically to counter the inactivity reboot and the data it puts out of reach.

Freezing the clock, and the data

The video does not explain the technical details, but it offers hints. During what the employee calls initial access, the tool places the iPhone into a preserved state by disabling its radios — Bluetooth, Wi-Fi and cellular — even when iOS itself would not allow those transmitters to be switched off from the Control Center. The stated purpose is to keep data on the device and isolate it from the network while it sits in storage.

The tools also take aim at a separate iOS behavior that purges certain information, such as cached location data, recently deleted photos and iMessages, after a set number of days. The employee claims the new products can hold onto that data indefinitely.

The central objective is keeping a seized phone in the After First Unlock, or AFU, state. In AFU, an iPhone has been unlocked at least once since boot and the keys protecting much of its data remain available in memory. In Before First Unlock, that data stays encrypted, and brute-forcing the passcode can be significantly harder — sometimes effectively impossible. 404 Media has previously reported on which iPhone models GrayKey and its competitor Cellebrite can access, with clear differences between AFU and BFU devices. According to the employee, the AFU state is "captured" by the new mode and survives reboots triggered by memory maintenance or power loss.

Agents running the preservation mode reportedly see only the phone's model and software version, not its contents, which Magnet frames as a way to secure evidence without examining it before legal authorization exists.

An informed guess at the mechanism

404 Media shared a transcript of the video with Jiska Classen, a researcher at the Hasso Plattner Institute who studies iPhone security. She cautioned that the footage alone cannot confirm how the feature works, but suggested Magnet may be manipulating the iPhone's clock — effectively slowing or halting the passage of time for the device, even across a reboot — or disabling the iOS maintenance tasks responsible for expiring data. Either way, she agreed the development is "quite a game changer," or at minimum returns the situation to what existed before Apple shipped the inactivity reboot.

Apple and Magnet Forensics did not respond to requests for comment, according to 404 Media.

Why it matters

Apple's 72-hour reboot was one of the more consequential privacy improvements for iPhones in police custody, precisely because it worked automatically and required nothing from the user. If Magnet's claims hold up, that protection can now be suspended at the moment of seizure and the phone held in its weaker AFU state for as long as investigators like. The stakes extend beyond ordinary criminal cases: as 404 Media notes, tools of this class have also reached authorities in authoritarian countries. The timeline is also telling — the feature became public in late 2024 and a commercial countermeasure appears in vendor training material from early 2025, illustrating how quickly software defenses erode against well-funded opponents. As 404 Media observes, the next move belongs to Apple, which must work out how the freeze is achieved and whether it can be blocked. Until then, the security of a seized iPhone depends on how fast that cat-and-mouse cycle turns.