The company behind GrayKey, a tool used by law enforcement to unlock phones, says it has found a way to bypass Apple's iPhone inactivity reboot feature. According to a leaked video obtained by 404 Media, Magnet Forensics has developed a new device called GrayKey Preserve and an Evidence Preservation Mode for its existing GrayKey hardware.
The video, described as an educational tutorial made exclusively for law enforcement agents and dated early 2025, claims the technology can capture an iPhone's After First Unlock (AFU) state and preserve it even if the device reboots. This would defeat a security feature Apple introduced in iOS 18.1 nearly two years ago, which forces a reboot after 72 hours of inactivity to return the iPhone to a more encrypted Before First Unlock (BFU) state.
How the GrayKey workaround works
When an iPhone is in BFU state, sensitive data remains protected by encryption keys that only become available after the user enters their passcode for the first time, switching the device to AFU. Apple's inactivity reboot was designed to automatically return a seized phone to BFU before investigators could access it, buying time for warrants or lab transport.
In the leaked video, a Magnet employee explains that GrayKey Preserve and Evidence Preservation Mode capture the AFU state so that it is not lost even if the device reboots, loses power, or undergoes memory maintenance. 'This is the true magic behind the GrayKey Preserve and the Evidence Preservation Mode function,' the employee says. The video does not detail the technical mechanism behind the workaround.
What Apple and security researchers say
Neither Apple nor Magnet Forensics responded to requests for comment from 404 Media. The report also consulted iPhone security researcher Jiska Classen, who suggested Magnet may have found a way to manipulate the iPhone's clock or to disable the processes responsible for expiring certain data altogether.
