Magnet Forensics, the company behind the GrayKey phone-unlocking tool used by law enforcement, says it can keep seized iPhones in a more accessible forensic state even after Apple’s inactivity reboot, according to a training video obtained by 404 Media.
The video, described as an educational tutorial made for law enforcement and dated early 2025, presents two products: a new device called GrayKey Preserve, and an Evidence Preservation Mode for existing GrayKey hardware. A Magnet employee in the video says both can “capture” an iPhone’s After First Unlock (AFU) state so that it survives a reboot or power loss. “Even if that device does reboot for any number of reasons, memory maintenance or the power is lost or whatever, the AFU state is not lost,” the employee says. “This is the true magic behind the GrayKey Preserve and the Evidence Preservation Mode function.” The same presentation calls the capability “an absolute game changer for iOS forensics.”
Apple added the inactivity reboot in iOS 18 and tightened it in iOS 18.1. If an iPhone is not unlocked for 72 hours, it restarts itself and returns to Before First Unlock (BFU). In BFU, class keys used to decrypt much of the user’s data stay locked inside the Secure Enclave until the passcode is entered again. Forensic tools generally extract far more from a device that is still AFU — unlocked at least once since the last boot — than from one that has rebooted into BFU. Law enforcement complained about the feature soon after it appeared, because seized phones often sit in evidence rooms or queues while agencies wait for a warrant or lab time.
Magnet’s claimed workaround is framed as preservation rather than immediate extraction. GrayKey Preserve is described as a field unit with no brute-force or full extraction capability of its own; its job is to hold the phone’s forensic state until a lab GrayKey can image it. Evidence Preservation Mode on standard GrayKey hardware is presented the same way: gain initial access, freeze the state, and wait for authorization before pulling data. The video also says the tools can stop time-based cleanup that would otherwise drop cached location data, recently deleted photos, and iMessages, and that after the initial connection they cut cellular, Bluetooth, and Wi-Fi so the phone cannot be remotely wiped or updated.
The recording does not explain the technical method. Security researcher Jiska Classen, who previously demonstrated the 72-hour reboot, has speculated that clock manipulation could be involved; that remains an outside hypothesis, not something shown in the video. Apple and Magnet Forensics did not respond to 404 Media’s requests for comment. The claims have not been independently verified in public technical analysis.
MacDailyNews Take: The report is the latest round in a long contest between Apple’s device encryption and commercial forensic tools sold mainly to police. GrayKey has for years been one of the better-known products for unlocking iPhones that are still AFU. Inactivity reboot was designed to shrink the window in which those tools work. If Magnet’s description holds, agencies that can attach a Preserve unit or enable Evidence Preservation Mode before the 72-hour timer fires could keep that window open while they wait on legal process — without the phone falling back to the harder BFU state on its own.
Please help support MacDailyNews — and enjoy subscriber-only articles, comments, chat, and more — by subscribing to our Substack: macdailynews.substack.com. Thank you!
Support MacDailyNews at no extra cost to you by using this link to shop at Amazon.
