Magnet Forensics, the company behind the GrayKey iPhone unlocking tool sold to law enforcement agencies, claims it has found a way around the "inactivity reboot" security feature Apple introduced with iOS 18 — a capability that could reopen seized iPhones to forensic extraction.
The claim comes from a promotional video obtained by 404 Media, dated to early 2025 and not previously made public. In it, Magnet presents a new device called GrayKey Preserve and a feature for existing GrayKey units called Evidence Preservation Mode.
WHY THE 72-HOUR TIMER EXISTS
Since iOS 18 — and tightened in iOS 18.1 — an iPhone that has not been unlocked for 72 hours reboots automatically into the "Before First Unlock" state. In that state the data is encrypted with keys that have not yet been loaded into memory, making attacks over the USB-C port far harder. The intent is to protect a device that has been stolen or seized, and 404 Media first revealed the feature in November 2024. Law enforcement complained that the timer often expires while they wait for a court authorization or work through a backlog of devices to unlock.
WHAT MAGNET CLAIMS
According to the video, GrayKey Preserve and Evidence Preservation Mode can delay or defeat the inactivity reboot; preserve the more permissive "After First Unlock" state — the mode that allows USB-C access — "regardless of the reason" for a reboot; and block the automatic deletion of other data, such as cached location data, deleted photos in the device's trash and iMessage messages. The video calls the capability an "absolute gamechanger" for iOS forensics and claims data can be preserved "indefinitely."
HOW IT MIGHT WORK
Technical details are absent. The video indicates GrayKey Preserve enables airplane mode, cutting Bluetooth, Wi-Fi and cellular connections. Jiska Classen, a professor at the Hasso Plattner Institute in Potsdam, suspects Magnet found an undisclosed way to manipulate the iPhone's clock — "stopping time" or at least slowing it — so that Apple's deletion and reboot timers never fire. Users could still foil the approach, she notes, by fully powering the device down before it is seized.
WHAT REMAINS UNVERIFIED
Neither Apple nor Magnet Forensics has commented on the report, and the technical claims have not been independently confirmed. The video's existence was reported by 404 Media on the basis of a company video, and reports of the capability have since circulated widely. The broader point stands regardless: the release, or the revelation of it, renews the long-running arms race between Apple's device security and the forensic tools sold to police and intelligence agencies — and raises fresh questions about what "locked" really means for a seized phone.
