A phone hacking company claims to have developed a tool that circumvents Apple’s inactivity reboot feature, according to a video obtained by 404 Media.
In November 2024, Apple introduced an automatic reboot function in iOS that restarts iPhones that have not been unlocked for 72 hours. According to 404 Media’s reporting, the feature is designed to make it harder for police and forensics tools to access data on locked devices.
Law enforcement expressed concern about this security measure because they often cannot immediately attempt to unlock seized iPhones—sometimes due to pending court authorization or backlogs in processing devices.
Magnet Forensics, the company behind GrayKey (a tool sold to law enforcement agencies for unlocking iPhones and Android phones), has developed a solution called GrayKey Preserve and a feature for existing GrayKey devices called Evidence Preservation Mode, according to the leaked educational video dated early 2025.
In the video, a Magnet employee describes the tool as “an absolute game changer for iOS forensics,” noting it targets both the inactivity reboot feature and another iPhone security measure that automatically deletes cached locations, recently deleted photos, and iMessages after a certain period. The employee states the solution can “preserve that data for an infinite amount of time.”
The technical mechanism remains unclear from the video, but the Magnet employee provides hints about how it operates. According to the transcript, GrayKey Preserve enables Airplane Mode upon initial access, disabling Bluetooth, Wi-Fi, and cellular transmissions. This prevents the device from communicating while preserving data in the field.
The tool aims to maintain iPhones in what’s known as an “After First Unlock” (AFU) state, which allows law enforcement to access data more easily than in a “Before First Unlock” (BFU) state, where certain sensitive data remains encrypted and harder to access.
According to the Magnet employee, “Even if that device does reboot for any number of reasons, memory maintenance or the power is lost or whatever, the AFU state is not lost.”
When using the new solution, law enforcement sees only the iPhone’s software version and device model rather than actual data, allowing officers to preserve information without viewing it before receiving authorization to do so.
Jiska Classen, an iPhone security researcher at the Hasso Plattner Institute, told 404 Media that while the exact mechanism is unclear, Magnet may have found a way to manipulate the iPhone’s clock or disable tasks that trigger data expiration. She characterized the development as a significant capability that “at least puts things back to where they were before inactivity reboot.”
Apple and Magnet Forensics did not respond to requests for comment.
Key facts
- Apple introduced automatic iPhone reboots after 72 hours without unlocking in November 2024 to prevent law enforcement access to data
- Magnet Forensics developed GrayKey Preserve and Evidence Preservation Mode to bypass this security feature
- The new tools keep iPhones in an ‘After First Unlock’ state that allows easier data access than a ‘Before First Unlock’ state
- Law enforcement expressed concerns about Apple’s reboot feature because they often cannot immediately access seized phones due to pending authorizations or backlogs
- The tool disables wireless transmissions and may manipulate the device’s clock or disable data expiration tasks