A tool used by law enforcement agencies can reportedly prevent Apple’s inactivity reboot from making data on a seized iPhone harder to access, potentially weakening a security feature Apple introduced specifically to protect devices that remain locked for extended periods.
Apple’s inactivity reboot automatically restarts an iPhone after it has gone 72 hours without being unlocked. That returns the device to a more secure state known as Before First Unlock, where encryption keys protecting certain data aren’t available until the passcode is entered again.
A law enforcement training video obtained by 404 Media shows Magnet Forensics claiming its GrayKey tools can preserve the less restrictive After First Unlock state even if the iPhone subsequently reboots or loses power.
GrayKey can reportedly freeze an iPhone in a more accessible state
The capability is built into a device called GrayKey Preserve and an Evidence Preservation Mode available for existing GrayKey hardware. Once an iPhone has been accessed and preserved, the tools are designed to keep it in the After First Unlock state that existed before the reboot.
That distinction can make a substantial difference during a forensic examination. An iPhone unlocked since its last restart can expose more data to forensic tools, while a normal reboot removes access to encryption keys that protect some of that information until the passcode is entered again.
Apple’s 72-hour inactivity timer was designed to close that window automatically. A seized iPhone sitting in an evidence room could eventually restart on its own and become considerably harder to examine before investigators have an opportunity or legal authorization to extract its contents. GrayKey Preserve is intended to prevent that change in state.
The training video doesn’t reveal exactly how the preservation works, making it impossible to determine from the material alone how GrayKey is getting around Apple’s protection. The video also appears to date from early 2025, so it’s unclear whether the same technique remains effective against the latest versions of iOS.
GrayKey can preserve data that iOS would normally delete
The tools aren’t limited to preventing the inactivity reboot from changing the device’s state. Magnet also says they can stop certain information from expiring, including cached location data, recently deleted photos, and recently deleted iMessages.
GrayKey Preserve also disables cellular, Wi-Fi, and Bluetooth connections after gaining initial access, isolating the iPhone from outside communications while its existing data is preserved.
That potentially gives investigators considerably more time. Instead of racing against Apple’s 72-hour reboot timer and other automatic deletion periods, a seized device could remain in the same forensic state while authorities wait for permission to examine its contents.
The existence of the preservation tools doesn’t mean law enforcement automatically gains access to everything on a locked iPhone.
They are designed to preserve a device and the data available in its existing state rather than eliminate every layer of Apple’s encryption or passcode protection.
Apple hasn’t publicly detailed how GrayKey Preserve works or whether newer versions of iOS contain protections against it.
