GrayKey maker reportedly found a way around the iPhone's Inactivity Reboot

Apple added Inactivity Reboot in the iOS 18.1 update, nearly two years ago. The rule is simple: if an iPhone isn't unlocked for 72 hours, it restarts on its own.

That sounds minor. It isn't, because of how iPhones protect data after a restart.

404 Media first revealed the feature in November 2024. It reported at the time that Apple added it quietly, and that the goal was to make it harder for police to break into seized phones and pull data from them with forensic tools.

An iPhone has two key states, as 9to5Mac explains:

• Before First Unlock (BFU): right after a restart, before you type your passcode. Some sensitive data stays protected by encryption keys that aren't available yet.
• After First Unlock (AFU): once you enter your passcode the first time. From then on, more of the phone's data stays accessible until the next restart.

Think of it like a house where the inner doors unlock after you come home the first time. A reboot locks them all again.

A phone in AFU is easier to break into. AppleInsider notes that BFU makes brute-force and other methods much harder, because access to the encryption keys is restricted.

So Inactivity Reboot puts a clock on things. If a phone sits unopened for three days, it slips back to the stricter state.

Apple wasn't the first to try this. Privacy Guides notes that GrapheneOS, a privacy-focused version of Android, introduced an Auto Reboot feature that returns phones to the stricter state after a set time. Apple's version works the same way, but with a fixed 72-hour timer.

Engadget describes the practical effect plainly: since the feature arrived, law enforcement officials have often been unable to get at information on seized iPhones.

When Apple made the change, 404 Media reported that law enforcement agents were worried. Police often can't try to unlock a seized iPhone right away.

They may be waiting for a court to authorize a search. Or there may simply be a backlog of devices in the forensic lab. Either way, three days can pass quickly.

The feature also protects against others. 404 Media noted it makes it harder for thieves to keep a stolen iPhone in AFU long enough to find a way in.

The new tools come from Magnet Forensics, the company behind GrayKey. 404 Media describes GrayKey as a popular tool sold to law enforcement that unlocks and accesses data on iPhones and Android phones.

According to the video, Magnet has two new things:

• GrayKey Preserve: a new device.
• Evidence Preservation Mode: a feature for its existing GrayKey hardware.

Both are reportedly designed to keep a seized iPhone in its After First Unlock state, even if the phone reboots. A Magnet employee in the video says:

"Even if that device does reboot for any number of reasons, memory maintenance or the power is lost or whatever, the AFU state is not lost. This is the true magic behind the GrayKey Preserve and the Evidence Preservation Mode function."

The same employee calls it "an absolute game changer for iOS forensics and a function that I wish we had years ago," according to 404 Media and Engadget.

According to 404 Media, the video was an educational and tutorial piece made only for law enforcement agents. It doesn't spell out the technical details, but it gives strong hints about how the products work. Privacy Guides adds that, even without technical details, the video serves as a kind of proof of what the tools can do.

9to5Mac reports the tools are meant to hold the phone's forensic state without immediately exposing its data. That lets police keep the state intact while they wait for authorization to search.

The video describes more than the reboot workaround.

• Disappearing data: AppleInsider reports Evidence Preservation Mode also stops cached locations, recently deleted photos and iMessages from expiring on schedule. In the video, the employee says, "We're gonna be able to preserve that data for an infinite amount of time."
• Cutting the phone off: after first access, GrayKey Preserve disables cellular, Bluetooth and Wi-Fi, isolating the phone from incoming communications, according to AppleInsider.

In real life If your iPhone sits unopened for three days, it restarts and locks its most sensitive data behind your passcode again. The reported tools aim to stop that clock for a phone that police have already seized.

The video doesn't explain the technical method. 404 Media asked iPhone security researcher Jiska Classen.

She suggested two possibilities: Magnet may have found a way to manipulate the iPhone's clock, or to turn off the processes that make certain data expire.

The catch: a lot is still unclear.

• Timing: the video appears to date from early 2025, 404 Media says. It's unclear how long the tools have been available to law enforcement.
• Real use: 9to5Mac notes it's unknown whether they've been used in actual investigations.
• Current iOS: it's also unclear whether the workaround still works on the latest versions of iOS.
• Responses: 404 Media says neither Apple nor Magnet Forensics responded to requests for comment.

The video was made only for law enforcement, and 404 Media granted the person who shared it anonymity because they weren't authorized to share it.

Why the video matters: Privacy Guides explains that forensic companies tend to keep their exact capabilities secret. If a phone maker learns which weakness a tool relies on, it can patch it, and the tool stops working. Leaks like this one are one of the few ways the public learns what these tools can do.

Magnet isn't the only company in this market. Privacy Guides points to Cellebrite as another well-known maker of phone extraction tools sold to law enforcement. These tools can work when a suspect shares their passcode, and sometimes when they don't.

The big picture: this is the latest round in a long back-and-forth between Apple and companies that help police get into iPhones. Apple adds protections; forensic firms look for ways around them. For more on Apple's recent security work, see its emergency CoreGraphics patch.

• For most people: the reported tools work on phones police have already seized, not remotely over the internet.
• Keep updating: it's unclear whether the method works on current iOS, and updates are how Apple closes gaps like this.
• Your passcode still matters: a strong passcode protects your data in the Before First Unlock state.
• Watch for Apple's response: Apple hasn't commented yet, so a change in a future iOS update is possible.