GrayKey maker reportedly bypasses iPhone reboot protection after 72 hours

Magnet Forensics, maker of the GrayKey iPhone access tool, has reportedly found a way to bypass Inactivity Reboot. The feature automatically restarts an iPhone that has not been unlocked for 72 hours.

404 Media reported the development based on a law-enforcement training video that appears to date from early 2025. Apple and Magnet Forensics did not respond to the publication’s requests for comment.

GrayKey reportedly preserves post-unlock state

According to 404 Media, Magnet developed a separate device called GrayKey Preserve and an Evidence Preservation Mode for existing GrayKey hardware. The tools are reportedly intended to preserve an iPhone’s forensic state without immediately exposing its stored data.

The video says the tools can retain the device’s After First Unlock (AFU) state even if the phone reboots because of power loss or another cause. It does not explain the technical mechanism behind the workaround.

Why Inactivity Reboot protects data

After a reboot, an iPhone returns from After First Unlock to Before First Unlock (BFU). In BFU, some sensitive data remains protected by encryption keys that become available only after the device passcode is entered for the first time.

Introduced in iOS 18.1, the feature is intended to make locked iPhones harder for law enforcement, forensic tools and thieves to access before the device returns to a protected state.

Availability and mechanism remain unclear

iPhone security researcher Jiska Classen suggested that Magnet may have manipulated the device clock or disabled processes responsible for expiring certain data. Her comments were a possibility, not a confirmed explanation of the system.

It is unclear how long the technology has been available to law enforcement, whether it has been used in investigations, or whether it still works against the latest iOS versions.