Since iOS 18.1, an iPhone restarts if it hasn't been unlocked for three days, thus significantly strengthening data security. The maker of the forensic tool GrayKey claims to be able to circumvent this protection. This is supported by an internal training video for investigators.
The US media outlet 404 Media has analyzed a training video from Magnet Forensics, which is aimed exclusively at law enforcement agencies. Magnet manufactures GrayKey, a device that investigators use to read data from locked iPhones and Android smartphones. The person who shared the video remains anonymous because they were not authorized to share it with third parties.
In the video, an employee presents a new device called GrayKey Preserve, along with an Evidence Preservation Mode for existing GrayKey hardware. Both are designed to preserve a seized iPhone in the state in which it can be most easily accessed, even after a restart. According to 404 Media, the video is dated early 2025.
Key Facts at a Glance
- Since iOS 18.1, an iPhone automatically restarts after 72 hours without being unlocked and enters a more secure state.
- Magnet Forensics claims in a training video that it can bypass this protection with GrayKey Preserve.
- Additionally, data that the iPhone deletes after a certain period of time should be retained indefinitely.
- The video does not show how this works technically; a researcher at the Hasso Plattner Institute suspects an intervention in the system clock.
Why restarting protects
An iPhone has two basic states. After being switched on, it is in the "Before First Unlock" (BFU) state: Certain sensitive data is encrypted with keys that only become accessible after the first passcode entry. Once this has happened, the device switches to the "After First Unlock" (AFU) state, and more data remains accessible until it restarts.
This difference makes a big difference for forensic tools. In BFU mode, it is significantly more difficult, sometimes practically impossible, to crack the code by trial and error. The inactivity restart ensures that a seized iPhone automatically reverts to BFU mode after three days, even if investigators are still waiting for a warrant or processing many devices simultaneously.
What GrayKey Preserve should be able to do
According to the video, GrayKey Preserve saves the AFU state as soon as the tool gains initial access to the device. Even if the iPhone restarts afterward, for example due to a power outage, this state is not lost. Additionally, the tool disables cellular, Wi-Fi, and Bluetooth to prevent any external data from reaching the device.
A second target is data that the iPhone automatically deletes after a certain period, such as cached locations and recently deleted photos and messages. This data is said to be retained indefinitely. According to the video, investigators initially only see the device's model and software version, not its contents, until they are authorized to access the data.
What the research says
404 Media provided a transcript of the video to Jiska Classen, who researches iPhone security at the Hasso Plattner Institute in Potsdam. According to her assessment, the video does not definitively explain how the function works. She considers it likely that Magnet manipulates the iPhone's clock, slowing down time or even stopping it after a restart, and disabling tasks that cause data to expire.
For Classen, this is a significant change that at least reverts the situation to the state it was before the introduction of the inactivity restart feature. Source: The video comes from the manufacturer itself and is aimed at customers; it is therefore also advertising for their own product.
An advertising promise with open details
I believe the report should be taken seriously, but read with caution. The statements are taken from the manufacturer's own training and promotional materials, the video is about a year and a half old, and it doesn't provide any technical details. Even Classen can only speculate about how the function works.
As 404 Media writes regarding the background, it remains true: An iPhone in BFU mode is significantly harder to hack than one in AFU mode, and it returns to BFU mode after every restart until the passcode is entered. Apple's Lockdown Mode adds further hurdles, blocking wired connections to computers and accessories while the iPhone is locked. It is one of several security features that protect an iPhone against unauthorized access, alongside a strong passcode, two-factor authentication, and stolen device protection.
The real measure of success lies in how long it takes Apple to react. The tools used by forensic providers and Apple's security measures have been alternating for years; for example, according to leaked documents, Cellebrite failed to compromise iPhones running iOS 17.4 or later in 2024.
Should Apple block such tools as rigorously as possible – or should investigators be able to access the data with a court order? Feel free to disagree in the comments.
