GrayKey maker reportedly claims workaround for iPhone’s automatic reboot protection

Magnet Forensics, the company behind the GrayKey phone-unlocking tool, reportedly claims it can preserve an iPhone’s more accessible data state even after a reboot. The claim concerns Inactivity Reboot, Apple’s security feature that automatically restarts an iPhone after 72 hours without an unlock.

In an October 1 report, 9to5Mac relayed 404 Media’s findings from a tutorial video made exclusively for law enforcement. The video appears to date to early 2025; it is not evidence of a newly available capability.

Why a reboot changes access to data

Introduced in iOS 18.1, Inactivity Reboot returns the phone to Before First Unlock, or BFU. In this state, certain sensitive data remains protected by encryption keys—the digital keys needed to read it—that become available only after the user first enters their passcode following a restart.

Entering the passcode moves the phone into After First Unlock, or AFU. More of its data then remains accessible until another reboot returns it to BFU. That makes the reboot important for a seized, locked phone: investigators may lose the less restrictive state while seeking a warrant or transporting the device to a laboratory. As 404 Media previously noted, the feature can also limit the time thieves have to keep a stolen phone in AFU while developing or using a way to break into it.

What Magnet reportedly claims to preserve

According to the report, Magnet developed a device called GrayKey Preserve and an Evidence Preservation Mode for existing GrayKey hardware. Both are reportedly designed to retain the phone’s state for forensic examination—analysis of data for an investigation—without immediately exposing its stored data. The stated purpose is to preserve that state while investigators await authorization to search.

In the video, a Magnet employee reportedly says the tools capture the AFU state and retain it even if the iPhone reboots or loses power. The claim is therefore about preserving that state across a restart, not simply preventing the automatic reboot. The video does not disclose how the workaround operates.

How it works—and where it works—remain unclear

iPhone security researcher Jiska Classen, consulted by 404 Media, suggested that Magnet might manipulate the phone’s clock or disable processes that cause certain data to expire. These are possible explanations, not a confirmed account of Magnet’s technique. According to 9to5Mac’s account, neither Apple nor Magnet responded to 404 Media’s requests for comment.

It remains unclear how long the technology has been available to law enforcement, whether investigators have used it in actual cases, or whether the claimed workaround still works against the latest iOS versions. Those questions determine whether the reported preservation capability can overcome the reboot protection on phones running current software.