Apple built a feature into iOS to stop police from getting into locked phones. Now a company that sells tools to police says it has a way around it.
The “inactivity reboot” feature was introduced in iOS in November 2024. It automatically restarts an iPhone that has not been unlocked for 72 hours. Apple designed it to put the phone into a state that makes it harder for law enforcement to break in and extract data.
Law enforcement agents complained when Apple changed the system. They often cannot immediately try to unlock seized iPhones because of pending court authorizations or device backlogs. The new reboot feature made their job harder.
Now Magnet Forensics, maker of GrayKey, says it has a fix. The company has developed a new device called GrayKey Preserve and a feature for its regular GrayKey devices called Evidence Preservation Mode. A Magnet employee claims the solution targets the iPhone’s inactivity reboot feature and the data it makes unavailable, calling it “an absolute game changer for iOS forensics.”
The Tools and How They Work
The leaked video, made exclusively for law enforcement and dated early 2025, shows the tools enabling Airplane Mode to disable Bluetooth, Wi-Fi, and cellular radios. That isolates the data on the device.
The employee explains the tools keep the iPhone in an “After First Unlock,” or AFU, state. That allows easier access to data compared to a “Before First Unlock,” or BFU, state. In BFU mode, certain data is encrypted, and it can be significantly harder — sometimes impossible — to brute-force the passcode and unlock the device.
The employee says the AFU state is preserved even if the device reboots for any reason. He calls it “the true magic behind the GrayKey Preserve and the Evidence Preservation Mode function.”
The tools are also designed to preserve data that would otherwise be deleted automatically, including cached locations, recently deleted photos, and iMessages. The employee says they do this “for an infinite amount of time.”
When using the new solution, law enforcement agents only see the iPhone’s software version and device model, not the actual data, according to the employee and a screenshot of GrayKey’s customer interface.
What the Researcher Says
Jiska Classen, a researcher at the Hasso Plattner Institute studying iPhone security, reviewed a transcript of the video. She described the tools as “quite a game changer” or “at least puts things back to where they were before inactivity reboot.”
Classen theorizes that Magnet may have found a way to manipulate the iPhone’s clock. That could slow or stop it from ticking, or simply disable the tasks that set data to expire.
Apple and Magnet did not respond to requests for comment. The person who provided the video was granted anonymity by 404 Media because they were not authorized to share it with third parties.
The Privacy Question
The question this raises is simple: whose job is it to protect a phone? Apple has spent years building features that make it harder for anyone to get into a device without permission. That includes the inactivity reboot, which was designed specifically to frustrate unauthorized access.
Magnet Forensics sells tools to police that break into iPhones, including GrayKey. The company is doing exactly what it says it does — finding a way around a security feature. But the feature exists for a reason, and that reason is user privacy.
“an absolute game changer for iOS forensics”
The company’s own framing of the tools as a “game changer” suggests the stakes are high for law enforcement. For everyone else, the stakes are about trust.
Comparing AFU and BFU
| State | What it means | Data availability | Encryption status |
|---|---|---|---|
| AFU (After First Unlock) | Phone has been unlocked at least once since reboot | Easier access to data | Not specified in the video |
| BFU (Before First Unlock) | Phone has never been unlocked since reboot | Harder access to data | Some data is encrypted |
The video gives only hints about how the tools work. It does not explain the technical details behind the new product and feature.
What it does show is a clear path around a security feature that was meant to prevent exactly this kind of access.
The Bottom Line
The tools claim to preserve the AFU state. The video shows them doing that. Whether they actually work remains unproven.
Apple built a wall. Magnet found a ladder. The question now is whether the ladder stays where it is, or whether it gets pulled up again.
For now, the answer is that the ladder is still there. The tools are real, the video is real, and the theories from the researcher suggest the forensic landscape has changed.
The company’s own description of the tools as a “game changer” suggests the stakes are high for law enforcement. For everyone else, the stakes are about trust.
Where the paper stands
The paper backs Apple’s design that makes it harder for law enforcement to break into locked phones and is against the vendor that wants to sell a workaround to police. The inactivity reboot was built for a reason, and that reason is user privacy. Apple spent years building features that frustrate unauthorized access, and the inactivity reboot was one of them.
Magnet Forensics is selling tools to police that break into iPhones, including GrayKey. The company is doing exactly what it says it does — finding a way around a security feature. The leaked video shows the tools enabling Airplane Mode to isolate data, and the employee calls the AFU preservation “the true magic.” The company’s own framing of the tools as a “game changer” shows how high the stakes are for law enforcement.
The video was provided by someone not authorized to share it, and the technical details are hinted at but not explained. Apple and Magnet did not respond to requests for comment. The tools are real, the video is real, and the theories from the researcher suggest the forensic landscape has changed. The question is whether the ladder stays where it is, or whether it gets pulled up again.
Source material: “Cops Can Bypass iPhone's Automatic Reboot to Get into Locked Phones,” 404 Media.
Get the Notebook.
The day's best stories and every fresh verdict, in plain English, in your inbox by seven. One email a day, no more.