Magnet Forensics Claims New Tool Blocks iPhone Inactivity Reboot for Police Access
Magnet Forensics has developed GrayKey Preserve and an Evidence Preservation Mode that it says freeze locked iPhones so police can reach data, defeating iOS's 72-hour inactivity reboot, according to a video obtained by 404 Media.
The video shows Magnet has built a new device called GrayKey Preserve and added a feature to its existing GrayKey devices called Evidence Preservation Mode, 404 Media reported. Both are aimed at the iPhone's inactivity reboot, a feature Apple added to iOS in November 2024 that automatically restarts phones which have not been unlocked for 72 hours, making them harder for police to open with forensic tools.
"This is an absolute game changer for iOS forensics and a function that I wish we had years ago," a Magnet employee says in the leaked video, according to 404 Media, which reported that the employee specifically named the inactivity reboot and the data it makes unavailable as the target. The same employee said of the preserved data, "We're gonna be able to preserve that data for an infinite amount of time."
According to 404 Media, GrayKey Preserve and Evidence Preservation Mode are also designed to counter a second iPhone behavior that automatically deletes certain data — cached locations, and recently deleted photos and iMessages — after a set number of days.
404 Media said it shared a transcript of the video with Jiska Classen, a researcher at the Hasso Plattner Institute who studies iPhone security. Classen said it is impossible to know for certain from the video how Magnet's feature works, but she agreed it is "quite a game changer" or at least "puts things back to where they were before inactivity reboot." She offered theories about the method: Magnet may have found a way to manipulate the iPhone's clock, effectively slowing down time or even stopping the clock from ticking after a reboot. Most likely, in her view, GrayKey disables the iPhone tasks that set data to expire.
GrayKey is a widely sold tool that law enforcement agencies use to unlock and extract data from iPhones and Android smartphones. The inactivity reboot was introduced as one of several protections intended to keep data on a locked phone out of reach of forensic hardware. Classen's account, as described by 404 Media, stops short of confirming how the Magnet features work, and the report is based on a video the company has not publicly released.