Report: GrayKey Maker Can Bypass iPhone Inactivity Reboot

Apple introduced the inactivity reboot feature with iOS 18.1 nearly two years ago. The feature automatically restarts an iPhone if it has not been unlocked for more than 72 hours. A reboot returns the device to a Before First Unlock, or BFU, state. In BFU, certain sensitive data remains protected by encryption keys that become available only after the user enters the passcode for the first time, which puts the phone in an After First Unlock, or AFU, state. AFU is less restrictive for forensic tools. Because obtaining a warrant or transporting a seized phone to a lab can take time, the automatic reboot can return a device to BFU before investigators access it.

According to 404 Media, the training video shows how Magnet’s tools can capture and preserve the AFU state. A Magnet employee says in the video, “Even if that device does reboot for any number of reasons, memory maintenance or the power is lost or whatever, the AFU state is not lost.” The employee also calls the capability “an absolute game changer for iOS forensics and a function that I wish we had years ago.” 9to5Mac, citing 404 Media, reported that the video does not explain the technical mechanism behind the workaround. The employee describes the preservation of AFU as “the true magic behind the GrayKey Preserve and the Evidence Preservation Mode function.”

The reported tools would also prevent automatic iPhone features that delete some data after a certain number of days, including cached locations and recently deleted iMessages and photos, according to the reports. Magnet primarily sells GrayKey to police as a means of unlocking smartphones.

404 Media said it contacted Apple and Magnet Forensics, but neither responded to a request for comment. The publication also consulted iPhone security researcher Jiska Classen, who said Magnet may have found a way to manipulate the iPhone’s clock or to turn off the processes responsible for expiring certain data altogether. It remains unclear how long the technology has been available to law enforcement, whether it has been used in actual investigations, or whether the workaround remains effective against the latest versions of iOS.

When iOS 18.1 was released, 404 Media noted that the inactivity reboot feature could also make it harder for thieves or other bad actors to keep a stolen iPhone in AFU long enough to develop or use a way to break into it. The reported workaround comes as local law enforcement teams and multiple federal agencies have faced accusations of skirting the lines of citizens’ digital privacy.