Full Breakdown
Magnet Forensics Unveils Tool to Preserve iPhone Forensic State After Apple’s Inactivity Reboot
By Drooid · · How we work
Core Development: GrayKey Preserve and Evidence Preservation Mode
Magnet Forensics, the maker of the GrayKey unlocking device, announced two new capabilities—GrayKey Preserve and an “Evidence Preservation Mode” for its existing GrayKey units. According to a training video obtained by 404 Media, the features keep a seized iPhone in the After First Unlock (AFU) condition even if the phone reboots or loses power. The video shows a Magnet employee describing how the system disables Bluetooth, Wi-Fi and cellular radios after initial access, effectively placing the device in airplane mode to isolate it while retaining the forensic state. In this preserved state, law-enforcement operators see only the iPhone’s software version and model, not the underlying data, until they receive proper authorization.
Background: Apple’s 72-Hour Inactivity Reboot
Apple introduced a security measure in iOS 18.1 that automatically reboots an iPhone after 72 hours of inactivity. The reboot forces the device into the Before First Unlock (BFU) state, in which many encrypted data elements become inaccessible without the user’s passcode. Apple’s design aims to make it harder for forensic tools to extract data from unattended devices, a response to earlier capabilities that could access phones after a single unlock.
How the New Tools Work (According to the Leaked Video)
The leaked demonstration explains that, once initial access is achieved, GrayKey Preserve disables all radio transmissions to prevent any data from leaving the device. The system then maintains the AFU condition, meaning the phone remains in the more accessible post-unlock state despite any subsequent reboot or power loss. A screenshot of the GrayKey interface shown in the video indicates that the tool reports only the device’s iOS version and model, not the contents of the phone, allowing investigators to preserve targeted data without viewing it before a warrant is issued.
Official Statements & Responses
Apple declined to comment on the alleged bypass technique. Magnet Forensics also did not respond to requests for comment at the time of reporting.
Expert Assessment
Jiska Classen, a researcher at the Hasso Plattner Institute who reviewed the video, said the exact technical method cannot be confirmed from the material alone. She suggested the tool might manipulate the iPhone’s internal clock or suppress tasks that trigger data expiration, thereby “slowing down time” or stopping the clock after a reboot. Classen emphasized that these ideas remain speculative and that the preservation claim has not been independently verified.
Conflicting Reports & Gaps
The core claim—that GrayKey Preserve can retain the AFU state through reboots and power loss—originates solely from the Magnet employee’s statements in the leaked video. Independent security analysts have not reproduced the technique, and the product’s public page provides no technical details. Consequently, the effectiveness of the preservation method remains unproven, and no third-party testing results have been published.
Why It Matters
If the preservation capability functions as described, it would restore law-enforcement access to data that Apple’s inactivity reboot is designed to protect, potentially reshaping the balance between forensic investigation and device security. The development illustrates an ongoing cycle: Apple strengthens iPhone protections, and forensic vendors respond with tools intended to maintain or regain access. Future iOS updates may address the reported bypass, prompting further adaptations from both sides.
