As reported by <a href="https://www.404media.co/cops-can-bypass-<a href="https://myappsplus.com/apple-shares-photos-shot-on-iphone-duo/” title=”Apple Shares Photos Shot on iPhone Duo”>iphone-automatic-inactivity-reboot-graykey/” rel=”nofollow noopener” target=”_blank”>404 Media, Magnet Forensics says it has found a way to bypass the iPhone security feature that automatically reboots devices if they haven’t been unlocked for 72 hours. Here are the details.
A bit of context
Nearly two years ago, the iOS 18.1 update introduced Inactivity Reboot, a feature that forces iPhone reboots in case they haven’t been unlocked for 72 hours.
In essence, this feature makes it harder for law enforcement and forensic tools to access data on a locked iPhone, since a reboot causes the device to return to a Before First Unlock (BFU) state, rather than remaining in the less restrictive After First Unlock (AFU) state.
When an iPhone is in BFU, certain sensitive data remains protected by encryption keys that only become available after the user enters their passcode for the first time, thus putting the device in AFU.
From that point on, more of the device’s data remains accessible until the iPhone is rebooted again, which returns it to BFU.
Automatically rebooting an iPhone means that even if a device is seized by law enforcement, it can return to BFU before investigators can access it, since obtaining a warrant or transporting the device to a forensic lab can take time.
As 404 Media noted when iOS 18.1 was released, the feature can also make it harder for thieves or other bad actors to keep a stolen iPhone in AFU long enough to develop or use a way to break into it.
GrayKey reportedly gets around Inactivity Reboot
404 Media reported today that, based on an “educational and tutorial video, which was made exclusively for law enforcement agents and appears to be dated early 2025,” Magnet Forensics, the company behind the GrayKey phone unlocking tool, appears to have developed a way to bypass the iPhone’s Inactivity Reboot feature.
According to the report, Magnet developed a new device called GrayKey Preserve, as well as an Evidence Preservation Mode for its existing GrayKey hardware.
Both are reportedly designed to maintain an iPhone’s forensic state without immediately exposing the data stored on the device, allowing law enforcement to keep that state intact while waiting for authorization to search it.
The report notes that while the video doesn’t detail the technical mechanism behind the workaround, it explains that GrayKey can preserve an iPhone’s AFU state even if the device reboots.
“That AFU state is captured,” by GrayKey Preserve and Evidence Preservation Mode, the employee says. “Even if that device does reboot for any number of reasons, memory maintenance or the power is lost or whatever, the AFU state is not lost. This is the true magic behind the GrayKey Preserve and the Evidence Preservation Mode function.”
404 Media reached out to Apple and Magnet Forensics, but neither responded to a request for comment. They also consulted iPhone security researcher Jiska Classen, who said Magnet may have found a way to manipulate the iPhone’s clock, or to turn off the processes responsible for expiring certain data altogether.
While the video appears to date from early 2025, it is unclear how long the technology has been available to law enforcement, whether it has been used in actual investigations, or whether the workaround remains effective against the latest versions of iOS.
To read 404 Media’s full report, follow this link.
Worth checking out on Amazon
You’re reading 9to5Mac — experts who break news about Apple and its surrounding ecosystem, day after day. Be sure to check out our homepage for all the latest news, and follow 9to5Mac on Twitter, Facebook, and LinkedIn to stay in the loop. Don’t know where to start? Check out our exclusive stories, reviews, how-tos, and subscribe to our YouTube channel
