A company that sells phone-cracking gear to police says it has found a way around one of Apple’s best privacy tools. The claim comes from a training video made for law enforcement. 404 Media got a copy and reported on it October 1.
It is the latest move in a long tug-of-war. Apple tightens security, and forensics companies look for ways through.
What Apple’s reboot feature does
In November 2024, reports revealed Apple had quietly added an “inactivity reboot” to the iPhone. If a phone goes 72 hours without being unlocked, it restarts on its own. The timer was seven days in the first iOS 18 release, then dropped to 72 hours. Researchers confirmed the timer after the first report, and Magnet itself later confirmed it too.
Police noticed first. A document that appeared to come from Detroit law enforcement warned that seized iPhones were rebooting by themselves. That made them much harder to unlock. Investigators often can’t crack a phone right away. They may be waiting for a court order, or other phones may be ahead of it in line.
The reboot matters because of two phone states. After a reboot, an iPhone is in “Before First Unlock.” Its data stays locked tight until the owner types the passcode. Once the owner unlocks it, the phone is in “After First Unlock.” That state is easier for phone-cracking tools to attack. The reboot sends the phone back to the harder state. Apple’s Secure Enclave chip counts the hours, so attackers can’t easily stop it.
What the leaked video says
The video appears to date from early 2025. It shows Magnet Forensics presenting two products. One is a new device called GrayKey Preserve. The other is a feature for its regular GrayKey units, called Evidence Preservation Mode. Magnet’s own materials say the new tools were built to address the iOS reboot timer.
A Magnet employee says the tools capture the phone’s “After First Unlock” state. Even if the phone reboots or loses power, the employee says that state isn’t lost. After police get in at first, the device shuts off cellular, Wi-Fi, and Bluetooth. That way nothing new can reach the phone.
The tools also target a second iPhone habit. The phone automatically deletes some data after a set number of days. That includes cached locations and recently deleted photos and iMessages. Magnet says it can hold that data forever. One Magnet employee praised the feature in the video, calling it “an absolute game changer for iOS forensics.”
GrayKey is widely used. Magnet says more than 1,200 agencies in 40 countries rely on it.
How GrayKey might work
The video doesn’t say how the tool works. Jiska Classen, an iPhone security researcher at the Hasso Plattner Institute, read a transcript for 404 Media. She says it’s impossible to know for sure.
Her best guess is that GrayKey tampers with the phone’s clock, so the phone thinks less time has passed. It might also switch off the tasks that erase old data. She agreed the result would put police close to where they stood before the reboot feature existed.
No one outside Magnet has tested these claims. Magnet’s website confirms GrayKey Preserve exists and describes it as a way to limit data loss from reboot timers. But no one has shown it can keep a phone in an easier state through a reboot. The video is also a training piece for police. It shows how Magnet describes its own product, not an outside test.
There are limits, too. This isn’t a gadget that cracks any iPhone on contact. Magnet’s claim is narrower: it stops a phone from sliding into the stricter locked state. Police still need a way in first. Neither Apple nor Magnet answered 404 Media’s request for comment. Apple could respond with a software update, but it hasn’t announced one.
The possible implications
For most people, nothing changes today. GrayKey is sold to law enforcement, and police often wait for court approval before searching a phone. Still, the reboot feature was one of Apple’s clearest wins against phone-cracking tools. Police had worried openly about it since 2024, so a fix would be welcome news for them. If these claims hold up, that win is smaller than it looked.
Magnet has played this game before. In 2024, leaked documents said GrayKey could partly unlock phones running iOS 18 and 18.0.1. The back-and-forth keeps going. Government systems have also faced separate cyberattacks, including the European Commission mobile system, which was targeted in a coordinated cyberattack on EU agencies. For now, the facts rest on one leaked video and a company’s own words. Watch for independent tests and any reply from Apple.
