In November 2024, Apple quietly shipped an inactivity reboot feature in iOS that automatically restarts any iPhone left unlocked for 72 hours, forcing it into the cryptographically harder Before First Unlock (BFU) state. The move was a direct countermeasure against forensic extraction tools used by law enforcement. Six months later, Magnet Forensics — the company behind the GrayKey phone-cracking device — claims to have neutralized it entirely. A leaked tutorial video, obtained by 404 Media and dated early 2025, shows a Magnet employee demonstrating two new products: GrayKey Preserve, a standalone device, and Evidence Preservation Mode, a feature for existing GrayKey units. Both aim to keep a seized iPhone locked in its After First Unlock (AFU) state indefinitely — the state where sensitive data remains decryptable and passcode brute-forcing is significantly easier. The employee calls it "an absolute game changer for iOS forensics." The technical approach, while not fully detailed in the video, reveals strong hints. Upon gaining initial access, the system disables all radio transmissions — Bluetooth, Wi-Fi, cellular — even overriding iOS restrictions that would normally prevent toggling Airplane Mode. This isolates the device from remote commands (including remote wipe) and from network-triggered data expiration. The critical claim: even if the iPhone reboots due to power loss or maintenance, the AFU state is preserved. Jiska Classen of the Hasso Plattner Institute theorizes Magnet may be manipulating the iPhone's internal clock, effectively "stopping time" so that expiration timers and the inactivity reboot countdown never trigger. The product also targets Apple's automatic data deletion features — cached location data, recently deleted photos, and iMessages that iOS purges after set periods. Magnet claims the preserved state retains this ephemeral data "for an infinite amount of time." Notably, the tool's interface shows cops only the iPhone model and iOS version during preservation, not the data itself, creating a procedural firewall that lets evidence be frozen before a warrant authorizes its inspection. The extraction dynamic here is layered. Magnet sells exclusively to law enforcement, but previous reporting has documented GrayKey and competitor Cellebrite devices in the hands of authoritarian regimes. The capability gap between AFU and BFU access is not trivial — it can mean the difference between full data extraction and effective impossibility. Apple's inactivity reboot was a rare instance of a trillion-dollar company building a feature whose primary beneficiary was the privacy of people whose phones had been seized. Magnet's bypass returns the equilibrium to its prior state. Neither Apple nor Magnet responded to requests for comment. The ball, as Classen noted, is now squarely in Apple's court. The history of this arms race suggests Apple will patch, Magnet will adapt, and the cycle will continue — but the interim window matters. Every month a bypass works is a month when every seized iPhone worldwide is more vulnerable than Apple intended. The asymmetry is structural: Apple must defend every attack surface simultaneously, while Magnet needs only one exploit at a time. What makes this episode significant is not the bypass itself — these are routine in the forensics industry — but the speed and confidence of the response. Apple's inactivity reboot was live for roughly four months before Magnet had a productized countermeasure in law enforcement hands. That turnaround time is the real metric to watch.
