It's easier to crack an iPhone after it's been unlocked once by the user after a reboot. A law enforcement tool vendor may have found a way to keep the device in that state.
Magnet Forensics claims its tools preserve iPhone data that Apple's security features would otherwise make harder to access. The tools could give police more time to extract sensitive information from seized devices.
In iOS 18.1, Apple introduced a new privacy feature, a sort of inactivity reboot. This reboot restarts an iPhone after 72 hours without an unlock, returning it to a Before First Unlock (BFU) state.
That state restricts access to encryption keys. As a result, it makes it much harder for anyone to break into an iPhone using brute-force or other methods.
Now, a law enforcement educational video seen by 404 Media details a device called GrayKey Preserve. Magnet also offers Evidence Preservation Mode for its existing GrayKey hardware, which police use to access locked smartphones.
In the video, which was dated early 2025, Magnet says GrayKey Preserve keeps the device in the more accessible After First Unlock (AFU) state, even if an iPhone reboots. Evidence Preservation Mode also reportedly prevents cached locations, recently deleted photos, and iMessages from expiring, preserving them indefinitely.
After initial access, GrayKey Preserve disables cellular, Bluetooth, and Wi-Fi connections to isolate the phone from incoming communications. Evidence Preservation Mode then allows law enforcement to effectively freeze the data while waiting for authorization to attempt retrieval.
The video doesn't explain how the feature works. But, iPhone security researcher Jiska Classen believes it could be clock manipulation. It could also disable iPhone tasks that set data to expire.
