A leaked video claims Magnet Forensics has created a way to bypass Apple’s automatic reboot feature, allowing law enforcement to access data on locked iPhones that would otherwise be wiped.
Apple introduced an inactivity reboot in iOS during November 2024. If a phone remains locked for 72 hours, the device restarts to a state where forensic extraction is much harder. Police often face delays waiting for court orders or dealing with backlogs, meaning they might miss the window to break into a phone before this reset occurs.
GrayKey Preserve
Magnet Forensics, the maker of GrayKey, has released a new device and a software feature called Evidence Preservation Mode. These tools are designed to keep an iPhone in a state known as “After First Unlock” (AFU). This state allows access to data that is encrypted and difficult to reach in a “Before First Unlock” (BFU) state.
In the video, a Magnet employee describes the process. Once the tool gains initial access, it disables Bluetooth, Wi-Fi, and cellular radios. This isolates the data and prevents it from reaching the device if the phone reboots or loses power.
The employee states that even if the device lacks the ability to turn off radios via the Control Center, the tool forces this isolation. The goal is to preserve data for an infinite amount of time, countering features that automatically delete cached locations, recently deleted photos, and iMessages.
The video does not reveal the technical specifics of how the tool works. Magnet granted anonymity to the person who shared the footage because they were not authorised to distribute it to third parties.
Technical implications
When using the new solution, law enforcement agents only see the iPhone’s software version and device model. They cannot view the actual data until they have proper authorisation.
Jiska Classen, a security researcher at the Hasso Plattner Institute, reviewed the video. She noted that while she could not confirm the exact method, Magnet likely manipulates the iPhone’s clock. This would effectively stop the timer counting down, preventing the inactivity reboot from triggering even if the power is lost.
Classen suggested the tool also disables the tasks responsible for setting data to expire. This approach puts the burden on Apple to determine how to stop Magnet from freezing iPhones and preserving sensitive information.
Apple and Magnet did not respond to requests for comment.
