Leaked Video: Magnet Claims GrayKey Can Bypass iPhone's Inactivity Reboot

A leaked Magnet Forensics training video claims the company has developed a way to defeat the iPhone's "inactivity reboot" and keep seized devices in a state where their data is easier for police to extract. The video, obtained by 404 Media, presents a new device called GrayKey Preserve and a feature for existing GrayKey units called Evidence Preservation Mode.

Apple added the inactivity reboot quietly to iOS, as 404 Media reported in November 2024. An iPhone that has not been unlocked for 72 hours reboots itself and returns to a state known as Before First Unlock, where sensitive data is encrypted and brute-forcing the passcode is far harder, sometimes practically impossible. Law enforcement raised concerns when the feature surfaced: seized phones often sit untouched for days while officers wait for a court authorization or work through a backlog.

What the new tools claim to do

"This is an absolute game changer for iOS forensics and a function that I wish we had years ago," a Magnet employee says in the video, which is dated early 2025 and was made only for law enforcement customers. According to the video, the solution keeps an iPhone in the After First Unlock state; that state is "captured," the employee explains, so the AFU state survives a reboot, memory maintenance or a loss of power. The tools can also "preserve that data for an infinite amount of time," the employee says, and fight a second iPhone feature that deletes cached locations, recently deleted photos and iMessages after a set number of days.

The device also enables Airplane Mode and cuts Bluetooth, Wi-Fi and cellular radios, so the data is isolated in the field. Until agents are authorized to look, the interface shows only the phone's model and iOS version, not the data inside, per the video and a screenshot of GrayKey's customer interface.

An expert's view

404 Media shared a transcript of the video with Jiska Classen, a researcher at the Hasso Plattner Institute who studies iPhone security. Classen said the exact mechanism cannot be confirmed from the video alone, but offered theories: Magnet may have found a way to manipulate the iPhone's clock, in effect slowing time down or stopping the clock from ticking even after a reboot, and GrayKey most likely disables the iOS tasks that set data to expire.

She described the capability as "quite a game changer," or at least a step that puts law enforcement back where it was before inactivity reboot arrived. Neither Apple nor Magnet Forensics responded to a request for comment. The ball is now in Apple's court: it has to work out how Magnet got around inactivity reboot and how to stop iPhones and the data inside them from being frozen in time.