Magnet Forensics, a company known for its GrayKey iPhone unlocking tools, has developed methods to bypass Apple's "inactivity reboot" security feature, according to a leaked video obtained by 404 Media. This feature, introduced in iOS 18.1, automatically restarts iPhones that have been inactive for 72 hours, returning them to a more secure "Before First Unlock" (BFU) state. This reboot makes it significantly harder for forensic tools to access encrypted data.
The company's new offerings, GrayKey Preserve and an "Evidence Preservation Mode" for existing GrayKey devices, aim to keep iPhones in the less secure but more accessible "After First Unlock" (AFU) state, even after a reboot. A Magnet Forensics employee stated in the leaked video that this capability is a "game changer" for iOS forensics, wishing they had possessed it years prior. This development addresses a key concern for law enforcement agencies, who often face delays in accessing seized devices due to warrant processing or backlogs.
Apple's inactivity reboot was intended to protect user data by ensuring that encryption keys are cleared from memory upon restart, requiring the user's passcode to re-establish access. This mechanism was a significant hurdle for digital forensics companies and law enforcement, as it reverted devices to the BFU state, where sensitive data is heavily encrypted and difficult to access without the passcode. Prior to this feature, tools like GrayKey and Cellebrite's UFED could often find ways to access data on locked iPhones given sufficient time and resources.
Magnet Forensics' new tools also reportedly combat another iPhone feature that automatically deletes certain data, such as cached locations and recently deleted messages, after a specified period. By preserving this data indefinitely, the GrayKey tools aim to provide law enforcement with a more complete picture from seized devices. iPhone security researcher Jiska Classen suggested that Magnet's technology might work by manipulating the device's clock or disabling background tasks that manage data expiration.
The St. Louis County Police Department has publicly stated that GrayKey Preserve has been a "game changer" for their operations, providing reassurance that devices can be preserved even when immediate analysis is not possible. Magnet Forensics has emphasized its commitment to supporting lawful access to data, developing preservation solutions to address the challenges posed by inactivity timers and expiring evidence.