GrayKey maker claims seized iPhones can stay in AFU through Apple's 72-hour reboot
Magnet Forensics tells police in a leaked video that GrayKey can hold seized iPhones in After First Unlock state through Apple's 72-hour reboot. If it holds, police need only reach a seized phone before the reboot and can unlock it on their own schedule.
The Watch · Security desk
What happened
- Two products appear in the video: a new device called GrayKey Preserve and an Evidence Preservation Mode for existing GrayKey units.
- A Magnet employee says the tools switch off Bluetooth, Wi-Fi and cellular radios once access is gained, even on phones where Control Center cannot enable Airplane Mode.
- Cached locations and recently deleted photos and iMessages, which iOS purges after a certain number of days, can be kept "for an infinite amount of time," the employee says.
- Officers using the mode see only the phone's model and software version, according to the employee and a screenshot of the GrayKey interface shown in the video.
- Made only for law enforcement and apparently dated early 2025, the video does not explain how the products work.
Why it matters
- Who's exposed exposure Anyone whose iPhone is seized in AFU and reaches a GrayKey before the reboot would lose the three-day limit Apple added, if the vendor's claim holds.
- Who has to decide decision Device policies that tell staff a seized iPhone re-locks itself within 72 hours now need a caveat for phones connected to a GrayKey inside that window.
- What it limits constraint Retention reasoning built on iOS auto-deletion of locations and deleted iMessages does not cover a phone held in preservation mode.
The claim turns on two iPhone states. A phone in After First Unlock, or AFU, gives police access to data that is much harder to obtain in Before First Unlock, or BFU [6]. In BFU, certain sensitive data is encrypted, and brute-forcing the passcode can be significantly harder, sometimes virtually impossible [7]. Apple's inactivity reboot, which 404 Media reported in November 2024, restarts an iPhone that has not been unlocked for 72 hours to put it back in the harder state [4].
Police disliked the timer from the start. Officers often cannot work on a seized phone right away, because they are waiting for court authorization or for their turn in a backlog of devices [9]. The Magnet employee in the video said the product targets the reboot and the data it makes unavailable, and called it "an absolute game changer for iOS forensics and a function that I wish we had years ago" [5]. "That AFU state is captured," the employee said. "Even if that device does reboot for any number of reasons, memory maintenance or the power is lost or whatever, the AFU state is not lost." [2]
The employee described keeping a phone in AFU [6], with the preserved state in place once "initial access is gained" [10]. On that account, the phone has to still be in AFU when it reaches a GrayKey. If the claim holds, the 72 hours limit how long police can wait before connecting a seized phone. The unlock itself can come whenever a warrant or a lab slot arrives [16]. The video does not describe restoring AFU to a phone that has already rebooted into BFU [16].
The video appears to date from early 2025, a few months after the reboot became public [17]. Magnet answered one Apple control with a new device and a mode for GrayKey units already in the field [3]. 404 Media had earlier obtained lists of iPhones that GrayKey and competitor Cellebrite could access, and support differed between AFU and BFU phones [15]. The outlet places the new tool in a long-running contest between Apple and companies that help police, sometimes in authoritarian countries, get into iPhones [13].
All of it comes from Magnet's own tutorial material. 404 Media granted the person who supplied the video anonymity because they were not authorized to share it with third parties [14].
What to watch
- Whether Apple changes inactivity reboot or related iOS protections in a later release.
- Independent testing, or court filings, showing a GrayKey-preserved iPhone keeping its AFU state past 72 hours.
- Any statement from Magnet Forensics on which iPhone models and iOS versions GrayKey Preserve supports.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence40
- Adoption
- Not scored
- Hype gap+30
- Incentives60
- Confidence45
Perspective Coverage
4 publishers- Builder
- Builder 39%
- Operator
- Operator 52%
- Investor
- Investor 9%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Magnet Forensics, the company behind GrayKey, has developed technology to get around the iPhone's inactivity reboot, according to a leaked video obtained by 404 Media.
- [2]
"That AFU state is captured," the employee said. "Even if that device does reboot for any number of reasons, memory maintenance or the power is lost or whatever, the AFU state is not lost."
- [3]
Magnet has developed a new device called GrayKey Preserve and a feature for its regular GrayKey devices called Evidence Preservation Mode, according to the video.
- [4]
In November 2024, 404 Media revealed Apple introduced an iOS feature that automatically reboots an iPhone that has not been unlocked for 72 hours, to revert the phone to a state that makes it harder for police to break into.
- [5]
The employee specifically said the solution is targeted at the inactivity reboot and the data it makes unavailable, saying: "This is an absolute game changer for iOS forensics and a function that I wish we had years ago."
- [6]
The idea behind GrayKey Preserve and Evidence Preservation Mode is to keep the iPhone in After First Unlock (AFU) state, which allows police to access data that would be much harder to obtain in Before First Unlock (BFU) state.
- [7]
If an iPhone is in BFU, certain sensitive data is encrypted, and it can be significantly harder, sometimes virtually impossible, to brute-force the passcode.
- [8]
GrayKey Preserve and Evidence Preservation Mode are also designed to combat an iPhone feature that deletes cached locations and recently deleted photos and iMessages after a certain number of days. The employee said: "We're gonna be able to preserve that data for an infinite amount of time."
- [9]
Law enforcement agents expressed concern about the inactivity reboot because they often cannot immediately try to break into seized iPhones, for example while waiting for court authorization or because of a backlog of devices.
- [10]
The employee said GrayKey Preserve disables Bluetooth, Wi-Fi and cellular radios, even if the device cannot turn on Airplane Mode through Control Center: "Once initial access is gained and the device is in a preserved state, we also disable all of those radios to make sure that that data cannot reach that device."
- [11]
Agents using the solution see only the iPhone's software version and device model, not data within, according to the employee and a screenshot of GrayKey's customer interface in the video.
- [12]
The educational and tutorial video was made exclusively for law enforcement agents, appears to be dated early 2025, and does not explain the technical details behind the product and feature.
- [13]
404 Media describes the tool as the latest round in a battle between Apple and companies that help police, sometimes in authoritarian countries, break into iPhones.
- [14]
404 Media granted the person who provided the video anonymity because they were not authorized to share it with third parties.
- [15]
404 Media previously obtained lists of iPhones that GrayKey and competitor Cellebrite could access, with variations between phones in AFU and BFU state.
- [16]
On the employee's description, the tool keeps an existing AFU state from the point of initial access, so a phone must still be in AFU when connected. If the claim holds, the 72-hour reboot limits how long police can wait before connecting a seized phone, while the unlock can come later; the video does not describe restoring AFU to a phone already in BFU.
- [17]
The video appears to date from a few months after the inactivity reboot was reported.
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
1 independent publisher whose own reporting we read for this story.
- 404media.coCops Can Bypass iPhone’s Automatic Reboot to Get Into Locked Phones, Leaked Video Claims
1 article · October 1, 2026
- 9to5mac.comGrayKey maker can reportedly bypass the iPhone’s ‘Inactivity Reboot’ security feature
1 article · October 1, 2026
- gizmodo.comCops May Have Found a Way Around One of Apple’s Toughest iPhone Security Features
1 article · October 1, 2026
- schneier.comPossible Vulnerability in Apple’s Automatic Reboot
1 article · October 6, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
- Mobile forensicsFollow
- iOS SecurityFollow
- Law enforcement access to encrypted devicesFollow