Security3 publishers2 min readPublished Updated
GrayKey maker claims seized iPhones can stay in AFU through Apple's 72-hour reboot
Magnet Forensics tells police in a leaked video that GrayKey can hold seized iPhones in After First Unlock state through Apple's 72-hour reboot. If it holds, police need only reach a seized phone before the reboot and can unlock it on their own schedule.
The Watch · Security desk
Drafted by a language model from the sources cited here and checked against its claim ledger before publication. How we use AISend a correction
What happened
- Two products appear in the video: a new device called GrayKey Preserve and an Evidence Preservation Mode for existing GrayKey units.
- A Magnet employee says the tools switch off Bluetooth, Wi-Fi and cellular radios once access is gained, even on phones where Control Center cannot enable Airplane Mode.
- Cached locations and recently deleted photos and iMessages, which iOS purges after a certain number of days, can be kept "for an infinite amount of time," the employee says.
- Officers using the mode see only the phone's model and software version, according to the employee and a screenshot of the GrayKey interface shown in the video.
- Made only for law enforcement and apparently dated early 2025, the video does not explain how the products work.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- exposure Anyone whose iPhone is seized in AFU and reaches a GrayKey before the reboot would lose the three-day limit Apple added, if the vendor's claim holds.
- decision Device policies that tell staff a seized iPhone re-locks itself within 72 hours now need a caveat for phones connected to a GrayKey inside that window.
- constraint Retention reasoning built on iOS auto-deletion of locations and deleted iMessages does not cover a phone held in preservation mode.
The claim turns on two iPhone states. A phone in After First Unlock, or AFU, gives police access to data that is much harder to obtain in Before First Unlock, or BFU [5]. In BFU, certain sensitive data is encrypted, and brute-forcing the passcode can be significantly harder, sometimes virtually impossible [6]. Apple's inactivity reboot, which 404 Media reported in November 2024, restarts an iPhone that has not been unlocked for 72 hours to put it back in the harder state [3].
Police disliked the timer from the start. Officers often cannot work on a seized phone right away, because they are waiting for court authorization or for their turn in a backlog of devices [4]. The Magnet employee in the video said the product targets the reboot and the data it makes unavailable, and called it "an absolute game changer for iOS forensics and a function that I wish we had years ago" [14]. "That AFU state is captured," the employee said. "Even if that device does reboot for any number of reasons, memory maintenance or the power is lost or whatever, the AFU state is not lost." [7]
The employee described keeping a phone in AFU [5], with the preserved state in place once "initial access is gained" [8]. On that account, the phone has to still be in AFU when it reaches a GrayKey. If the claim holds, the 72 hours limit how long police can wait before connecting a seized phone. The unlock itself can come whenever a warrant or a lab slot arrives [1]. The video does not describe restoring AFU to a phone that has already rebooted into BFU [1].
The video appears to date from early 2025, a few months after the reboot became public [2]. Magnet answered one Apple control with a new device and a mode for GrayKey units already in the field [2]. 404 Media had earlier obtained lists of iPhones that GrayKey and competitor Cellebrite could access, and support differed between AFU and BFU phones [12]. The outlet places the new tool in a long-running contest between Apple and companies that help police, sometimes in authoritarian countries, get into iPhones [13].
All of it comes from Magnet's own tutorial material. 404 Media granted the person who supplied the video anonymity because they were not authorized to share it with third parties [15].
What to watch
- Whether Apple changes inactivity reboot or related iOS protections in a later release.
- Independent testing, or court filings, showing a GrayKey-preserved iPhone keeping its AFU state past 72 hours.
- Any statement from Magnet Forensics on which iPhone models and iOS versions GrayKey Preserve supports.