Apple’s iOS 18.1 introduced a safety mechanism called Inactivity Reboot that forces an iPhone to restart if it remains locked and unused for 72 hours. This reboot moves the device into a more restrictive state known as Before First Unlock (BFU), where many encrypted data types become inaccessible until the user enters their passcode. The aim is to thwart unauthorized access, especially by forensic tools often used by law enforcement.
Now, it appears that Magnet Forensics, maker of the GrayKey unlocking system, may have found a way around that protection.
GrayKey Preserve & Evidence Preservation Mode
A leaked training video, said to be from early 2025 and made for law enforcement officials, reveals two new GrayKey features: one called GrayKey Preserve and another labeled Evidence Preservation Mode. These tools are designed to maintain the After First Unlock (AFU) security state even if the iPhone has been unused long enough to trigger the 72-hour inactivity reboot. In theory, AFU grants access to more data than BFU, including items that would otherwise become protected or wiped as inactivity expires.
Though the video does not detail exactly how the bypass works, it claims that GrayKey can capture the AFU state in a durable way—so durable that even if the device reboots (due to power loss, scheduled restart, or other causes), the AFU state would be preserved. The Evidence Preservation Mode is said to prevent auto-deletion of cached locations, recently deleted photos, and expired iMessage content.
What’s Known and What Isn’t
Security researcher Jiska Classen has speculated that GrayKey’s tools may act by delaying or disabling system processes tied to the inactivity timer, or by manipulating the internal clock. Those are unproven theories, since the video doesn’t show the underlying technical method.
It also remains uncertain how broadly the tools are deployed, whether they’ve been used in real-world investigations, or whether they are still effective against the latest versions of iOS.
Apple and Magnet Forensics have both declined to comment on the allegations, and the leaked video serves as the primary source for the claims so far.
This development may mark a turning point—not just for forensic tools, but for mobile device security expectations. While protecting user data from misuse has always been a battleground between device makers and investigative agencies, these latest claims suggest a possible rollback of some protections.
Why this matters: If GrayKey Preserve and Evidence Preservation Mode do what they claim, law enforcement agencies may no longer face the 72-hour deadline that iOS’s inactivity reboot imposes. For ordinary users, this puts pressure on the assumption that a sequestered or forgotten device becomes significantly safer after three days of nonuse. Going forward, observers will need to test whether the bypass tools work universally, how Apple responds in upcoming iOS releases, and how privacy laws may react if these tools become widely adopted.
