Magnet Forensics Bypasses Apple iPhone Inactivity Reboot

A new forensic capability from Magnet Forensics threatens to neutralize one of Apple’s most significant recent security upgrades for seized devices. The Canadian digital investigations company has introduced tools designed to prevent iPhones from automatically locking down after 72 hours of inactivity, effectively giving law enforcement an indefinite window to extract data that Apple engineered to become inaccessible.

The development centers on a hardware product called GrayKey Preserve and a software update known as Evidence Preservation Mode for existing GrayKey systems. Both target the technical boundary between two distinct encryption states built into iOS: After First Unlock (AFU) and Before First Unlock (BFU).

When an iPhone powers on or reboots, it enters BFU status. In this state, the device’s file-based encryption keeps the majority of user data locked behind cryptographic keys stored in the Secure Enclave, Apple’s dedicated security coprocessor. Those keys are not released to the operating system until the owner enters their passcode for the first time following a boot cycle. Once that passcode is entered, the phone shifts to AFU status, where significantly more data—including cached emails, certain third-party app contents, and portions of message databases—becomes decrypted and accessible to the operating system, and consequently, to forensic extraction tools.

Apple introduced the inactivity reboot feature in iOS 18.1, released in late 2024. The mechanism forces an automatic restart if a device remains locked for 72 consecutive hours, deliberately pushing any active phone back into the highly secure BFU state. For police departments and federal agencies managing evidence lockers filled with confiscated phones, the 72-hour timer created a severe logistical bottleneck. Devices awaiting search warrants or sitting in backlogs at crime labs would routinely reboot themselves, hardening their encryption just as investigators were preparing to examine them.

Magnet’s preservation tools aim to sever that timeline entirely. According to an instructional video obtained by 404 Media, the system captures and maintains the AFU condition even if the physical device loses power or restarts. A Magnet employee in the footage described the retention of the unlocked state as “the true magic” behind the new features, noting that memory maintenance cycles or unexpected power losses no longer strip investigators of their access advantage.

Security researchers note that the promotional materials stop short of explaining the underlying exploit. Jiska Classen, an iPhone security researcher at Germany’s Hasso Plattner Institute, told 404 Media that the video lacks the technical depth required to reverse-engineer Magnet’s method. Classen theorized the company may have discovered a way to manipulate the iPhone’s internal clock to deceive the 72-hour trigger, or found a mechanism to block the specific background software tasks responsible for initiating the forced reboot. She characterized the capability as “quite a game changer,” suggesting it effectively rolls back the defensive advantage Apple provided to users with the introduction of inactivity reboots.

Beyond defeating the reboot timer, the GrayKey Preserve system enforces immediate network isolation upon gaining initial access to a handset. The tool disables Wi-Fi, Bluetooth, and cellular radios at a level deeper than standard iOS controls. The Magnet employee demonstrated that the system can kill these connections even in scenarios where a suspect has configured settings preventing Airplane Mode activation through the standard user interface. This prevents remote wiping commands sent by accomplices and blocks the device from communicating with external servers.

The preservation suite also addresses the ephemeral nature of modern mobile data. Volatile information such as cached GPS coordinates, recently deleted photographs, and iMessages often operate on automated expiration timers governed by iOS housekeeping routines. Magnet claims its tools freeze these assets, preventing the operating system from permanently deleting them during standard maintenance cycles while the device sits in an evidence queue.

Crucially, the workflow allows officers to secure a device without immediately viewing its contents. Personnel can identify the specific iPhone model and installed iOS version to apply the correct preservation parameters, maintaining the chain of custody and respecting Fourth Amendment boundaries until a judge signs a warrant authorizing actual data extraction.

The release underscores the escalating engineering arms race between Apple’s privacy architecture and the commercial surveillance industry. While Apple spent years refining BFU protections and eventually automating them through inactivity reboots, forensic vendors like Magnet, Cellebrite, and MSAB continue to monetize zero-day vulnerabilities and undocumented system behaviors to circumvent those defenses. Apple typically patches exploits used by forensic firms once they become public knowledge, but companies operating under strict non-disclosure agreements with government clients often keep their methods hidden for years to protect their commercial value.

Magnet Forensics, acquired by Thoma Bravo and merged with ADIA-backed Clearlake Capital to form the private entity Magnet Forensics in 2023, distributes GrayKey exclusively to verified law enforcement and government intelligence agencies. The updated Evidence Preservation Mode is currently rolling out to authorized customers operating existing GrayKey deployments globally.