A claimed countermeasure to automatic rebooting
Magnet Forensics, the company behind the GrayKey phone-access system, says it has developed technology intended to stop seized iPhones from automatically rebooting before investigators can examine them. The claim appears in a company video obtained by 404 Media and concerns a security feature that can make data extraction more difficult after a device has remained locked.
Apple introduced the behaviour known as inactivity reboot in 2024. According to 404 Media’s earlier reporting, an iPhone that has not been unlocked for 72 hours can restart automatically. A restart returns the device to a more protected condition before the owner enters a passcode, limiting the material available to some forensic techniques.
That clock presents a practical obstacle for agencies holding a phone. Investigators may need to secure legal authorization before examining it, while forensic laboratories can also have queues of devices awaiting work. If the phone restarts during that period, the opportunity to use certain extraction methods may narrow.
Magnet’s response has two elements, according to the obtained video: a separate product called GrayKey Preserve and an Evidence Preservation Mode for existing GrayKey equipment. The company describes them as ways to freeze an iPhone in a state that leaves more data accessible to forensic examination. The supplied evidence does not include an independent technical test, supported iPhone models or iOS versions, or details of the mechanism involved. The capability should therefore be treated as a vendor claim rather than a universally demonstrated bypass.
The security contest continues
GrayKey is sold to law-enforcement agencies for accessing data on iPhones and Android devices. Its latest claimed capability sits within a recurring contest between mobile-platform security changes and specialist forensic vendors that try to work around them. A defensive feature can reduce the useful window for extraction, while vendors respond with hardware, software or handling procedures designed to preserve that window.
The stakes extend beyond a single investigation. Modern phones contain messages, location histories, photographs, account tokens and other sensitive records. Apple’s automatic reboot raises the barrier to accessing that information without the passcode. Tools that prevent or neutralize it would shift some advantage back toward agencies that possess a seized device.
The report also leaves important questions unanswered. It does not say whether Apple can detect or block the preservation method in a later update, whether physical access alone is sufficient, or whether the approach works reliably across current devices. Nor does it change the legal rules governing a search; technical capability and authorization are separate issues.
For now, the significance lies in Magnet’s assertion that the 72-hour safeguard is no longer an absolute deadline for customers using its equipment. Independent validation will be needed to determine the breadth and durability of that claim. As Apple and forensic suppliers continue to adjust their systems, the condition in which authorities store a locked phone may remain as consequential as the extraction tool eventually connected to it.
