How Police Might Keep Data on Locked iPhones Longer
Magnet Forensics has built a way to keep access to locked iPhone data that Apple would normally block, according to a police training video reviewed by 404 Media. The account was published on Oct. 1, 2026. The claim is about two new products: a GrayKey Preserve tool and an Evidence Preservation Mode for GrayKey. Engadget
Apple added the inactivity reboot to many iPhones in 2024. If a phone is not unlocked for more than 72 hours, it restarts itself. That restart locks the phone more tightly, with fewer temporary codes left for copying tools to use. It works like a safe that locks itself fully after three days idle.
Magnet Forensics makes GrayKey, which it mainly sells to police as a means of unlocking smartphones. According to the training video, the company made the bypass to fight the inactivity reboot. The video reportedly shows Magnet tools opening data normally blocked after that waiting period ends.
404 Media suggested that the Magnet method keeps the iPhone in a state called After First Unlock. That means the phone was unlocked once since it was turned on, so it still holds extra codes in short-term memory. A Magnet speaker said in the video that the After First Unlock state is not lost even if the device reboots, loses power, or undergoes memory maintenance. If accurate, investigators could keep access through restarts that would normally wipe those codes.
Magnet workers claimed in the video that the new products can also stop the iPhone from auto-deleting certain data after a number of days, including cached locations and recently deleted iMessages and photos. There are often delays between seizure, transport, warrant approval, and lab work that run past the time those temporary items are kept.
The current claim is part of a longer fight over iPhone USB and lock-screen access. In March 2018, Grayshift began selling a $15,000 GrayKey device that police can use to unlock iPhones themselves. In June 2018, Apple planned to close an iPhone security hole that police used to crack devices. CNBC
Apple has a Wired Accessories setting under Settings > Privacy & Security > Security to control USB and other accessory connections. Apple Support Apple states that the Restricted Mode setting on iPhone or iPad can be controlled by a device management administrator through USB Restricted Mode. Apple Deployment For iOS 18.3.1 and iPadOS 18.3.1, Apple said a physical attack may turn off USB Restricted Mode on a locked device. Apple stated it was aware of a report that the issue may have been exploited. Apple Support
Other police tools have worked better at some times than others. Leaked April 2024 documents found and checked by 404 Media showed Cellebrite could not unlock a large chunk of modern iPhones. 404 Media Cellebrite is an Israeli company. Micro Systemation made an application called XRY that can crack an iOS or Android phone's passcode. Federal investigators forced an iPhone X owner to unlock their device with their face in a child abuse investigation. The FBI appears to have a tool that can access Signal messages on a locked iPhone, according to a Department of Justice file. Separately, Apple stated that the government asked a court to order Apple to create a unique version of iOS to bypass security protections on the iPhone lock screen. Apple
The broader context here is a simple pattern. Tool makers find ways to hold onto access, Apple tightens settings and shortens how long data stays, and labs change how they hold phones to keep them as open as possible.
In my view, the inactivity reboot made delay more costly for police, and Preserve-style tools are about buying that time back rather than breaking the passcode itself. The open questions are whether it works on all models, iOS versions, and power states, and whether a court will accept evidence gathered this way. People who update promptly still get stronger protection, and this back-and-forth tends to make phones tougher over time.
