GrayKey Preserve Allegedly Keeps Locked iPhone Data Past Apple's 72-Hour Reboot
Magnet Forensics has built a workaround that allegedly preserves access to locked iPhone data that Apple's inactivity reboot would otherwise cut off, according to a law-enforcement training video reviewed by 404 Media. The account was published on Oct. 1, 2026. The claim centers on two new offerings: a GrayKey Preserve tool and an Evidence Preservation Mode for GrayKey. Engadget
Apple added the inactivity reboot to many iPhones in 2024. If a phone goes more than 72 hours without being unlocked, it restarts on its own. That restart returns a seized phone to a more locked-down state, with fewer decryption keys held in memory for extraction tools to use. Think of it as the phone putting its keys back in the safe after three days idle.
Magnet Forensics makes GrayKey, which it primarily sells to police as a means of unlocking smartphones. According to the training video, the company built the bypass specifically to counter the inactivity reboot. The video allegedly shows Magnet tools reaching data normally blocked after that reboot interval expires.
404 Media suggested that the Magnet approach keeps the iPhone in a state called After First Unlock. That means the phone has been unlocked at least once since it was switched on, so it keeps extra keys in temporary memory. A Magnet representative said in the video that the After First Unlock state is not lost even if the device reboots, loses power, or undergoes memory maintenance. If accurate, investigators could retain logical access across events that would normally clear that temporary key material.
Magnet workers claimed in the video that the new products can also prevent automatic iPhone deletion of certain data after a number of days, including cached locations and recently deleted iMessages and photos. Seizure workflows often include delays between seizure, transport, warrant approval, and lab processing that run past retention windows for those short-lived records.
The current claim fits a longer contest over iPhone USB and lock-screen access. In March 2018, Grayshift began selling a $15,000 GrayKey device that police can use to unlock iPhones themselves. In June 2018, Apple planned to close an iPhone security hole that police used to crack devices. CNBC
Apple provides a Wired Accessories setting under Settings > Privacy & Security > Security to control USB and other accessory connections. Apple Support Apple states that the Restricted Mode setting on iPhone or iPad can be managed by a device management administrator via USB Restricted Mode. Apple Deployment For iOS 18.3.1 and iPadOS 18.3.1, Apple documented that a physical attack may disable USB Restricted Mode on a locked device. Apple stated it was aware of a report that the issue may have been exploited. Apple Support
Other forensic capabilities have risen and fallen in parallel. Leaked April 2024 documents obtained and verified by 404 Media showed Cellebrite could not unlock a large chunk of modern iPhones. 404 Media Cellebrite is an Israeli company. Micro Systemation developed an application called XRY that can crack an iOS or Android phone's passcode. Federal investigators forced an iPhone X owner to unlock their device with their face in a child abuse investigation. The FBI appears to have a tool that can access Signal messages on a locked iPhone, according to a Department of Justice file. Separately, Apple stated that the government asked a court to order Apple to create a unique version of iOS to bypass security protections on the iPhone lock screen. Apple
The broader context here is a familiar procurement and patch cycle. Vendors find persistence or extraction paths, Apple hardens defaults and shortens data lifetimes, and labs adjust seizure procedures to preserve the most permissive state possible.
In my view, the inactivity reboot raised the cost of delay for law enforcement, and Preserve-style tooling is best understood as an attempt to buy that time back rather than to defeat the passcode itself. For labs, the practical questions are reliability across models, iOS versions, and power states, and whether evidence gathered this way holds up in court. The long arc still favors stronger default encryption for users who update promptly, and that back-and-forth tends to leave phones more resilient over time.
