Cops Can Bypass iPhone's Automatic Reboot to Get into Locked Phones
Law Enforcement Now Able to Circumvent iPhone's Auto-Reboot Security
A leaked internal video has revealed that Magnet Forensics, the company responsible for the GrayKey unlocking tool, has found a way to neutralize a critical security feature in iPhones designed to lock out investigators.
According to the footage obtained by 404 Media, the company has developed a method to "freeze" iPhones, ensuring that police can access sensitive internal data more effectively. This represents the latest escalation in the ongoing arms race between Apple's privacy protections and the tools used by law enforcement (and potentially authoritarian regimes) to breach them.
The "Inactivity Reboot" Conflict
In November 2024, it was discovered that Apple had implemented a stealthy update to iOS. This feature triggers an automatic reboot if a device remains locked and inactive for 72 hours.
The primary objective of this "inactivity reboot" is to shift the device from an accessible state to a highly secure one, thwarting forensic extraction. Law enforcement agencies were alarmed by this change because they often face delays—such as waiting for judicial warrants or managing a backlog of seized hardware—before they can attempt to crack a phone.
Enter: GrayKey Preserve
To combat this, Magnet Forensics introduced two new capabilities:
- GrayKey Preserve: A dedicated hardware device.
- Evidence Preservation Mode: A software feature integrated into existing GrayKey tools.
Key Capabilities of the New System:
- Bypass Inactivity Reboots: Stops the 72-hour timer from locking the device.
- Prevent Data Expiration: Stops the automatic deletion of iMessages, cached locations, and recently deleted photos.
- Radio Isolation: Forces the device into a state similar to
Airplane Mode. - State Maintenance: Keeps the phone in the AFU state regardless of power loss.
"This is an absolute game changer for iOS forensics and a function that I wish we had years ago," stated a Magnet employee in the leaked tutorial video, which was intended solely for law enforcement and dates back to early 2025.
Understanding AFU vs. BFU
The core of this struggle lies in the difference between two device states. The goal of GrayKey is to ensure the phone stays in AFU, whereas Apple wants to force it into BFU.
| State | Term | Security Level | Data Accessibility |
|---|---|---|---|
| BFU | Before First Unlock | Most sensitive data is encrypted; brute-forcing is extremely difficult. | |
| AFU | After First Unlock | More data is decrypted in memory; significantly easier to extract. |
The employee in the video claims that the "true magic" of the new tool is that the AFU state is captured and preserved. Even if the device suffers a power failure or a system crash, the AFU status is not lost.
Technical Implementation and Privacy
To maintain legal integrity, the tool is designed so that officers do not immediately see the user's private data. Instead, the interface only displays:
Device Model: [Model Name]
Software Version: [iOS Version]
This allows police to the evidence without it until they have the proper legal authorization.
How does it work?
While the video doesn't provide a technical blueprint, Jiska Classen, a security researcher at the Hasso Plattner Institute, offered some theories. She suggests that Magnet may be manipulating the system clock to effectively "stop time" for the OS.
Mathematically, if the system perceives time as: Then the 72-hour threshold for the inactivity reboot is never reached. Classen believes the tool likely disables the specific background tasks responsible for data expiration and reboot triggers.
Current Status
The leaked video confirms that Apple's attempt to block forensic access via auto-reboots has been circumvented. The responsibility now falls on Apple to analyze how Magnet Forensics achieved this "freeze" and develop a patch to prevent it.
