A company that makes phone hacking devices claims to have developed a solution that freezes iPhones in a state that lets cops more easily access sensitive data inside them, according to a video obtained by 404 Media.
This is the latest salvo in the never-ending battle between Apple and companies that help cops — sometimes those in authoritarian countries — break into iPhones.
In November 2024, 404 Media revealed Apple quietly introduced a new feature in iOS that automatically reboots an iPhone that has not been unlocked for 72 hours. The idea behind this so-called “inactivity reboot” is to revert the phone to a state that makes it harder for police to break into the device, and thus extract sensitive data from it with forensics technology.
At the time of Apple’s change, law enforcement agents expressed concern about this new feature, given that oftentimes they can’t immediately try to break into iPhones that have been seized. That could be because police are still waiting for a court authorization to do so, or there is simply a backlog of devices to unlock, for example.
The new technology to get around inactivity reboot was developed by Magnet Forensics, the company behind GrayKey, a popular tool sold to law enforcement agencies that allows them to unlock and access data stored in iPhones and Android smartphones. Magnet has developed a new device called GrayKey Preserve and a feature for its regular GrayKey devices called Evidence Preservation Mode, according to the video.
“This is an absolute game changer for iOS forensics and a function that I wish we had years ago,” a Magnet employee says in the leaked video, specifically mentioning that the solution is targeted at the iPhone’s inactivity reboot feature and the data it makes unavailable. GrayKey Preserve and Evidence Preservation Mode are also designed to combat another iPhone feature that automatically deletes certain data — such as cached locations, and recently deleted photos and iMessages — after a certain number of days. “We're gonna be able to preserve that data for an infinite amount of time.”
The educational and tutorial video, which was made exclusively for law enforcement agents and appears to be dated early 2025, does not explain the technical details behind this new product and feature, but gives some strong hints as to how it works. 404 Media granted the person who provided it anonymity because they were not authorized to share it with third parties.
“Now, one of the many things that the GrayKey Preserve is going to do, as part of all of this, inside of our initial access, is it's going to enable Airplane Mode, or more specifically, it's gonna disable our radio transmissions like Bluetooth, Wi-Fi and cellular. In doing this, that's not only going to allow you to preserve the data in the field, but also isolate the data in the field,” the employee explains. “Even if that device doesn't have the ability to turn on Airplane Mode or to turn off the transmitters through the Control Center of iOS. Once initial access is gained and the device is in a preserved state, we also disable all of those radios to make sure that that data cannot reach that device.”
The idea behind GrayKey Preserve and Evidence Preservation Mode is to keep the iPhone in a state known as After First Unlock, or AFU. Having an iPhone in that state essentially allows cops to access data that would otherwise be much harder to obtain if the phone was in a Before First Unlock, or BFU state. If the iPhone is in BFU, certain sensitive data is encrypted, and it can be significantly harder — sometimes even virtually impossible — to brute-force the device’s passcode and unlock it. 404 Media previously obtained lists of iPhones that GrayKey and competitor Cellebrite could access, with variations between phones in an AFU and BFU state.
“That AFU state is captured,” by GrayKey Preserve and Evidence Preservation Mode, the employee says. “Even if that device does reboot for any number of reasons, memory maintenance or the power is lost or whatever, the AFU state is not lost. This is the true magic behind the GrayKey Preserve and the Evidence Preservation Mode function.”
When using this new solution, law enforcement agents only see the iPhone’s software version and device model, rather than any data within, according to the employee and a screenshot of GrayKey’s customer interface included in the video. That allows the cops to preserve the data they care about without actually seeing it before they are authorized to do so.
Apple and Magnet did not respond to a request for comment.
404 Media shared a transcript of the video with Jiska Classen, a researcher at the Hasso Plattner Institute who studies iPhone security. While Classen said that it’s impossible to know for sure how Magnet’s new feature works based on the video, she posited some theories and agreed that it is “quite a game changer” or “at least puts things back to where they were before inactivity reboot.”
She thinks Magnet has found a way to manipulate the iPhone’s clock, effectively “slowing down time” or even “stopping the clock from ticking, even after a reboot.” Most likely, according to her, the GrayKey may disable the iPhone tasks that set data to expire.
What is certain is that the ball is now in Apple’s court to figure out how Magnet got around inactivity reboot, and find a way to prevent the company and its technology from freezing iPhones — and the sensitive data stored in them — in time.