GrayKey Claims It Can Defeat Apple’s 72-Hour Inactivity Reboot
Malwarebytes Labs
Toggle Dark Mode
Magnet Forensics, maker of the GrayKey phone unlocking tool, claims to have found a way to bypass a recently added iPhone security feature that automatically reboots devices that haven’t been unlocked for 72 hours.
The solution freezes an iPhone in a state that makes it easier for law enforcement and government types to access the sensitive data stored in the device’s silicon, according to a video obtained by 404 Media.
Inactivity Reboot
Not long after Apple released iOS 18.1 in November 2024, we reported that frustrated law enforcement officials were becoming concerned that iPhones were secretly communicating with each other to force reboots. However, while Apple had indeed made a subtle change in that iOS update, the truth wasn’t quite as sinister as forensic investigators had first thought.
The update brought a new feature dubbed “inactivity reboot,” which forces an iPhone to restart if it hasn’t been unlocked in the last 72 hours. While the feature is ostensibly designed to improve security and privacy by making it harder for bad actors to find a way into a stolen iPhone, that made it equally challenging for law enforcement and alphabet agencies like the FBI to break into the device’s treasure chest of data.
You see, many of the fancy and expensive tools used by forensic specialists to unlock iPhones rely on a locked iPhone being in an “AFU” state. AFU is short for “after first unlock.” This officially documented mode refers to a less restrictive state where certain information remains stored in memory in an unencrypted form.
This differs from “BFU” or “before first unlock,” where nearly everything on the iPhone remains in an encrypted state until the user enters their passcode or password to automatically decrypt the device.
You may have already noticed the difference between these two states without realizing it; when restarting your iPhone, it won’t even connect to your home Wi-Fi network until you’ve unlocked it at least once, after which it stays connected even when it’s locked. That’s because your saved Wi-Fi password is one of those pieces of information that remains unencrypted in the AFU state.
While most of the data on your iPhone is still safely encrypted whenever it’s locked, the AFU state is designed to ensure that your iPhone can stay connected to things like Wi-Fi networks, e-mail accounts, social media accounts, and VPNs, which means all the passwords and credentials for these other services remain accessible until the iPhone is rebooted again, which returns the handset to a BFU state.
The 72-hour auto-reboot means that even if law enforcement seizes a device, it can return to its BFU state before investigators can obtain a warrant to access it or before the device can even be transported to a forensic lab.
Further, forensic technicians are often forced to keep confiscated iPhones in storage, waiting for GrayKey and other tools to catch up to security improvements in the latest iOS releases before they can hack them. Traditionally, labs have kept all these seized devices connected to power to ensure they don’t restart and end up in the BFU state — until iOS 18.1 came along and foiled that strategy.
How GrayKey Is Said to Bypass Inactivity Reboot
According to 404 Media, a leaked tutorial video from early 2025 made exclusively for law enforcement agents indicates that Magnet Forensics, the company behind the GrayKey phone unlocking tool, has developed a way to bypass the Inactivity Reboot feature present on any iPhone running iOS 18.1 or later.
The report says Magnet came up with a new device called GrayKey Preserve, while also adding an Evidence Preservation Mode to its existing GrayKey hardware.
The new gimmick basically freezes an iPhone in its current forensic state without immediately exposing the data stored on the device. This allows investigators to preserve that state while waiting for authorization to search it or ship it to a forensics lab.
While the video doesn’t provide any details as to how the workaround, um, works, it does explain that GrayKey can preserve an iPhone’s AFU state even after a reboot.
“This is an absolute game changer for iOS forensics and a function that I wish we had years ago,” a Magnet employee says in the leaked video. The new GrayKey Preserve and Evidence Preservation Mode tools are also designed to foil another iPhone feature, which automatically deletes certain data — including recently deleted photos, iMessages, and cached locations — after a certain number of days. “We’re gonna be able to preserve that data for an infinite amount of time.”
“That AFU state is captured,” the employee continues, “Even if that device does reboot for any number of reasons, memory maintenance or the power is lost or whatever, the AFU state is not lost. This is the true magic behind the GrayKey Preserve and the Evidence Preservation Mode function.”
While 404 Media says it has reached out to both Apple and Magnet Forensics for comment, neither has responded. The publication did consult with iPhone security researcher Jiska Classen, who theorized that the forensics firm may have discovered a method of manipulating the iPhone’s clock, or to somehow turn off the data expiration processes altogether.
At this point, we don’t know whether the new technology has been used in actual investigations, or whether it still works against later versions of iOS, like iOS 26 or the recently-released iOS 27.
