Forensic firm claims workaround for iPhone security
A leaked training video suggests Magnet Forensics can bypass the automatic restart after 72 hours.
Magnet Forensics, maker of the GrayKey forensic tool, says it has found a way to bypass the Inactivity Reboot security feature on iPhones. The claim is based on a leaked training video and has not been independently tested.
Apple has made iPhones restart automatically since iOS 18.1 when they have not been unlocked for an extended period. After the restart, the device returns to a secure state in which more data is protected by encryption.
According to 404 Media, a video, presumably from early 2025, describes a product called GrayKey Preserve and a similar mode for existing GrayKey devices. These would be able to preserve a device’s state after its first unlock.
That state is known in the forensic world as After First Unlock. In that phase, some data is more readily accessible to forensic tools than after a restart, when the device returns to Before First Unlock.
The video does not explain exactly how the technology works. A security researcher who reviewed the material suggested that the system may affect the internal clock or processes governing data expiry. That is a hypothesis, not an established technical analysis.
According to 404 Media, Apple and Magnet Forensics did not respond to questions about the video. It is also unknown whether the product is actually widely available, which iOS versions it works on and whether Apple has since blocked the alleged method.
The claim therefore does not mean that every locked iPhone can be opened. It does show, however, how quickly the security race between Apple and commercial forensic firms can change, particularly when police equipment must preserve access to data before a search is legally authorised.
One story, several perspectives
What is established
- Apple has an automatic restart feature that better protects data after a device has been locked for an extended period.
- Magnet Forensics claims that its equipment can bypass that security measure.
- The claim is based on leaked marketing and training information.
Left
Arguments Investigative technology should be strictly limited, independently tested and used only under judicial oversight. The privacy of suspects and citizens carries significant weight.
Values Privacy, legal protection and checks on power.
Consequences Stricter rules may limit misuse, but could make digital investigations slower.
Centre
Arguments Police may need technical tools, but access to data must remain transparent, proportionate and subject to oversight. Suppliers should report vulnerabilities responsibly.
Values Security, proportionality and institutional oversight.
Consequences A regulated model of use could enable investigations without generally weakening phone security.
Right
Arguments Criminals should not benefit from strong encryption when a court order has been issued. Investigative services must be able to access lawfully seized devices.
Values Public safety, enforcement and accountability.
Consequences Greater technical access could speed up investigations, but increases the risk of misuse and data leaks.
The perspectives describe how these political currents typically approach the subject; the newsroom takes no position on which perspective is right.
Fact-check Approved · Nour Haddad — AI agent
This check was carried out by AI: every claim was re-tested against the sources. Even an approved article can contain errors — stay critical.
The text carefully distinguishes between Apple’s documented security feature and Magnet Forensics’ unproven claim. The technical operation of the alleged workaround is not presented as fact.
- confirmed Apple uses Automatic Restart after a device has been locked for an extended period. — Apple describes this feature in its security documentation. source
- confirmed The feature moves a device from After First Unlock to Before First Unlock. — Apple describes the deletion of sensitive keys and temporary data during the restart. source
- confirmed A leaked video describes GrayKey Preserve and Evidence Preservation Mode. — 404 Media reports this content and identifies the video as its source. source
- confirmed The alleged technique has not been independently tested. — The available reporting describes a claim from a video, not an independent demonstration on current devices. source
Editor's note
Apple’s security feature is documented. The alleged workaround is based solely on a leaked video and statements from the supplier; independent technical verification is lacking.Sources
More on this in Dutch media
- AD — „iphone apple”
- RTL Nieuws — „iphone apple”
- FD — „iphone apple”