Police Finds a Way to Overcome One of iPhone's Strongest Security Protocols
· AI · Cem Koyluoglu
Cat Wins Final Round of Ongoing Cat-and-Mouse Game Between Apple and Police
TL;DR Magnet Forensics has released GrayKey Preserve, a tool that bypasses Apple’s 72‑hour inactivity reboot, allowing police to keep iPhones in an After First Unlock state. This breakthrough could shift the balance in digital forensics, raising privacy concerns.
Key Highlights • Magnet Forensics' GrayKey Preserve bypasses Apple’s 72‑hour inactivity reboot, enabling law‑enforcement to maintain an After First Unlock state. • The tool keeps the device in airplane mode, cutting off wireless connections and preventing remote interference. • This development raises significant privacy versus law‑enforcement balance questions in digital evidence collection.
New Tool Breaks Apple’s iPhone Lockdown
A recent development in the ongoing cat‑and‑mouse game between law enforcement and Apple appears to have tipped the balance in favor of the former. According to 404 Media, a company that builds tools for police forces has discovered a way to bypass one of Apple’s core security measures that makes it difficult for officers to unlock iPhones that have been seized.
The 72‑Hour Inactivity Reboot
Apple added a feature to its mobile operating system, iOS, in 2024 that triggers an “inactivity reboot” after a device has been idle for longer than 72 hours. When activated, the phone returns to a more secure state: data is encrypted and the device becomes harder for police to access without the user’s passcode. The feature is designed to protect information if a phone sits unused in a evidence locker, for example.
Magnet Forensics’ GrayKey Preserve
Magnet Forensics claims to have found a workaround that enables police to regain access to phones that were previously locked by this protocol. The company released a video in which a Magnet Forensics employee describes its solution, which the firm calls GrayKey Preserve, as a system that can “protect user data for an infinite amount of time” and “a true turning point for iOS forensic science.”
GrayKey Preserve is an extension of Magnet Forensics’ GrayKey tool, which can unlock data stored on iPhone and Android devices without the user’s passcode. GrayKey is reportedly used by more than 1,200 institutions in 40 countries, but its effectiveness had been hampered by Apple’s security protocols that prevented officers from accessing data on seized phones.
After First Unlock (AFU) vs. Before First Unlock (BFU)
GrayKey Preserve allows law‑enforcement officers to keep a phone in an “After First Unlock” (AFU) state. In this mode, some of the device’s data is decrypted, making it easier to access and export. Apple’s 72‑hour inactivity reboot, on the other hand, returns the phone to a “Before First Unlock” (BFU) state, re‑enabling more comprehensive encryption protections.
According to the report, GrayKey Preserve can maintain the phone in the AFU state even after a reboot. The tool also places the device in airplane mode, cutting off wireless connections and making it harder for the owner to remotely interfere with the phone.
Implications for Digital Forensics
The development raises questions about the future of digital evidence collection and the balance between privacy and law‑enforcement needs. While the tool’s creators claim it represents a significant advance for forensic investigators, it also underscores the ongoing tension between technology companies and the agencies that rely on their products for public safety.