Magnet Forensics claims it can bypass Apple's 72-hour auto-reboot and freeze an iPhone in a state where the data inside is far easier for police to reach.
Apple and the companies selling lock picks have been playing cat and mouse for years.
In late 2024 Apple quietly shipped a feature: an iPhone that has not been unlocked for 72 hours reboots itself. After a reboot the phone drops back into its strictest encrypted state, and a seized handset is much harder for police to crack.
The trouble is that police often cannot start right away. They may still be waiting on a court order, or there is simply a backlog of devices.
The lock sellers and the lock buyers
Magnet Forensics is the company behind GrayKey, a tool police forces buy to unlock iPhones. According to an internal training video obtained by 404 Media, it has a new device called GrayKey Preserve and a new mode for its regular units called Evidence Preservation Mode.
The method: once the tool has taken over the phone, it forces Airplane Mode and cuts Bluetooth, Wi-Fi and cellular. The employee in the video says this works even when the iPhone itself cannot switch those radios off from iOS.
Time, put on pause
An iPhone is in one of two states. If it has never been unlocked since booting, the data is sealed tight; once it has been unlocked, many keys still sit in memory and forensic tools have a seam to work.
The tool's job is to freeze that second state. Even if the phone reboots for memory maintenance or loses power, the state is not lost. Jiska Classen, who studies iPhone security, suspects Magnet is manipulating the phone's clock, slowing time down or stopping it altogether.
It also goes after another Apple feature: cached locations, recently deleted photos and iMessages that normally expire after a set number of days. The tool claims it can keep that data forever.
The ball is now back on Apple's side of the court.
Why it matters
Whether a phone is actually locked is never Apple's decision alone — it is a tug of war between two companies, fought in courtrooms and in code. The 72-hour auto-reboot is real protection for ordinary users, but it only lasts until the next bypass is found.
Curated from high-quality sources, with concise summaries and key takeaways.
