A promotional video produced by Magnet Forensics and obtained by 404 Media reveals that the company has built a workaround for Apple's "inactivity reboot" feature—the mechanism that automatically restarts an iPhone after 72 hours without a user unlock, forcing the device back into a Before First Unlock (BFU) state where most user data remains encrypted and far harder to extract.

### The feature Magnet is targeting

In November 2024, Apple quietly shipped an inactivity reboot in iOS. If an iPhone goes 72 hours without being unlocked, it restarts itself. The reboot moves the device from After First Unlock (AFU)—where decryption keys for user data are in memory and forensic tools like GrayKey and Cellebrite can often access substantial data—to Before First Unlock (BFU), where those keys are purged and brute-forcing the passcode becomes impractical on modern hardware. The feature originated in GrapheneOS, which defaults to an 18-hour timer and lets users set anything from 10 minutes to 72 hours; Apple and Google's stock Pixel implementation fixed the window at 72 hours with no user configuration.

Law enforcement agencies had complained that the 72-hour window sometimes expired before they could obtain a warrant or clear a backlog of seized devices.

### What Magnet's new tools do

According to the leaked video—dated early 2025 and made exclusively for law enforcement—Magnet has introduced two related capabilities:

* **GrayKey Preserve**, a dedicated hardware device. * **Evidence Preservation Mode**, a feature for existing GrayKey units.

Both are designed to "capture" the AFU state and keep it durable. The video describes the process:

1. On initial access, the tool enables Airplane Mode (or directly disables Bluetooth, Wi-Fi, and cellular radios), isolating the device from network commands that could trigger a wipe or reboot. 2. The tool then maintains the AFU state "for an infinite amount of time," even if the phone reboots due to memory maintenance, power loss, or the inactivity timer itself. 3. It also blocks automatic deletion of ephemeral data—cached locations, recently deleted photos, and recently deleted iMessages—that iOS normally purges after a set number of days.

The video emphasizes that officers using the tool see only the iPhone's software version and model, not the actual data, preserving chain-of-custody until a warrant authorizes a full extraction.

### How it might work

404 Media shared a transcript with Jiska Classen, a researcher at the Hasso Plattner Institute who studies iPhone security. Classen cautioned that the video does not reveal technical details, but she offered two plausible theories:

* **Clock manipulation**: The GrayKey may interfere with the iPhone's timekeeping—"slowing down time" or "stopping the clock from ticking, even after a reboot"—so the 72-hour inactivity counter never reaches its threshold. * **Task suppression**: The tool may disable the specific iOS background tasks responsible for expiring cached data and triggering the inactivity reboot.

Classen called the development "quite a game changer" or at minimum a return to the pre-inactivity-reboot status quo.

### Context: an ongoing arms race

The inactivity reboot was Apple's response to the steady improvement of mobile forensic tools. Leaked Cellebrite documents from April 2024, previously reported by 404 Media, showed that even Cellebrite—GrayKey's main competitor—could not unlock a large portion of modern iPhones at that time. Both companies sell primarily to law enforcement, though their tools have also been documented in use by authoritarian governments.

Magnet's claimed bypass illustrates the familiar pattern: a platform vendor deploys a mitigation, forensic vendors find a workaround, and the cycle repeats. Apple and Magnet did not respond to requests for comment.

### What remains uncertain

* The exact technical mechanism is not publicly documented; Classen's theories are informed speculation. * It is unknown whether the bypass works on all iPhone models and iOS versions, or only a subset. * Apple's response—whether via a software update, hardware change, or legal action—has not been announced. * The video shows a prototype or early-release capability; real-world deployment scale and reliability are unverified.