GrayKey can keep a seized iPhone unlockable after Inactivity Reboot, a leaked Magnet Forensics video claimsGrayKey can keep a seized iPhone unlockable after Inactivity Reboot, a leaked Magnet Forensics video claims

A Magnet Forensics training video obtained by 404 Media claims the company's GrayKey tools can keep a seized iPhone in its after-first-unlock state even when the phone restarts.

404 Media published the report on 1 October, written by Lorenzo Franceschi-Bicchierai. The video dates from early 2025 and describes two products: GrayKey Preserve, a separate device, and Evidence Preservation Mode, a feature for existing GrayKey units. According to the report as relayed by 9to5Mac, a Magnet presenter says the after-first-unlock state is not lost even if the device reboots. AppleInsider, 9to5Mac and Engadget all reported the claim the same day, each crediting 404 Media. None of them did separate reporting, so this is one source.

What Inactivity Reboot is meant to do

Inactivity Reboot arrived quietly in iOS 18.1 in October 2024. Security researcher Jiska Classen reverse-engineered it a month later and found the timer lives in the Secure Enclave: if an iPhone has not been unlocked for 72 hours, it restarts. A restart moves the phone from after first unlock, where many encryption keys are held in memory, to before first unlock, where almost all user data stays encrypted until the passcode is entered. Forensic tools have far less to work with in the second state.

What exactly is being claimed?

The claim is narrow, and it matters to read it that way. It is about preserving a phone that was already in the after-first-unlock state when it was connected. Nothing in the reporting suggests GrayKey can unlock a phone that has already restarted, or one that was switched off when it was seized.

According to 9to5Mac and AppleInsider, the video also says the tools switch off cellular, Bluetooth and Wi-Fi, and stop iOS deleting data that normally expires, such as cached locations and recently deleted photos and messages. The video does not explain how. Classen suggested to 404 Media that it could involve manipulating the clock or disabling the expiry tasks. Neither Apple nor Magnet commented to 404 Media.

The product itself is not a secret. Magnet announced GrayKey Preserve publicly in early 2025 as an answer to the reboot timer, and published a blog post on preserving evidence against inactivity timers in December 2025. What the video adds is the specific claim about surviving a restart.

What is still unknown

No iOS version is named. The video is around 18 months old, and 9to5Mac notes it is not known whether the technique still works on current software. Apple has shipped iOS 26 and iOS 27 since. Nobody outside Magnet has tested it.

Our take

APPDOOK's reading is that this is less a break in Apple's design than a race against a timer that was always going to be raced. Inactivity Reboot works by forcing a phone back into its safest state before an examiner gets to it. If a tool connected within that window can stop the clock from mattering, the protection still holds against phones that sit in an evidence bag, but not against phones plugged in promptly.

For most iPhone owners the practical advice is unchanged by any of this, and it is the same advice the feature was built around. A phone in before-first-unlock state is the hard target. Restarting an iPhone, or switching it off, before handing it over or crossing a border where it may be taken puts it there, and nothing reported here touches that state.

The bigger question is for Apple. Magnet marketed this product openly for over a year, and the video's age suggests Apple has had every opportunity to respond in software. Whether it has done so silently, as it introduced the reboot timer in the first place, is something only a test on iOS 27 would show. Until someone runs one, the honest answer is that we do not know.