Apple built the 72-hour inactivity reboot into iOS 18.1 to push unattended iPhones into a harder-to-crack security state. A leaked training video obtained by 404 Media reportedly shows Magnet Forensics claiming its GrayKey tools can preserve that more accessible forensic state, even after a reboot or power loss.
What the Leaked Video Claims
A reported Magnet Forensics presentation describes two products designed to keep a seized iPhone accessible through reboots and power loss, though the video’s technical claims are not independently verified.
According to 404 Media’s report, the video shows Magnet Forensics presenting two products: GrayKey Preserve and Evidence Preservation Mode. Both are described as keeping a seized iPhone in its After First Unlock (AFU) state even if the device subsequently reboots or loses power. The video’s authenticity and its technical claims have not been independently verified.
That AFU and BFU distinction matters here. AFU refers to the state after a user has unlocked the phone at least once since booting; some protected data remains more accessible to forensic tools in this state. Before First Unlock (BFU) is the harder-to-crack state a phone returns to after a reboot, before the passcode is entered again.
An unidentified Magnet Forensics employee spoke in the leaked training video, as reported by 404 Media. That employee stated: “Even if that device does reboot for any number of reasons, memory maintenance or the power is lost or whatever, the AFU state is not lost.” That claim is not independently confirmed.
The video also reportedly says the preservation process disables cellular, Wi-Fi, and Bluetooth transmissions after initial access. The stated purpose, according to the leaked material, is to isolate the device while maintaining its forensic state, though this detail comes from the video alone and has not been independently tested.
What’s Confirmed, What Isn’t
Two facts are independently established; the core preservation claim, however, remains reported but unverified.
Apple introduced the inactivity reboot in iOS 18.1, with the interval reported at 72 hours, according to coverage by TechCrunch and MacRumors. Independent analysis confirmed the timer is managed through the Secure Enclave; per that analysis, it operates regardless of cellular or Wi-Fi connectivity.
Magnet’s public product page confirms GrayKey Preserve exists and describes preservation capabilities intended to reduce data loss from automatic reboot timers. The cited product page does not disclose the underlying technical method.
Whether GrayKey Preserve can actually maintain AFU state through a reboot or power loss is reported but not independently demonstrated. Researcher Jiska Classen of the Hasso Plattner Institute offered an assessment, as characterized through coverage of the leaked video. She reportedly concluded the alleged capability could restore forensic access to pre-reboot levels.
Classen also reportedly speculated the system might manipulate the device’s clock or disable data-expiration tasks. That theory is speculative and is not established by the leaked video or Magnet’s public materials.
One important clarification: this does not mean every locked iPhone can be unlocked or that all data becomes readable. Forensic access still depends on the device model, iOS version, passcode, and the specific capabilities of the tool being used.
A second unidentified employee, also featured in the leaked training material reported by 404 Media, said: “This is an absolute game changer for iOS forensics and a function that I wish we had years ago.” That statement reflects a purported employee’s characterization of the product and has not been independently verified. Apple and Magnet reportedly did not respond to requests for comment.
An Ongoing Security Contest
This development reflects a continuing cycle in which Apple strengthens protections and forensic vendors respond with tools aimed at preserving access before those protections take effect.
Apple tightens protections that return seized devices to BFU, while forensic vendors develop tools aimed at preserving or attempting to maintain the more accessible AFU state before that transition occurs. Apple may respond to the alleged preservation method in a future iOS update, though no such response has been announced.
For iPhone users, a locked phone’s security posture is not static. It shifts based on iOS version, how long the device has been unattended, and the forensic tools an examiner has available.
