Apple spent years marketing privacy as a feature. So when it quietly rolled out an inactivity reboot in 2024, which automatically restarts iPhones that haven’t been unlocked in 72 hours, it looked like a genuine win for users. The idea was simple: a rebooted phone is harder to crack. Law enforcement confirmed this was a real obstacle. But a new training video suggests that advantage may already be slipping away.
According to Engadget, 404 Media obtained a training video made for law enforcement that allegedly shows how tools from Magnet Forensics can work around the inactivity reboot feature. Magnet makes GrayKey, a device sold almost exclusively to police agencies for unlocking smartphones. The company claims it has now built a workaround into two new products: something called GrayKey Preserve and an Evidence Preservation Mode built into GrayKey itself.
The video doesn’t explain the technical method in detail. But 404 Media suggests the tools work by keeping the phone in what’s known as the After First Unlock state, commonly called AFU. This matters because a phone in AFU has far more data accessible than one in the Before First Unlock state. In BFU, encryption is tighter and the device is significantly harder for anyone except the owner to get into. A Magnet employee is quoted in the video saying, “Even if that device does reboot for any number of reasons, memory maintenance or the power is lost or whatever, the AFU state is not lost.” Another employee reportedly calls it “an absolute game changer for iOS forensics.”
That framing should give anyone pause. Magnet is essentially claiming it can neutralize a security feature Apple built specifically to protect users after periods of inactivity. And the claimed capabilities don’t stop at bypassing the reboot. The company also says its tools can stop iPhones from automatically deleting certain data over time, including:
- Cached location data
- Recently deleted iMessages
- Recently deleted photos
This is where the privacy implications get serious. Apple’s automatic data deletion exists partly to protect users. Freezing that process means investigators can potentially access information the phone was designed to remove.
The broader context makes this more uncomfortable. Both local police departments and federal agencies have faced repeated accusations of overreach when it comes to digital surveillance. Tools like GrayKey don’t exist in a vacuum. They exist in a system where oversight is inconsistent and legal standards for accessing phone data vary widely depending on jurisdiction.
Apple has not publicly responded to the claims in the video, and Magnet hasn’t provided a technical breakdown of how the tools actually work. So there are still open questions. But if the claims hold up, Apple’s inactivity reboot, one of the more meaningful privacy protections the company has added in recent years, is already being quietly dismantled by the forensics industry. Users who assumed a locked, rebooted iPhone was a protected iPhone may need to rethink that assumption.