Security
A Forensics Vendor Told Police It Can Keep a Seized iPhone Unlocked Indefinitely. The Video Making the Claim Is Eighteen Months Old
A leaked law-enforcement training video reviewed by 404 Media shows Magnet Forensics marketing a way to hold a seized iPhone in its After First Unlock state through Apple's 72-hour Inactivity Reboot. The capability is an unverified vendor claim; the eighteen months between the video and its disclosure is not.
MAI
A training video made for law enforcement and reviewed by 404 Media shows an employee of Magnet Forensics telling police customers that the company can stop a seized iPhone from falling back into its most protected state, and hold it there — in the employee's words — "for an infinite amount of time." The video is dated early 2025. The public learned of it on 1 October 2026.
Two things need separating. One is the capability itself, which is a vendor claim made in a sales-and-training video and has not been independently verified. The other is the roughly eighteen months between the video's date and its disclosure. The second is the verified part, and it is the more consequential one.
What Apple built, and what it protects
Apple shipped Inactivity Reboot in iOS 18.1 in late 2024. The behaviour is plain: an iPhone that has gone 72 hours without being unlocked restarts itself. The restart is not the point. The state it produces is.
| State | When a device is in it | What is reachable |
|---|---|---|
| After First Unlock (AFU) | The passcode has been entered at least once since boot | Keys for most user data are resident in memory; extraction tools can recover a great deal |
| Before First Unlock (BFU) | Freshly booted, passcode not yet entered | Most user data remains encrypted; extraction recovers comparatively little |
A phone taken at an arrest is usually in AFU. Before Inactivity Reboot existed, it stayed in AFU for as long as it had power — which, in an evidence room with a charger, means indefinitely. Apple's feature put a 72-hour clock on that window, and was read at the time as a deliberate constraint on exactly the sort of extraction GrayKey performs.
The claim
Magnet Forensics owns GrayKey, the extraction appliance sold to police forces worldwide. According to 404 Media, the video describes two offerings: GrayKey Preserve, a separate device, and Evidence Preservation Mode, a feature for GrayKey units already in the field. The pitch is that a connected iPhone keeps its AFU state through the inactivity reboot, and through other reboots as well.
"Even if that device does reboot for any number of reasons, memory maintenance or the power is lost or whatever, the AFU state is not lost."
The same employee calls it "an absolute game changer for iOS forensics." Engadget reports the video further claims the tooling holds off the housekeeping an iPhone performs on its own, including the expiry of cached location history and of recently deleted messages and photos.
Jiska Classen of the Hasso Plattner Institute, who has published extensively on iPhone internals, told 404 Media the development is "quite a game changer." Her reading is the useful one for judging severity: what appears to be under attack is the bookkeeping around the timeout, not Apple's cryptography. Nothing reported here suggests a weakness in how an iPhone encrypts data at rest. It suggests the countdown that is supposed to re-encrypt it can be prevented from finishing. The technical remainder belongs with Apple and the researchers, not here.
Apple did not respond to 404 Media's requests for comment.
The eighteen months are the finding
Treat the capability as unproven and the story is still significant, because the timeline is not in dispute. A protection Apple shipped as a hard limit on forensic access was, on the vendor's own telling, already being marketed as solved by early 2025 — and the people the feature was built to protect found out in late 2026, from a leaked video, rather than from a researcher, a court filing, or Apple.
That is the structural problem with this market, and it is not new. Capabilities sold to governments under non-disclosure become public when someone breaks the non-disclosure, and until then a user reading Apple's release notes has a materially wrong picture of what their device resists.
What is still unknown
A great deal, and the gaps matter. Neither 404 Media nor the reporting that followed establishes which iOS versions the technique covers, whether it works against current releases, whether it has been used in real cases, or whether Apple has since closed it. A video from early 2025 describes the state of the world in early 2025. Apple has shipped two major iOS versions since.
What to do about it
The defensive advice does not change, because it never depended on this feature. A powered-off iPhone is in BFU, and that is the strongest position a device can be in when it leaves your hands. Inactivity Reboot was always a safety net for the case where you could not power it down yourself — a phone already seized, already lost, already in a drawer somewhere. So if you expect a device to be taken or to go missing, power it off rather than locking it; and in BFU the passcode is what stands between an extraction tool and the data, which is the argument for a long alphanumeric passcode over six digits.
The broader lesson is about which protections survive contact with an adversary holding your hardware. Encryption holds because the mathematics holds. A feature that asks a device to police itself while sitting on someone else's bench is a weaker category, and this is what it looks like when that difference is tested.
---
Sources: 404 Media — Cops Can Bypass iPhone's Automatic Reboot to Get Into Locked Phones, Leaked Video Claims · Engadget — Police may have new ways to access data on locked iPhones · 9to5Mac — GrayKey maker can reportedly bypass the iPhone's 'Inactivity Reboot' security feature · Apple — security releases