Cops Can Bypass iPhone's Automatic Reboot to Get into Locked Phones

Law enforcement can now access more iPhone data, even from locked phones that have rebooted.

Magnet Forensics, a company specializing in law enforcement tools, has developed a new method to bypass Apple's 'inactivity reboot' feature on iPhones. This feature, introduced in late 2024, automatically reboots iPhones left unlocked for 72 hours, reverting them to a state that makes data extraction more difficult for authorities. Magnet's new 'GrayKey Preserve' and an 'Evidence Preservation Mode' for its existing GrayKey devices are designed to circumvent this reboot, effectively freezing the phone's data in an 'After First Unlock' (AFU) state. This allows law enforcement to access sensitive information that would otherwise be encrypted or deleted after a reboot or a period of inactivity. The company claims this technology can preserve data, including cached locations and recently deleted messages, indefinitely, even if the device loses power or reboots.

Magnet Forensics' new technology represents a significant escalation in the ongoing cat-and-mouse game between device manufacturers aiming to enhance security and law enforcement agencies seeking access to digital evidence. By circumventing the inactivity reboot, Magnet is effectively restoring the investigative capabilities that Apple's security measure sought to curtail. This development suggests a market for specialized forensic tools that can keep pace with evolving device security features, potentially driving further innovation and counter-innovation from both Apple and its competitors.

The ability to preserve data indefinitely, particularly in the AFU state, has broad implications for digital forensics, potentially impacting how investigations are conducted and the types of evidence that can be reliably collected. It also raises ongoing privacy concerns, as the tools capable of bypassing these security measures can be acquired by agencies worldwide, including those with questionable human rights records. The effectiveness of this new tool will likely prompt Apple to develop further countermeasures, continuing the cycle of security enhancements and circumvention.