Magnet Forensics has built new digital forensic equipment designed to override Apple’s built-in defenses and stop iPhones from restarting automatically after prolonged inactivity. An internal training video from the developer revealed a hardware unit called GrayKey Preserve alongside an Evidence Preservation Mode feature, both engineered to ensure that seized smartphones remain available to criminal investigators.
The forensic mechanisms specifically target a safeguard introduced in Apple‘s iOS 18.1 operating system, rolled out on November 1, 2024, which triggers an automated device restart once 72 hours pass without an unlock. Apple instituted that operational countdown to force devices back into a Before First Unlock state, a heavily encrypted tier that locks down core internal file systems against digital extraction utilities.
New forensic hardware stops automatic reboot timers on Apple devices
The newly designed hardware prevents iPhones from falling back into that hardened cryptographic lockdown, maintaining an intermediate After First Unlock posture even if the phone experiences a battery shutdown or a forced restart. To secure that environment, the utility immediately severs all radio communication pathways across the phone, disabling cellular antennae, Wi-Fi connections, and Bluetooth to block incoming wipe instructions issued remotely by device owners.
Law enforcement agencies had sought this capability after finding it difficult to conduct forensic work under the tight 72-hour window imposed by Apple‘s software. Police departments across the United States reported procedural delays in securing search warrants before impounded handsets sitting in evidence storage lockers triggered their internal restart cycles. Product materials from Magnet Forensics indicate that its GrayKey product line currently serves 1,200 police departments and government bodies across 40 countries.
Check out: Apple plans smart home event on October 13 for three devices
A company staff member featured in the leaked instructional video praised the technical breakthrough, stating that the capability marks an absolute game changer for iOS forensics and represents a feature investigators needed years ago. Hasso Plattner Institute security researcher Jiska Classen analyzed the development, noting that the technique restores forensic access to the operational standing investigators held before Apple added the inactivity reboot timer.
Foreign investigators access digital extraction tools despite export bans
The distribution of high-level forensic hardware has also raised questions regarding international export compliance and corporate oversight. Court records examined by digital rights watchdog Citizen Lab demonstrated that Russian law enforcement agents deployed Cellebrite’s UFED software, an Israeli forensic platform, to pull private messaging archives from the personal device of political activist Andrey Pivovarov.
Court documentation surrounding the Russian opposition figure details a timeline of vendor decisions and state forensic interventions:
- March 2021: Israeli developer Cellebrite made a formal public declaration that it was ending all software sales and customer support operations within the Russian Federation.
- June 17, 2021: Russian government analysts used the Cellebrite UFED toolkit to extract private messaging data from Andrey Pivovarov’s iPhone 12, three months after the vendor announced its market departure.
- November 1, 2024: Apple deployed its iOS 18.1 system update, introducing the 72-hour inactivity reboot defense across supported devices worldwide.
Addressing the continuing operation of forensic tools following commercial withdrawals, Israeli human rights attorney Eitay Mack remarked that halting shipments or officially canceling a license does not prevent a prior customer from misusing existing technology. Cellebrite chief marketing officer David Gee stated to Citizen Lab that the vendor severed commercial ties within the Russian market and maintained that any subsequent forensic usage occurred outside company authorization.
Follow: iPhone Duo folding screen film can be replaced at Apple stores for 19 dollars
John Scott-Railton, a senior researcher at Citizen Lab, argued that forensic vendors must take more aggressive steps to govern their equipment, stating that manufacturers should remotely deactivate deployments whenever credible reports of abuse emerge and implement cryptographically signed watermarks on extracted device data to eliminate plausible deniability.
Neither Apple nor Magnet Forensics responded to inquiries regarding the newly disclosed bypass mechanisms. The underlying software method used by the GrayKey unit to suppress the 72-hour reboot timer has not undergone third-party cryptographic review, and the full roster of public safety agencies currently deploying the hardware in active investigations remains undisclosed.
