The latest round of the ongoing cat-and-mouse game between Apple and the cops has seemingly gone to the cat. According to a report from 404 Media, a company that develops tools for law enforcement has figured out a way to bypass a key Apple security technique that has been making life considerably harder for police to crack seized iPhones.
The protocol that has given the cops fits is a feature first introduced to Apple’s mobile operating system, iOS, back in 2024, which instituted an “inactivity reboot” for iPhones that sit idle for more than 72 hours. The feature basically reverts an iPhone to a more secure state if it’s been inactive (read: sitting in an evidence locker) for too long, encrypting details on the device and making it harder for police to access without the person’s passcode.
But, according to 404 Media, a company called Magnet Forensics has figured out a workaround that could help cops get back into devices that they previously couldn’t. The publication obtained a video showing the technology, which the company calls GrayKey Preserve, in action. In it, a Magnet Forensics employee calls the tool “an absolute game changer for iOS forensics” that can preserve user data “for an infinite amount of time.”
GrayKey Preserve is part of GrayKey, a tool that law enforcement can use to unlock and access data stored on iPhones and Android devices without needing a user’s passcode to unlock the device. According to Magnet Forensics, GrayKey is used by more than 1,200 agencies in 40 countries. But its functionality was hampered by Apple’s security protocols, much to the chagrin of law enforcement, who found themselves locked out of iPhones they seized from suspects.
GrayKey Preserve allows police to keep iPhones in a state referred to as After First Unlock (AFU). In this state, some data on the device is unencrypted and easier to access and extract. Apple’s security feature would revert a device to a Before First Unlock (BFU) state when inactive for 72 hours, reactivating the more thorough encryption protections. That’s what GrayKey Preserve now bypasses, and, per the report, it can keep the phone in that AFU state even if it reboots. It also seemingly makes it harder for the device owner to revert the device remotely by placing the device in Airplane Mode and cutting off access to wireless connections.
Gizmodo reached out to Apple for comment on this apparent bypass but did not hear back at the time of publication.
