GrayKey claims it can stop the iPhone's 72-hour security clock

Magnet Forensics has developed GrayKey Preserve and an Evidence Preservation Mode, according to a video obtained by 404 Media. Both are supposed to retain the After First Unlock state, which gives forensic tools better access to some data, even if an iPhone reboots or loses power.

GrayKey aims to preserve the phone's state through a reboot

Since iOS 18.1, Apple automatically reboots an iPhone after 72 hours without an unlock. This returns the device to Before First Unlock, where more sensitive data remains encrypted and passcode attacks are generally harder. The protection complicates police work when a seized phone is waiting for court authorization or laboratory capacity.

The leaked training video describes a separate GrayKey Preserve device and a new mode for existing GrayKey hardware. Magnet claims they capture the After First Unlock state through a later reboot. After initial access, the tool is also meant to disable cellular, Wi-Fi and Bluetooth radios and prevent some data, including recently deleted photos or iMessages, from expiring.

The contest shifts from cracking the phone to freezing time

The operational change matters. Under the description, police do not have to read the phone's contents immediately. The tool can first preserve the available state and show only the device model and iOS version while investigators wait for legal authorization to search it.

For phone security, this is another round in the contest between Apple and forensic vendors. Automatic reboot shortened the period during which a seized device remains in a more exposed state. GrayKey now claims it can turn that deadline from a technical protection into a problem addressed at the moment of seizure.

The mechanism is secret and no independent test confirms the claim

The 404 Media report was only partly accessible during verification and is based on a leaked video. The video does not explain the technical mechanism, and it is unclear which iOS versions remain affected or whether the capability has been used in real investigations. The reboot-persistence claim therefore belongs to Magnet, not an independent laboratory.

Security researcher Jiska Classen reportedly suggested that the tool may manipulate the phone's clock or disable tasks that expire data. That is an expert hypothesis rather than a demonstrated description of the exploit. Magnet's public product page confirms features intended to protect against automatic reboot timers, but it does not disclose technical details.

Apple's response will show whether this is an exploit or a temporary lead

Three signals will settle the issue: independent reproduction, an exact list of supported devices and iOS versions and any fix from Apple. An update may close the route if it depends on a specific flaw. If the state is preserved through another mechanism, Apple may need to change the transition between AFU and BFU itself.

There is no simple settings switch for users to answer this claim. Prompt iOS updates, a strong passcode and awareness that physical control of an unlocked phone gives specialist tools a much better starting position remain the practical defenses.

Lilith's verdict

Apple put a 72-hour clock in the evidence locker. GrayKey says it can stop the hands, but until an independent lab takes the trick apart, we are still watching the magician's own recording.