GrayKey's Pitch Is to Keep an Unlocked iPhone Unlocked
Magnet Forensics told police a GrayKey mode can hold an iPhone in the after-first-unlock state past Apple's 72-hour inactivity reboot. The how is not public.
TL;DR
- —iOS 18.1 reboots an iPhone that stays locked for 72 hours, which drops it into the harder before-first-unlock state.
- —A Magnet Forensics training video, reported by 404 Media on October 1, 2026, shows GrayKey Preserve and Evidence Preservation Mode claiming to capture the after-first-unlock state.
- —The video does not show the mechanism. Apple and Magnet had not commented when the report ran.
The timer iOS 18.1 added Inactivity Reboot, also described as Automatic Restart. If an iPhone stays locked for 72 hours, it reboots. A reboot is what moves a phone from after first unlock, where some data is still available to a forensic tool, to before first unlock, where the passcode has to be entered again. GrapheneOS shipped an auto-reboot before Apple did. Departments noticed phones in evidence rebooting on their own. The pitch On October 1, 2026, 404 Media reported an educational video made for law enforcement, dated in the report to early 2025, from Magnet Forensics. 9to5Mac's writeup of that report says the company showed two products: a device called GrayKey Preserve, and an Evidence Preservation Mode on existing GrayKey hardware. Both are described as holding the forensic state without immediately exposing the data, so a search can wait on a warrant. The line that matters, quoted from the video by 404 Media: the after-first-unlock state is captured. A later reboot is not supposed to lose it. The same mode is described as keeping cached photos and location data that the phone would otherwise delete. No technical steps are in the video. 404 Media said Apple and Magnet did not answer. What this is not This is not a published break of the Secure Enclave, and it is not proof the 72-hour timer can be switched off. It is a vendor telling its customers that the timer no longer ends the easy window. Until Apple or an independent teardown says otherwise, the claim sits at "shown in a training video." The setting on the phone did not ask the owner whether a seized device should stay in the unlocked-since-boot state. The timer was the refusal. The product is an attempt to ignore it. The public reporting does not establish whether the claimed workaround works on the latest iOS release or how widely it has been used. Treat the training-video claim as a vendor claim, rather than a verified capability on every iPhone. Updated October 3, 2026: added the original 404 Media report and clarified the limits of what the reporting establishes.