Phones that seal themselves after days without an unlock have become one of the strongest brakes on forensic access. A law enforcement training clip that surfaced this week suggests that brake can be released.
404 Media, which obtained the video, dates it to early 2025. In it, a staffer from Magnet Forensics walks investigators through a pair of products meant to hold a handset in its readable state. The company builds GrayKey, the box police widely use to pull data from seized iPhones.
The protection being worked around arrived with iOS 18.1 in late 2024. A device that goes 72 hours without being unlocked restarts on its own. That restart returns it to a state where much of its content sits behind keys that only come back when the owner types the passcode again. For an investigator waiting on a warrant, the timer can erase reach.
Magnet’s answer, the video says, is a new unit called GrayKey Preserve plus an Evidence Preservation Mode for hardware already in the field. The captured unlocked state survives a restart, memory pressure, or a dead battery, according to the employee, who calls that survival the real trick.
How the state is preserved was not shown. iPhone security researcher Jiska Classen told the outlet two mechanisms are plausible: nudging the phone’s clock, or stopping the background processes that expire data. Neither Apple nor Magnet answered questions about the clip.
The reboot timer was pitched as a safeguard for ordinary owners, not only a courtroom hurdle. It also shortens the window in which a thief, or anyone who buys stolen hardware, can work at a device. A tool that freezes a seized phone’s unlocked state extends that window for whoever holds it.
