As reported by 404 Media, Magnet Forensics says it has found a way to bypass the iPhone security feature that automatically reboots devices if they haven’t been unlocked for 72 hours.
Nearly two years ago, the iOS 18.1 update introduced Inactivity Reboot, a feature that forces iPhone reboots if they haven’t been unlocked for 72 hours. This makes it harder for law enforcement and forensic tools to access data on a locked iPhone, since a reboot causes the device to return to a Before First Unlock (BFU) state, rather than remaining in the less restrictive After First Unlock (AFU) state.
404 Media reported that, based on an educational video made exclusively for law enforcement, Magnet developed a new device called GrayKey Preserve, as well as an Evidence Preservation Mode for its existing GrayKey hardware. Both are reportedly designed to maintain an iPhone’s forensic state without immediately exposing the data stored on the device, allowing law enforcement to keep that state intact while waiting for authorization.
The report notes that GrayKey can preserve an iPhone’s AFU state even if the device reboots. 404 Media consulted iPhone security researcher Jiska Classen, who said Magnet may have found a way to manipulate the iPhone’s clock or turn off processes responsible for expiring data.
Source: 9to5Mac · Summarized by HeadlinesBriefing