Cops Can Bypass iPhone's Automatic Reboot to Get into Locked Phones
Magnet Forensics has developed tools called GrayKey Preserve and Evidence Preservation Mode that let law enforcement bypass Apple's 72-hour iPhone inactivity reboot feature.
summary is enough The summary captures the core cat-and-mouse dynamic between Apple and forensics vendors, so most technical readers can skip the short article itself.
summary
Apple recently introduced a 72-hour inactivity reboot in iOS to protect seized phones from forensic tools, but forensics company Magnet Forensics has created a workaround. Their new GrayKey Preserve and Evidence Preservation Mode maintain a seized iPhone's After First Unlock state, preventing reboots and preserving recent data. This allows law enforcement to extract sensitive information even before securing a formal warrant, raising significant civil liberties concerns.
key points
- Magnet Forensics introduced GrayKey Preserve and Evidence Preservation Mode to maintain a seized iPhone's After First Unlock (AFU) state indefinitely.
- The tool circumvents Apple's iOS feature that automatically reboots a locked phone after 72 hours of inactivity to block forensic decryption.
- Commenters highlight legal and ethical concerns that this enables law enforcement to pre-search or extract device data prior to obtaining a formal warrant.
who should read it
Security-conscious mobile users, privacy advocates, and digital forensics professionals.
discussion skeptical
consensus
Commenters focus heavily on civil liberties implications, expressing concern that police use these expensive commercial tools to extract phone data before securing formal warrants.
pushback
Some note that because GrayKey licenses cost tens of thousands of dollars and are restricted to government agencies, the exploit is unavailable to standard street criminals.
> “Even if that device does reboot for any number of reasons, memory maintenance or the power is lost or whatever, the AFU state is not lost. This is the true magic behind the GrayKey Preserve and the Evidence Preservation Mode function.”
Based on this, it seems more likely that this involves exploiting the device to retrieve the underlying keybags present in AFU mode and store them, rather than manipulating the actual feature of automatic reboots. Then the device can be exploited again in BFU mode but with the prior keybag to decrypt everything.
It sounds like this feature is being used to …
It offers a plausible technical explanation that the tool likely extracts and stores underlying keybags from AFU mode rather than tampering with the reboot feature itself.
Generated by an LLM from the article and thread. Check the sources before relying on it.