TL;DR: Magnet Forensics can keep seized iPhones from slipping into a more secure state, potentially extending law enforcement's window to access data that would otherwise become harder to retrieve after a device reboots. The feature shows how mobile forensic companies are adapting to changes in Apple's security model. Instead of simply defeating a passcode, it seeks to keep the phone from reaching the post-reboot state Apple intended to protect.
The company's GrayKey Preserve device and a new Evidence Preservation Mode for its existing GrayKey system are designed to prevent an iPhone from losing its After First Unlock, or AFU, status, according to an instructional video 404 Media obtained. That puts the tools in direct conflict with an Apple security feature known as inactivity reboot.
Apple's feature automatically restarts an iPhone if it has not been unlocked for 72 hours. The reboot moves the phone into a more protected state called Before First Unlock, or BFU. In BFU, certain data stays encrypted until you enter the phone's passcode. That can make extraction much harder for forensic tools.
iPhones hold different categories of data depending on whether they have been unlocked since their last reboot. In the AFU state, a device has already received its passcode after starting up. That makes some information available that would be inaccessible, or much more difficult to reach, after a reboot.
Magnet's new tools are meant to preserve that AFU condition, even if the phone restarts or loses power.
"That AFU state is captured," a Magnet employee says in the video. "Even if that device does reboot for any number of reasons, memory maintenance or the power is lost or whatever, the AFU state is not lost. This is the true magic behind the GrayKey Preserve and the Evidence Preservation Mode function."
For investigators, that could solve a timing problem created by Apple's inactivity reboot system. Police may seize a phone but not try to access it right away. They may be waiting for a court order, handling other evidence or dealing with a queue of devices. If the phone restarts during that period, data that had been available in AFU can become harder to access.
The video also describes a network-isolation function. After initial access, the GrayKey system can turn off the phone's wireless radios, including Wi-Fi, Bluetooth and cellular connections. The point is to prevent communications with the device while preserving its data.
"Now, one of the many things that the GrayKey Preserve is going to do, as part of all of this, inside of our initial access, is it's going to enable Airplane Mode, or more specifically, it's gonna disable our radio transmissions like Bluetooth, Wi-Fi and cellular," the Magnet employee says. "In doing this, that's not only going to allow you to preserve the data in the field, but also isolate the data in the field."
The employee says the system can disable those connections even when the phone's user could not activate Airplane Mode or turn off the radios through iOS controls.
"Once initial access is gained and the device is in a preserved state, we also disable all of those radios to make sure that that data cannot reach that device," the employee says.
GrayKey Preserve is also intended to stop certain information from disappearing over time. The video refers to cached location data, recently deleted photos and iMessages. Those types of data may be removed automatically after a set period.
"We're gonna be able to preserve that data for an infinite amount of time," the employee says.
The video does not explain the technical method behind the preservation system. It indicates that officers using the feature can see the phone model and iOS version without viewing the device's contents. That would allow them to preserve the device before receiving authorization to examine the data.
Jiska Classen, a researcher at the Hasso Plattner Institute who studies iPhone security, told 404 Media that the video does not provide enough detail to determine exactly how the technology works. She suggested that Magnet may have found a way to alter the phone's internal clock or prevent software tasks that cause stored data to expire.
Classen called the development "quite a game changer" and said it could "at least put things back to where they were before inactivity reboot."