GrayKey Preserve is a forensic tool that, according to its maker, can stop a seized iPhone from locking itself down after 72 hours. If that claim holds up, Apple’s inactivity reboot protects you less than you thought. Here’s what’s been reported, what isn’t proven, and what you can do today.
Quick facts:
- Magnet Forensics sells GrayKey Preserve, plus an “Evidence Preservation Mode” for existing GrayKey systems.
- It targets Apple’s inactivity reboot, which restarts an iPhone left locked for 72 hours.
- Forbes reports that ICE has bought the technology, and agencies in at least six US states use it.
- TechSpot says the claim hasn’t been independently verified, and Apple hasn’t commented.
The takeaway: this affects people whose phones are physically seized, not everyday users. Still, it’s worth five minutes to tighten your settings.
What GrayKey Preserve reportedly does
The tool aims to keep a seized iPhone in the state it was in when it was taken. According to TechSpot, Magnet says the phone stays in “After First Unlock” mode even if it would normally restart. The tool also reportedly turns off Wi-Fi, Bluetooth and cellular radios after the first access.
Magnet also claims it keeps data that would otherwise vanish, such as cached location data, recently deleted photos and iMessages. A Magnet employee reportedly said data could be held for “an infinite amount of time.”
Researcher Jiska Classen of the Hasso Plattner Institute guessed that the tool may change the phone’s clock or block tasks that delete old data. She called it “quite a game changer,” per TechSpot. That’s an outside guess, not a confirmed method.
Why the 72-hour reboot mattered
Apple added the inactivity reboot in fall 2024, as Forbes notes. It restarts a phone nobody has unlocked for 72 hours. A restarted iPhone is much harder to break into, because its data stays encrypted until you enter the passcode.
That gave you a clock. Police needed to get a warrant and start extraction before the timer ran out. GrayKey Preserve is said to freeze that clock.
| State | What it means | How exposed your data is |
|---|---|---|
| After First Unlock (AFU) | You’ve unlocked the phone since it last restarted. | Many keys stay in memory, so forensic tools have more to work with. |
| Before First Unlock (BFU) | The phone just restarted and nobody has entered the passcode. | Most data stays locked until the passcode is typed in. |
The point is simple: the longer a phone stays in AFU, the more a forensic tool can reach.
Who is using it, and what’s still unknown
Forbes says local and federal agencies in at least six states use the tool: Georgia, Maine, Missouri, Mississippi, New York and Rhode Island. The Onondaga County Center for Forensic Sciences in New York reported 71 uses, the most of any known user. It didn’t say how many led to preserved evidence.
Orin Kerr, a Stanford law professor, told Forbes that use should be lawful when police have probable cause and are seeking a warrant. Privacy groups worry about how ICE might use it. Forbes also reports that rival Cellebrite has announced a similar feature.
Apple and Magnet didn’t answer Forbes’ questions. Treat every technical claim here as unproven until someone tests it.
How to protect your iPhone from GrayKey Preserve and similar tools
None of these steps is a guarantee against a tool nobody has publicly tested. They do raise the bar, though.
- Use a long alphanumeric passcode. A six-digit code is far easier to guess than a long mix of letters and numbers. Go to Settings, then Face ID & Passcode, then Change Passcode, then Passcode Options.
- Hold the side button and a volume button for a few seconds. This brings up the power-off screen and makes the phone ask for your passcode before Face ID works again.
- Turn on Lockdown Mode under Settings, Privacy & Security, if you’re at real risk of targeted attacks. It limits some features, so it isn’t for everyone.
- Keep iOS current. Our guide to the iOS 26.7.1 zero-day fix shows why delaying updates is risky.
Why this matters: your passcode is the one thing a forensic tool can’t skip, so its strength decides how hard your data is to reach. If you’re unsure which update path to take, see Apple’s iOS 27 upgrade push on iOS 26 phones.
Frequently Asked Questions
Does GrayKey Preserve work on my iPhone?
Nobody has independently confirmed it. TechSpot says the claim is unverified, and Magnet hasn’t explained the method. It also only matters if someone already has your phone in their hands.
What is the iPhone inactivity reboot?
It restarts an iPhone that hasn’t been unlocked for 72 hours. After the restart, the phone is back to its most protected state until the passcode is typed in.
Can I turn off GrayKey Preserve on my phone?
No. It’s a tool used by investigators, not an app or setting on your device. All you can do is harden the phone itself.
Is Lockdown Mode worth turning on?
Only if you face a real risk of targeted attacks, because it limits some features. For most people, a long passcode and quick updates matter more.
Should you worry? A practical verdict
For most people, this is a story about how far device security keeps shifting, not an emergency. If you carry sensitive work data, travel across borders, or just like to be careful, set a long passcode this week. Do that and you’ve covered most of what you can control, whatever Magnet’s tool turns out to do.
Leave a Reply