New Tool Claims to Bypass iOS Idle Auto-Reboot Protection

Magnet Forensics, a company specializing in digital forensics tools, has introduced GrayKey Preserve, a new device that reportedly bypasses the automatic reboot protection mechanism implemented by Apple in iOS 18.1. This feature, designed to restart iPhones after 72 hours of inactivity, is intended to enhance security by limiting data access.

The GrayKey Preserve tool is said to maintain the iPhone's AFU (After First Unlock) state even after an automatic reboot. In this state, device data is typically more accessible compared to the BFU (Before First Unlock) state, which is activated post-reboot and restricts access to encryption keys, making brute-force attacks more difficult.

Magnet Forensics claims the tool can also prevent cached location data, recently deleted photos, and iMessage data from expiring, thus preserving relevant information for longer periods. The process involves disconnecting the iPhone from cellular, Bluetooth, and Wi-Fi networks to isolate it from external communications and prevent new data from overwriting existing information.

The technical methodology behind this capability has not been fully disclosed. Security researchers suggest potential mechanisms could involve manipulating the system clock or disabling system tasks responsible for data cleanup. Law enforcement agencies utilize GrayKey devices to access locked smartphones during investigations.