iPhone Automatic Restart and a forensic vendor's bypass claim

404 Media reported on 1 October that it had obtained a video made by Magnet Forensics, the maker of Graykey, a tool sold to law enforcement for unlocking phones and extracting their data. In the video, a Magnet employee says the Graykey Preserve device and Graykey's Evidence Preservation Mode keep a seized iPhone in a state that is easier to extract data from, even if the phone reboots "for any number of reasons" or loses power. 404 Media's report describes the technology as a way around what it calls inactivity reboot, the iOS 18.1 feature that Apple's Platform Security guide calls Automatic Restart. According to 9to5Mac, citing 404 Media, it is a training video made for law enforcement and appears to date from early 2025.

TechSpot's report of 2 October says the claim has not been independently verified. 9to5Mac's report adds that it is unclear how long the technique has been available, whether it has been used in real cases, and whether it still works on the latest iOS. According to 9to5Mac and Privacy Guides, neither Apple nor Magnet responded to 404 Media's request for comment.

According to Privacy Guides, which relays 404 Media's report, the video gives no technical details of how this works. As of 7 October, Magnet's own Graykey product page says it can "protect your extractions from automatic reboot timers".

Perspective

The protection rests on two states described in a TechCrunch report from November 2024. Before First Unlock (BFU) is a phone that has been switched on but not yet unlocked with its passcode, and according to that report its data is fully encrypted and near-impossible to access without the passcode. After First Unlock (AFU) is a phone that has been unlocked at least once since starting up, and some of its data is unencrypted, which some forensic tools may extract more easily even while the phone is locked.

Apple's Platform Security guide says Automatic Restart in iOS 18.1 and iPadOS 18.1 or later uses the Secure Enclave, a dedicated subsystem on the chip that handles keys, to watch unlock events. A device left locked for a prolonged period restarts on its own, moving from AFU to BFU and purging sensitive keys and transient data from memory. From iOS 18.4, device management administrators can turn Automatic Restart on or off, and it is off by default on supervised devices (iPhones set up centrally by an organisation such as an employer or school). Apple's guide does not give the interval, but a researcher measured 72 hours in November 2024, and TechCrunch reported at the time that Magnet also confirmed the figure.

The researcher who measured the 72 hours wrote that thieves lack the means to get current exploits within three days, so the restart likely locks them out entirely, while law enforcement comes under more time pressure. Privacy Guides' news brief relays the video's claim that Evidence Preservation Mode "captures" the iPhone in AFU, so the AFU state survives a restart. If that is true, a phone that has already been accessed and preserved keeps its AFU state when the 72 hours run out. In our view, how much that time pressure matters depends on whether investigators can demand the passcode, and the rules differ from place to place, as Hong Kong, Singapore and mainland China show.

In Hong Kong, amended rules under Article 43 of the National Security Law took effect on 23 March 2026 for investigations of offences endangering national security. Police may require a suspect, or anyone they reasonably believe owns, uses or knows the password to a device, to provide the password or other decryption method, and failing to comply without reasonable excuse carries up to a year in prison and a HK$100,000 fine. The Secretary for Security told reporters on 24 March that police must first apply to a court for a warrant on affidavit. The Department of Justice's paper notes that the earlier rules already let police search electronic equipment where obtaining a warrant was not reasonably practicable, but does not say whether that route also applies to the new password requirement.

Singapore's Criminal Procedure Code, section 40, lets police authorised by the Public Prosecutor require access to decryption information when investigating an arrestable offence. Failing to comply can bring a fine of up to S$10,000, up to three years in prison, or both, with heavier penalties of up to S$50,000 or ten years where the data holds evidence of certain serious offences.

In mainland China, a 2016 regulation from the Supreme People's Court, the Supreme People's Procuratorate and the Ministry of Public Security, and the Ministry's rules on electronic evidence in criminal cases, in force since February 2019, both say seized phones should be sealed with signal shielding, signal blocking or cutting the power. Xinhua reported in May 2026 that the Ministry of Public Security had published a draft revision of those rules for public comment. When the holder refuses to provide an account password, the draft lets police obtain it by other means with approval from a public security chief at county level or above, after informing the holder or in front of a witness. We found no final version as of 7 October.

Our reading is that where a passcode can be compelled, a phone in BFU guards against thieves more than against a legal demand for the passcode. Where it cannot, keeping a seized phone in AFU is worth more to investigators. None of the sources says what an ordinary user can do to stop Magnet's technique.

Apple's iPhone User Guide says the passcode is always required after the phone is turned on or restarted. People worried that their phone could be seized can switch it off before it may leave their hands, so it starts up in BFU. This is our inference from the definition of BFU, and the video does not say whether Magnet's technique works on a phone already in BFU.

According to the video, once preservation starts even a loss of power does not lose the AFU state. In our reading, switching off only helps before the phone is taken. Switching off also means missing calls and messages in the meantime.

Apple's "Passcodes and passwords" page says an attacker holding a device cannot get at data in specific protection classes without the passcode, and that longer passcodes are stronger against brute-force attacks. The same page adds that a longer numeric passcode may be easier to enter than a shorter alphanumeric one while giving similar security. It does not discuss how passcode length affects Magnet's technique.

To change the passcode, go to Settings, then Face ID & Passcode (or Touch ID & Passcode), tap Change Passcode, then Passcode Options. The iPhone User Guide lists Custom Alphanumeric Code and Custom Numeric Code as the most secure options. The cost is typing a longer passcode after every restart and whenever the phone has not been unlocked for more than 48 hours.

People with no reason to expect their phone to be seized do not need to change anything for this story. People using a supervised iPhone cannot assume the 72-hour restart applies.

Apple's security releases page says Apple does not disclose, discuss or confirm security issues until an investigation has occurred and patches or releases are generally available. As of 7 October it is unclear whether Magnet's technique works on the latest iOS, and in November it is worth checking iOS release notes for a related fix and whether any researcher has verified the claim.