New GrayKey feature lets police stop seized iPhones from becoming harder to access after a reboot

Magnet Forensics has unveiled a new feature, GrayKey Preserve, designed to prevent seized iPhones from falling into an even more secure state after a reboot. This update aims to extend the window for law enforcement to access data that would otherwise become more challenging to retrieve after a device restarts. The video obtained by 404 Media explains how the feature preserves the "After First Unlock," or AFU, status of an iPhone, which is crucial for accessing certain data that can become encrypted after a reboot.

The feature uses the GrayKey Preserve device and a new Evidence Preservation Mode for its existing GrayKey system. It works by preventing an iPhone from sliding into a more protected state called "Before First Unlock," or BFU. In BFU, data remains encrypted until the passcode is entered, making it much harder for forensic tools to extract information. The AFU state is captured even if the device reboots for various reasons, ensuring that critical data remains accessible.

The new tools also employ network isolation, disabling the phone's wireless radios, including Wi-Fi, Bluetooth, and cellular connections. This prevents any communication with the device while preserving its data. Additionally, the system can disable these connections even if the phone's user cannot activate Airplane Mode or turn off the radios through iOS controls. This feature ensures that the preserved data remains inaccessible to anyone who might try to access it.

Magnet Forensics claims that this new feature can preserve data such as cached location information, recently deleted photos, and iMessages, which might otherwise be removed after a set period. While the video does not delve into the technical specifics of how this preservation system works, it suggests that the method could involve altering the phone's internal clock or preventing software tasks that cause stored data to expire.

This development is seen as a significant advancement by researchers, potentially putting mobile forensic tools back in a position similar to those before the implementation of Apple's inactivity reboot system.