Possible Vulnerability in Apple’s Automatic Reboot

Apple’s automatic reboot is an inactivity-based security feature. If an iPhone has not been used for 72 hours, it restarts and enters a more secure state. The feature matters because a reboot changes the phone’s security condition and makes some stored data unavailable, according to the article.

The article does not describe the technical steps behind that state. It does show why the feature matters: Magnet’s technology specifically targets the iPhone’s inactivity reboot and the data that reboot makes unavailable. GrayKey tools are built to unlock and access data on smartphones.

Normally, the protection activates after 72 hours of inactivity. A leaked video claims Magnet has developed GrayKey Preserve and Evidence Preservation Mode to get around that protection. Apple engineers are now presumed to know about the flaw and may be able to fix it.

GrayKey is a popular Magnet Forensics tool sold to law-enforcement agencies. It allows them to unlock and access data stored on iPhones and Android smartphones. Magnet also developed GrayKey Preserve, a separate device, and Evidence Preservation Mode, a feature for regular GrayKey devices.

These newer tools are designed to counter two automatic iPhone protections. One is the inactivity reboot, which makes certain data unavailable after 72 hours without use. The other deletes some data after a certain number of days. Examples include cached locations, recently deleted photos, and recently deleted iMessages.

A leaked video describes the capability as a major change for iOS forensics. A Magnet employee says it could preserve the affected data “for an infinite amount of time.” The report presents this as technology intended to help investigations retain access to data that iPhones would otherwise protect or delete.

The iPhone’s automatic inactivity protection normally activates after 72 hours of nonuse. At that point, the phone automatically reboots into a more secure state. The article says this reboot makes some data unavailable, which is why bypassing it matters to forensic investigators.

Magnet Forensics reportedly developed GrayKey Preserve and Evidence Preservation Mode to target that protection. The leaked video describes the technology as preserving data that the inactivity reboot would otherwise make unavailable. The article does not provide a more precise technical description of how preservation works.

The same tools also target iPhone data that is automatically deleted after a certain number of days. The examples include cached locations, recently deleted photos, and recently deleted iMessages. A Magnet employee claims the technology can preserve that data “for an infinite amount of time,” although the article presents this as the company’s claim.

The reported vulnerability concerns iOS’s automatic reboot after 72 hours of inactivity. 404Media reports that Magnet Forensics developed technology to bypass this security feature. The reported goal is to keep access to data that the reboot would otherwise make unavailable.

The article does not identify the vulnerability by name or explain its technical mechanism. It also does not say whether the device literally avoids restarting, restarts in a different state, or is handled in another way. Therefore, the safest conclusion is that Magnet’s tools reportedly defeat the protection’s intended effect.

The leaked video links the capability to GrayKey Preserve and Evidence Preservation Mode. A Magnet employee calls it a major development for iOS forensics. The article says Apple engineers presumably now know the flaw exists, so Apple may be able to investigate and fix it.

The automatic reboot is intended to move an unused iPhone into a more secure state. If Magnet’s reported technology defeats that protection, the phone may not receive the security benefit Apple designed for it. That creates a privacy concern because data could remain accessible for longer to someone with forensic tools.

For law-enforcement investigations, the effect could be useful. GrayKey already allows agencies to unlock and access data on iPhones and Android smartphones. GrayKey Preserve and Evidence Preservation Mode reportedly help retain data that the inactivity reboot would otherwise make unavailable, potentially preserving evidence during an investigation.

The article does not quantify how many phones are affected or describe successful cases. It says Apple engineers presumably know about the flaw and may fix it. Until then, the report suggests a conflict between a user-facing security feature and forensic technology designed to overcome it.

The article identifies an iPhone feature that automatically deletes some data after a certain number of days. Its examples are cached locations, recently deleted photos, and recently deleted iMessages. The stated effect is that this data eventually becomes unavailable unless Magnet’s technology preserves it.

The source does not explain Apple’s reason for automatic deletion. In general, automatic removal of sensitive or temporary data can reduce how much personal information remains on a device and limit exposure if the phone is accessed later. That privacy explanation is established context, not a reason stated in the article.

Magnet’s GrayKey Preserve and Evidence Preservation Mode are designed to combat this deletion. A Magnet employee says the tools will preserve the data “for an infinite amount of time.” The article presents that as the company’s claim and does not independently verify its scope or technical limits.

Encryption converts stored information into unreadable data without the correct cryptographic key. A passcode helps protect access to that key and authenticates the person using the phone. Together, they make data difficult to read if someone does not know the passcode or cannot satisfy the device’s security checks.

A device’s security state can change after events such as a reboot. In general smartphone design, a post-reboot state requires stronger authentication before protected data becomes available. The source specifically says Apple’s 72-hour inactivity reboot puts an iPhone into a more secure state and makes some data unavailable.

The article does not explain Apple’s encryption design or the exact relationship between passcodes and reboot states. It reports that GrayKey technology reportedly bypasses the inactivity protection. That matters because defeating one layer may preserve access to data that the stronger state was intended to protect.