The iPhone’s reboot may no longer end the evidence trail. Magnet Forensics claims it has developed a way to preserve a locked iPhone’s forensic state, helping law enforcement maintain access after the device would otherwise become harder to examine.
The company calls the device GrayKey Preserve, supported by a feature named Evidence Preservation Mode. The tools target an iPhone behavior that automatically reboots the device after inactivity and can cause certain data to be deleted after a number of days.
That combination creates a problem for investigators handling a locked phone. A reboot can move the iPhone into a state where data becomes harder to obtain, turning time and battery power into unwanted collaborators. Technology rarely misses an opportunity to make a locked box more complicated.
Preserving the After First Unlock State
GrayKey Preserve is designed to keep the iPhone in an After First Unlock, or AFU, state. An iPhone in AFU allows access to data that is harder to obtain when the device sits in Before First Unlock, or BFU, state.
Magnet says GrayKey Preserve and Evidence Preservation Mode ensure the AFU state does not disappear if the iPhone reboots or loses power. A Magnet employee described the feature in blunt terms: “That AFU state is captured.”
The employee also called the capability “an absolute game changer for iOS forensics and a function that I wish we had years ago.” Another statement claimed, “We’re gonna be able to preserve that data for an infinite amount of time.” That is a bold promise, but the technical goal is clear: prevent a device event from discarding a more useful forensic state.
The preservation process begins after initial access is gained. GrayKey Preserve enables Airplane Mode and disables radio transmissions, including Bluetooth, Wi-Fi, and cellular connections, so the device cannot receive data while investigators preserve its state.
Cutting Off the Radios
A Magnet employee explained that the system disables those connections even when the iPhone cannot activate Airplane Mode or turn off its transmitters through the iOS Control Center. Once the phone enters its preserved state, the radios are disabled to prevent data from reaching the device.
That detail matters because the system is not presented as a way for law enforcement to browse everything inside the iPhone during preservation. When using the solution, law enforcement sees the device model and software version, but not the data within it.
The distinction separates preservation from access. GrayKey Preserve is intended to hold the iPhone in a condition that supports later forensic work, rather than expose the contents of the phone during the preservation process itself.
Magnet Forensics’ claims were associated with information dated October 1, 2026 at 9:00 AM, with November 2024 also listed in the material. The names 404 Media, Jiska Classen, and Hasso Plattner Institute appear alongside the details, but the central claim belongs to Magnet: its GrayKey system can preserve AFU access through reboots and power loss.
The practical effect is straightforward. An iPhone’s automatic reboot can still happen, but GrayKey Preserve and Evidence Preservation Mode are designed to stop that reboot from destroying the more useful forensic position.
For locked iPhones, the important battle is not only whether investigators gain initial access. It is whether that access survives the phone’s own security behavior. Magnet says it now has a way to keep the answer from being decided by a reboot.
