Police departments across the country have a new edge in unlocking seized iPhones. A leaked training video shows the company behind the GrayKey device telling law enforcement it can keep phones in an accessible state. Even after Apple’s built-in 72-hour inactivity reboot kicks in.

The revelation comes from 404 Media. Its reporters obtained an educational video produced for law enforcement customers. The footage, dated to early 2025, demonstrates tools from Magnet Forensics. That firm acquired Grayshift, the original creator of GrayKey, in 2024.

Apple introduced the inactivity reboot in iOS 18.1. A locked iPhone that goes three days without the passcode being entered restarts automatically. The move forces the device back into its most secure mode. Encryption keys stay locked away in the Secure Enclave. Brute-force attempts become far harder. Officers often wait days or weeks for warrants. Phones would reboot in evidence lockers. Valuable data slipped out of reach.

Officers complained at the time. Backlogs at forensic labs made the feature a real obstacle. Magnet Forensics appears to have answered those concerns. Its solution comes in two forms. A new piece of hardware called GrayKey Preserve. And a software feature named Evidence Preservation Mode for existing GrayKey units.

Both aim to capture the After First Unlock state. In that condition, the phone has been unlocked at least once since its last boot. Certain encryption keys remain in memory. Applications can access protected data. Photos load. Messages appear. Location history stays available. The alternative, Before First Unlock, locks nearly everything down.

“That AFU state is captured,” a Magnet Forensics employee says in the video, according to 404 Media. “Even if that device does reboot for any number of reasons, memory maintenance or the power is lost or whatever, the AFU state is not lost. This is the true magic behind the GrayKey Preserve and the Evidence Preservation Mode function.”

The video does not spell out the exact technical steps. That secrecy protects the company’s methods from Apple engineers. Yet independent researchers have floated theories. Security expert Jiska Classen suggested the system might manipulate the device clock. Or it could disable background tasks that handle data expiration. Such moves would prevent the phone from recognizing prolonged inactivity.

Once the initial connection happens, GrayKey Preserve isolates the iPhone. It turns off cellular service. Bluetooth shuts down. Wi-Fi goes dark. The device shows only its model and software version to investigators. No private data appears until proper authorization arrives. This design helps preserve chain of custody. Officers avoid viewing evidence prematurely. Courts appreciate that caution.

Evidence Preservation Mode adds another benefit. It stops cached locations, recently deleted photos, and iMessages from expiring. Normally those items vanish after set periods. The mode keeps them available indefinitely. Investigators gain more complete pictures of user activity.

Magnet Forensics did not respond to requests for comment from 404 Media. Apple stayed silent as well. The lack of statements leaves open questions about whether the bypass violates any terms or triggers future patches.

This development fits a familiar pattern. Apple tightens security. Forensic vendors find cracks. The cycle repeats. Earlier leaks showed GrayKey struggling with iOS 18 devices, extracting only partial data on newer models. The September 2026 report from Neowin highlighted those limits. Now the company claims progress against a specific protection added later.

Law enforcement agencies have spent heavily on these tools. Federal contracts with the ATF, DEA, and others include GrayKey licenses worth tens of thousands of dollars each. A September 2026 solicitation listed dozens of Preserve licenses alongside standard units. Agencies clearly value the capability.

Privacy advocates see danger. Strong default encryption protects ordinary users from thieves and overreaching governments alike. When tools erode those protections, everyone loses some security. Yet supporters argue lawful warrants deserve effective execution. The debate continues without easy answers.

Researchers note that powering off an iPhone before potential seizure still returns it to the protected state. That simple habit remains effective. For devices already in custody, the new Magnet tools change the equation.

Apple has patched forensic bypasses before. It may do so again. The company’s history shows quick responses to high-profile leaks. Whether it can close this gap without harming legitimate functions stays uncertain. The Secure Enclave’s design makes some changes complex.

In the meantime, police labs likely prepare to test GrayKey Preserve. The video calls the advance significant. One employee described it as something wished for years earlier. That enthusiasm suggests real operational impact.

The contest between smartphone makers and forensic firms shows no sign of slowing. Each side adapts. Users sit in the middle, hoping their data stays safe until they choose to share it. For now, the balance has shifted slightly toward investigators.

Further details may emerge as more agencies adopt the technology. Or as Apple analyzes the claims. Until then, the leaked video offers a rare window into tools that usually stay hidden from public view.