The Digital Security Digest, by Freedom of the Press Foundation (FPF), is a weekly newsletter with security tips that keep you, your sources, and your devices safe. If someone shared this newsletter with you, please subscribe here.
Leaked law enforcement tutorial video says forensic tools bypass iOS’s automatic reboot feature
Starting with iOS 18.1, released in late 2024, Apple introduced a simple but potent security feature to iPhones. When it has not been unlocked for more than 72 hours, your iPhone will automatically reboot. Why does this matter?
This feature disrupts forensic software used by law enforcement, as well as some authoritarian governments around the world, because these tools are much more effective at making copies of your data when you have typed in your passcode and the phone remains powered on — even if you locked your device. As soon as a device is rebooted or powered down, forensic tools are significantly more limited in their ability to extract your personal data.
According to a video leaked to 404 Media dating to early 2025, Magnet Forensics, maker of Graykey smartphone forensic devices, has developed a technique for subverting this automatic reboot feature. In the tutorial intended for law enforcement, a Magnet employee states (without explaining how) that existing Graykey products, including a new tool dubbed Graykey Preserve, support a feature called Evidence Preservation Mode, which bypasses an iPhone’s automatic reboot function.
What you can do
- Shut down your phone in sensitive moments. If you are at risk of having your device seized or snatched, know that your device is only properly encrypted when powered down, or until you type in your passcode to unlock the device. The moment you power it on and type in the passcode, you have decrypted the device, making your data much more vulnerable.
- Keep your devices up to date. We know from previous reporting from 404 Media that it can take months, and perhaps longer, for researchers to develop exploits that work on devices with the newest security patches. This is a good reason to invest in a reasonably new phone, and to download your updates as soon as you can.
- Use a stronger password. By default, your phone probably offered you a chance to make a six-digit numeric passcode. We challenge you to make something stronger! You can make a phone snatcher’s job much harder by using a passcode that is long and difficult to predict. Learn how to use an alphanumeric passcode, and if you can, use a random set of words, which you can generate and store safely with a password manager.
- Try Lockdown Mode. Automated attacks conducted by forensic devices and similar tools typically depend on a physical connection to your phone through your charging port. With Apple’s Lockdown Mode enabled, your device is further hardened by requiring the person accessing it to unlock it and use a specific USB connection. Try out Lockdown Mode for iPhone, iPad, or your MacBook. Android users can take advantage of a similar feature called Advanced Protection. Note that this may affect some functionality on these devices. For example, you may find that certain webpages load differently, and some messages from unfamiliar people may be blocked. Test it to see if this is a worthy trade for the extra reassurance.
Our team is always ready to assist journalists with digital security concerns. Reach out here, and stay safe and secure out there.
Best,
Martin Shelton
Deputy Director of Digital Security
Freedom of the Press Foundation
