In the October 2 morning intelligence digest, a line from 404 Media flashed by: police had learned to get around the iPhone’s automatic idle reboot—the one that hides encryption keys on a seized phone. A year ago, that reboot was written about as a quiet Apple victory: leave a device sitting unattended, and it slips on its own into a state where its data cannot be reached. Now it turns out the victory has an expiration date.
The first thought was dull: an iOS hole, a patch will come out, case closed. The numbers said otherwise. U.S. Customs and Border Protection (CBP) gets hold of a phone during the first day of a trip, while Apple gives the device exactly 3 days before it reboots itself. Nothing is broken between those timeframes: the mismatch is not in the code, but in who gets to decide when the clock starts.
An iPhone does not recognize its owner immediately. Until the passcode is entered for the first time after startup, the device lives in a state called Before First Unlock (BFU): the user-data partition is encrypted, while the keys sit in the Secure Enclave (SEP)—a separate coprocessor that handles cryptography and does not hand keys out to the outside world. Until the passcode is entered, Face ID does not work, saved Wi-Fi networks do not connect, and incoming messages have no previews: there is nothing to show, because the contacts and text are still encrypted.
Entering the passcode opens the keybag, and that safe remains wide open for as long as the device is running. This state is called After First Unlock (AFU), and it is where nearly everything of interest in a search lives: cached locations, recently deleted photos, message history. As long as a phone is powered on and has been unlocked at least once, a forensic extractor gets an order of magnitude more from it than from a brand-new one fresh out of the box.
A reboot sends everything back to BFU. That is why seized phones have been kept alive for years—away from networks, in shielded rooms, but powered on. Automatic reboot breaks precisely this procedure: the device slips into BFU without asking and without a human being involved.
The feature was spotted in November 2024. Forensic specialists complained that seized iPhones were rebooting “on their own” and blamed wireless networks. Jiska Classen, head of a research group at the Hasso Plattner Institute in Potsdam, found the mechanism’s name—“inactivity_reboot”—in keybagd, the daemon responsible for the keybag, and determined that the string first appeared in iOS 18.1.
Then came the layer-by-layer teardown. The SEP stores the time of the last unlock. If more than 3 days have passed, it reports this to the AppleSEPKeyStore kernel module; the module asks user space to begin a reboot, and SpringBoard gracefully shuts down processes. If the module sees that the phone is still running after the deadline, the kernel panics—that is by design.
The SEP firmware itself is encrypted, but keys for the iOS 18.1 version leaked online almost at the same time as the release, and Classen took it apart: inside the sks application she found a table of four time values, including 3 days, 2 days, 1 day, and 2.5 hours. The reference point is held in silicon, beyond the reach of either internet time or carrier signal. You cannot feed the phone someone else’s date and move the deadline.
As for the bypass reported on October 1. Magnet Forensics, the company behind the GrayKey tool, released a GrayKey Preserve device and added an Evidence Preservation Mode to its existing hardware. Judging by the internal video, this is how it works: once it has access, the device disables cellular service, Bluetooth, and Wi-Fi, then preserves the AFU state within itself. An employee explains on camera, with no embarrassment at all:
“This AFU state is preserved. Even if the device reboots for any reason—memory maintenance, loss of power, whatever—the AFU state is not lost. That’s the real magic of GrayKey Preserve and Evidence Preservation Mode.”
There is no technical mechanism in the video. Classen, whom 404 Media asked to analyze it, suggests 2 possibilities: manipulating the clock, or disabling tasks that mark data as expired. It is also claimed that the mode prevents the location cache, recently deleted photos, and iMessage messages from disappearing—they are retained indefinitely.
Here, a noticeable divergence begins between the sources. 9to5Mac and AppleInsider call this a “bypass” of the reboot, Engadget writes about new ways of accessing data on a locked iPhone, while the video’s own phrasing points closer to a third meaning: not hacking, but requisition—the state is copied before the phone hides it. If that is so, the “magic” is not in the mathematics but in the logistics: getting there before the device hides the keys.
There is still honest uncertainty. The video is dated early 2025, and no one explains whether the method works against current iOS versions. Apple and Magnet Forensics did not respond to requests for comment.
The current timer is not the first in this race. iOS 8 (2014) introduced Erase Data: after ten incorrect passcode attempts, the keys are destroyed. That feature was the formal trigger for the FBI’s case against Apple: in 2015, a work iPhone 5C with a 4-digit passcode was seized in San Bernardino, and in February 2016 the Justice Department demanded that Apple write and sign software that would bypass auto-erasure, accept brute-force attempts over the port, Bluetooth, and Wi-Fi, and impose no artificial delays between attempts. Apple refused; a court in Brooklyn declined to stretch the All Writs Act this far (“absurd results,” in Judge Orenstein’s wording); and the FBI ultimately paid more than $1.3 million for a hacker.
The second attempt was USB Restricted Mode in iOS 11.4.1 (2018). The Lightning port stops transferring data if an hour passes without an unlock: the device turns into a dumb charger. A few days later, ElcomSoft showed that the deadline could be reset by connecting a Lightning accessory to the phone—even one that had never encountered that particular phone before; a $39 adapter was enough. The reason lies in the trust model: accessories are identified by their MFi certificate, and no key exchange with them is required. A timer tied to an event the adversary can imitate does not become a boundary.
The third attempt is those same 72 hours inherited by iOS 18.1. It was not only forensic specialists who reacted to them, but thieves as well: in Classen’s logic, within 3 days a stolen phone does not have time to receive a fresh exploit, while old tools from flea markets are useless against updated firmware. The asymmetry is the whole point of the design.
So far, this has been about targeted searches, where a phone is transported to a lab and the exploit takes weeks to arrive. But the timer has a second front, and it is far broader.
U.S. Customs and Border Protection processed 419 million travelers in fiscal year 2025 and searched the devices of 55,318 of them—less than one-hundredth of a percent. Of those searches, 50,922 (92%) were “basic”: an officer manually scrolls through the contents, with no external equipment. An “advanced” search involving connected hardware requires reasonable suspicion and sign-off from a senior supervisor. The trouble is that the whole mass of these cases lives in the first 2 lines of those statistics—CBP reporting has been rising for 3 years: 10,937 searches in the first quarter of 2024, against 19,732 in the third quarter of 2026.
This is where the 2 figures converge. The timer counts from the last unlock, not from the moment of seizure, and at the border a device is not held for days while they wait for a warrant—it is inspected at once. Few people can get their property back, either: a U.S. citizen cannot be denied entry, but their phone can be held pending further inquiry; for a foreigner, refusing a search becomes part of the decision on admission to the country.
The scale of the market explains why this timer exists at all. According to 2020 data cited by the New York Times, more than 2000 U.S. law-enforcement agencies had bought tools for opening locked phones—mostly from Cellebrite and Grayshift. Prices from Fairfield Police Department procurement records (2023): $550 for the GrayKey device itself, around $11,000 for a license, $300 to train each employee. Promotional material promises a Turbo Brute Force mode that speeds up iOS passcode guessing by 33–43%.
And that answers the original question: why the bypass is revealed through a leaked video rather than a closed patch. Back in 2024, when the timer was first noticed, forensic-software makers were falling over one another to promise they could complete an extraction within a day—and Classen remarked in response that this gave them away completely: judging by their deadlines, they only have exploits for the AFU state. For those with a ready-made hack, 72 hours are an inconvenience, not a fatal obstacle; for those without one, even 3 days are not enough.
As long as the price of cracking is $11,000 per agency and at least a day of logistics, the timer protects against the slow route: transport, queues, warrants. The fast route—an officer looking through the phone on the spot—cannot be shut down by a timer in principle: it counts from the last unlock, and it cannot reach back before the first unlock while the phone is in someone else’s hands.
The phone now counts for itself and asks no one. But it knows how to count only one thing: how long it has gone unopened. So Apple, apparently, has another timer ahead of it—and the market, which adapts to each one within a few months, will answer that one too.