Signs have emerged that forensic tools used by police and other investigative agencies may be able to maintain conditions that favor access to iPhone data even after an automatic reboot.

On Oct. 1 local time, IT outlet Engadget reported that mobile forensics firm Magnet Forensics introduced GrayKey Preserve and the existing GrayKey Evidence Preservation Mode in a video made for training investigative agencies. The two features focus on preventing Apple’s automatic reboot from reducing forensic accessibility.

Apple has applied a security feature since iOS 18.1 that automatically restarts iPhones that have not been unlocked for an extended period. After a reboot, a device returns from the After First Unlock (AFU) state to the Before First Unlock (BFU) state. In BFU, more encryption keys are locked, making it much harder for forensic tools to access data.

In the video, a Magnet Forensics employee claimed the new feature captures and preserves an iPhone’s AFU state so that the forensic condition is not lost even if power is lost or a reboot occurs. The video did not disclose the specific operating mechanism. A security researcher said possibilities raised include manipulating system time or blocking processes responsible for data expiration.

GrayKey Preserve was reported to also block cellular, WiFi and Bluetooth communications after initial access to prevent data changes caused by external communications. Magnet Forensics said the evidence preservation mode also provides a function to preserve cached location information that may disappear after a certain period, as well as recently deleted photos and iMessage messages.

The video was said to have been produced in early 2025, but it has not been confirmed how much the technology has been used in actual investigations or whether it works the same way on the latest iPhones and iOS. The case shows that the standoff continues between tighter smartphone security and investigative agencies’ digital forensics technology.