The 72-Hour Security Measure

Apple has emphasized that they are prioritizing safety over almost everything, including AI. That's becoming even more important with Siri AI, which can now search across your messages, emails, photos and other information to answer questions based on your personal context.

However, a newly revealed forensic tool shows why protecting all that information doesn't end with securing the AI that uses it.

Magnet Forensics, the company behind the GrayKey phone-forensics tool used by law enforcement, claims it has developed a way to get around an iPhone security measure designed to make data significantly harder to extract from a seized device.

According to a leaked Magnet Forensics video obtained by 404 Media, a new device known as GrayKey Preserve and a feature called Evidence Preservation Mode can keep an iPhone in a more accessible state even after the phone would ordinarily reboot. Magnet itself says its new GrayKey preservation capabilities were developed to address the iOS reboot timer and can preserve data on iOS devices indefinitely.

That's potentially a big deal for iPhone privacy — and the timing couldn't be more interesting.

The iPhone protection you probably didn't know existed

Apple quietly added something called "inactivity reboot" to iOS in 2024. If an iPhone hasn't been unlocked for 72 hours, it automatically reboots. That isn't just an annoying restart, it actually changes the security state of the phone.

Once you've unlocked an iPhone after a reboot, it enters what's known as After First Unlock or AFU. Some encryption keys become available so apps and services can work normally.

Restart the phone and leave it locked, and it goes back to Before First Unlock, or BFU, where more sensitive data remains encrypted and is harder for forensic tools to reach.

That's why the 72-hour timer can make a difference. Leave a seized iPhone untouched for too long and it can reboot on its own, locking down more of its data. Magnet claims it has found a way around that.

According to the leaked video obtained by 404 Media, GrayKey Preserve can capture the AFU state and keep it available even if the iPhone later reboots or loses power. Magnet also claims it can preserve data that would normally disappear over time, including cached locations, recently deleted photos and recently deleted iMessages. Magnet's own explanation says its new GrayKey capabilities can preserve that data indefinitely.

Exactly how it works isn't clear. Security researcher Jiska Classen told 404 Media that Magnet could be manipulating the iPhone's clock or interfering with the processes that expire data, but for now that's only a theory.

AI Integration and Data Privacy

Siri AI can use what Apple calls "personal context understanding" to find information scattered across your iPhone. Ask it to find an old photo, track down a recommendation buried in a message or pull information from an email or calendar entry, and Siri can go looking for it. It also has onscreen awareness and can take actions across apps.

That's a big part of what makes the new Siri useful, but it also means the assistant is working with some of the most personal information on your phone.

Apple has put a lot of emphasis on keeping that information private. Much of Apple Intelligence runs on device, while more complicated requests can go through Private Cloud Compute. Apple says data sent there isn't stored or made accessible to the company.

GrayKey raises a different issue. It isn't reportedly breaking Siri AI or Private Cloud Compute. It's going after the iPhone itself.

And that's where the distinction matters. Apple can lock down how its AI processes your information, but the messages, photos, emails and location data Siri relies on still have to live somewhere. If someone gains physical access to the phone, protecting that underlying data becomes just as important as protecting the AI using it.

Remaining Questions

There are still plenty of unknowns. We don't know exactly how Magnet's technique works, which versions of iOS it works on or whether Apple has already closed the door on it. The leaked Magnet video also appears to date from early 2025, even though it only surfaced now.

And this isn't a case of plugging any iPhone into GrayKey Preserve and instantly seeing everything on it. Magnet's claim is more specific: its technology can prevent an iPhone from moving into the more restrictive security state that normally kicks in after prolonged inactivity.

Still, the timing is hard to ignore. Apple is asking Siri to understand more about you while promising that the information behind those personalized answers stays private. On-device processing and Private Cloud Compute protect how Apple Intelligence handles that data, but they don't eliminate the need to protect what's sitting on the iPhone itself.

As Siri gets more personal, keeping the data it relies on secure has become even more important.