Apple has emphasized that they prioritize security over almost everything, including AI. That becomes even more important with Siri AI, which can now search through your messages, emails, photos and other information to answer questions based on your personal context.
However, a newly discovered forensic tool shows why the protection of all this information does not stop with securing the AI that uses it.
Magnet Forensics, the company behind the GrayKey phone forensics tool used by law enforcement, claims it has developed a way to bypass an iPhone security measure designed to make data significantly more difficult to extract from a confiscated device.
Latest Videos FromTom the guide
According to a leaked Magnet Forensics video obtained by 404 Media, a new device known as GrayKey Preserve and a feature called Evidence Preservation Mode can keep an iPhone in a more accessible state even after the phone normally restarts. Magnet itself says that its new GrayKey preservation capabilities were designed to tackle the iOS restart timer and preserve data on iOS devices indefinitely.
That’s potentially a big deal for iPhone privacy — and the timing couldn’t be more interesting.
The iPhone protection you probably didn’t know existed
Apple quietly added something called “inactivity reboot” to iOS in 2024. If an iPhone hasn’t been unlocked for 72 hours, it will automatically reboot. That’s not just an annoying reboot, it actually changes the security state of the phone.
If you’ve unlocked an iPhone after a reboot, it goes into what’s known as After First Unlock or AFU. Some encryption keys become available so that apps and services can work normally.
Restart the phone and leave it locked, and it reverts to Before First Unlock, or BFU, where more sensitive data remains encrypted and it’s harder for forensic tools to access.
That’s why the 72-hour timer can make a difference. Leave a seized iPhone untouched for too long and it may restart on its own, locking out more of its data. Magnet claims it has found a way around that.
According to the leaked video obtained by 404 Media, GrayKey Preserve can capture the AFU state and keep it available even if the iPhone later restarts or loses power. Magnet also claims that it can preserve data that normally disappears over time, including cached locations, recently deleted photos and recently deleted iMessages. Magnet’s own statement says its new GrayKey capabilities can preserve this data indefinitely.
How it works exactly is not clear. Security researcher Jiska Classen told 404 Media that the magnet could manipulate the iPhone’s clock or interfere with processes that leak data, but for now that’s just a theory.
Then there is Siri AI
Siri AI can use what Apple calls “personal context understanding” to find information scattered about your iPhone. Ask it to find an old photo, follow a recommendation buried in a message, or pull information from an email or calendar entry, and Siri can search for it. It also has onscreen awareness and can perform actions via apps.
That’s a big part of what makes the new Siri useful, but it also means the assistant works with some of the most personal information on your phone.
Apple has put a lot of emphasis on keeping this information private. Much of Apple Intelligence runs on the device, while more complex queries can go through private cloud compute. Apple says that the data sent there is not stored or made accessible to the company.
GrayKey raises another issue. It is reported not to break Siri AI or Private Cloud Compute. It goes after the iPhone itself.
And this is where the difference is important. Apple can lock down how its AI processes your information, but the messages, photos, emails and location data that Siri relies on still have to live somewhere. If someone gets physical access to the phone, protecting the underlying data becomes just as important as protecting the AI used.
What does this mean for your iPhone?
There are still many unknowns. We don’t know exactly how the magnet technique works, which versions of iOS it works on, or whether Apple has already closed the door. The leaked magnet video will also appear until the beginning of 2025, although it has only appeared now.
And this is not a case of plugging any iPhone into GrayKey Preserve and immediately seeing everything in it. Magnet’s claim is more specific: its technology can prevent an iPhone from moving into the more restrictive security state it usually enters after prolonged inactivity.
Still, the timing is hard to ignore. Apple asks Siri to understand more about you while promising that the information behind these personalized responses will remain private. On-device processing and Private Cloud Compute protect how Apple Intelligence handles this data, but they don’t eliminate the need to protect what sits on the iPhone itself.
As Siri becomes more personal, the data it relies on is sure to become even more important.
follow Tom’s Guide to Google News in the add us as a preferred source to get our latest news, analysis and reviews in your feeds. Subscribe to Tom’s Guide YouTube and keep following us TikTok.
