The Clock Behind the Lock

In its October 8 podcast summary, 404 Media says police can bypass the iPhone’s inactivity reboot. The underlying October 1 report by Lorenzo Franceschi-Bicchierai is more carefully framed: a leaked video contains a company’s claim that it can circumvent the feature. That distinction is not editorial upholstery. It separates a reported sales claim from a demonstrated capability.

The accessible opening names Magnet Forensics, the company behind the GrayKey phone-forensics tool, and two offerings: a device called GrayKey Preserve and an Evidence Preservation Mode for regular GrayKey devices. According to the report, the company claims it can freeze iPhones in a state that makes sensitive data easier for police to access.

This article could read that opening, but not the reporting behind the membership barrier. The video and an independent technical assessment were not examined. Nothing here establishes which models or software versions the claimed bypass supports, how reliably it works, or how widely it is used.

Buying time is not breaking everything

Franceschi-Bicchierai explains the defensive feature through earlier reporting: Apple introduced an automatic reboot after an iPhone had gone 72 hours without being unlocked. The purpose, his account says, was to return the device to a state that makes forensic access harder.

That description supplies the important distinction. A locked phone and a rebooted phone are not interchangeable conditions for the reported attack. Time without an unlock can change the defender’s position. A feature that prevents that transition would preserve an opportunity for access; it would not, by that fact alone, demonstrate that every passcode can be defeated or every file extracted.

The report also explains why the timer matters institutionally. Police may have seized a phone but still be waiting for court authorization, or have a backlog of devices awaiting examination. The delay is not necessarily idle time. In this account, it can allow a security feature to make the eventual examination more difficult.

That is a more revealing contest than “iPhones are secure” versus “police can unlock iPhones.” The reported product targets the interval between possession and attempted extraction. It is an effort to stop waiting from changing the technical conditions.

Security has apparently acquired a queue-management problem. That does not make the security imaginary.

Preservation for whom?

“Evidence Preservation Mode” names the benefit from the examiner’s side. From the owner’s side, the same claimed function would prevent a protective transition. Both descriptions concern the same device. Only one fits neatly on the product label.

Preserving a forensic opportunity, extracting data and having lawful authority to examine it remain separate questions. A company’s demonstration cannot settle the last one. Nor does the existence of an authorization process tell us what a particular tool can actually retrieve. The accessible reporting does not establish whether any specific use of these offerings was lawful or unlawful.

The standard worth defending is therefore neither blind reassurance nor universal defeat. People affected by a search need meaningful ways to challenge its scope and authority. Claims about technical access need bounded evidence: supported devices, relevant conditions and demonstrated results. That is how security and accountability become something more useful than opposing slogans.

A privacy system should be judged partly by whether the people whose information it exposes can contest that exposure—not merely by whether the institution holding the phone can complete its workflow. Making an investigation more convenient does not answer whose protections were weakened to achieve it.

For now, the evidence supports reporting a company’s claimed way around a defensive timer, not declaring the iPhone’s locks universally open. The product has a name. The public still needs the limits.