In mid-December 2025, a convicted drug trafficker who had been living on borrowed time finally ran out of it. Police located him at a convenience store in Westbrook, Maine, and arrested him for breaching the conditions of his parole. It was the kind of ordinary, uncelebrated arrest that happens in small cities across America every day. But when officers searched the rental car he had been using, they found four iPhones. Four phones meant possible evidence: texts, photos, videos, location history, web searches, maybe the names of suppliers and customers. But the phones were locked, and the clock was ticking. In the fall of 2024, Apple introduced a security feature that automatically reboots an iPhone after it has been locked for 72 hours or more. The purpose of this feature is to make it harder for someone, including police, to break into a phone that has been inactive. Once the phone reboots, its encrypted data becomes dramatically less accessible, and a forensic examiner may never get another chance to read it. For law enforcement, the auto reboot turns every seized iPhone into a piece of evidence with an expiration date. Investigators generally have three days to convince a judge to give them a warrant and then carve out time to extract the data. That might sound like enough, but in real life it often isn’t. Arrests happen at odd hours, judges are not always available, and drug networks don’t stop communicating. Enter GrayKey Preserve, a tool made by Magnet Forensics that can pause Apple’s 72-hour countdown. It doesn’t unlock the phone. It doesn’t steal the data. It simply freezes the device’s current state so that it remains just as accessible, or inaccessible, as it was when officers seized it. In the Westbrook case, the tool gave investigators the extra time they needed to seek a warrant and preserve the possibility of searching those four iPhones for chats, images, videos, and browsing data. The arrest itself was unremarkable; the technology behind the scenes was not. It is a window into a quiet arms race between Silicon Valley and law enforcement, one that is happening in police departments and border offices far from public scrutiny.
To understand why GrayKey Preserve matters, it helps to look at what it actually does. Apple’s security feature is sometimes described as an inactivity reboot, and it works by automatically restarting the phone if it has not been unlocked for 72 hours. After a restart, the device enters a more secure state known in forensic circles as “Before First Unlock.” In that state, the encryption keys needed to access messages, photos, and other sensitive data are stripped out of memory. To put it simply, the phone becomes a much harder nut to crack. GrayKey Preserve is specifically designed to stop that change from happening. The tool connects to the phone and prevents the automatic reboot, essentially putting the device in a kind of forensic holding pattern. No passcode is broken. No files are copied. No text messages are read. The phone remains exactly as it was when it was seized, waiting for a judge’s permission before anyone goes looking inside. Det. Sgt. Maurice Drouin of the Androscoggin County Sheriff’s Office in Maine, who has used the tool regularly, describes it as a form of evidence preservation, not extraction. “Preserve is preventing the destruction of evidence,” he says. “By preserving the device, we are not gaining any additional information on the device. No data is extracted by the Preserve tool. The only thing it is allowing is for the state of the device to not change pending extraction of data.” Drouin also serves on an FBI task force that investigates violent crimes against children, and he says he is unaware of any legal problems with the tool. For him, the device is simply an answer to Apple’s decision to build a deadline into its operating system. Without it, a locked phone could effectively destroy its own evidence simply by sitting in an evidence locker. The distinction he draws is subtle but important. Police already have a right to seize a phone during an arrest; they just need a warrant to search it. Preserve does not give them the warrant. It gives them time. And in a world where time is the most precious resource in any investigation, that can make all the difference.
GrayKey Preserve did not emerge out of nowhere. It is one product of a corporate consolidation that has transformed the business of police phone forensics. The tool is made by Magnet Forensics, a Canadian company founded in 2010 by Jad Saliba, a former police officer who knew firsthand how frustrating it was to encounter a locked phone in the middle of an investigation. Saliba built Magnet into a major player in digital forensics, the process of recovering and analyzing data from electronic devices. For years, Magnet’s main rival was Cellebrite, an Israeli firm that has become a $3 billion powerhouse in law enforcement technology. Cellebrite’s devices were so widely used that they almost became synonymous with phone cracking. Magnet needed its own edge. It found one through a merger. In 2023, the private equity firm Thoma Bravo paid $1.3 billion to acquire Magnet and paired it with Grayshift, an Atlanta-based company that had developed GrayKey, a device designed to crack into iPhones. The combination created a powerful one-two punch: Grayshift’s hardware-based unlocking capabilities and Magnet’s software and analytical tools. GrayKey Preserve was one of the products that grew out of that union. According to Forbes, court and contract records as well as public information requests show that local and federal police in at least six U.S. states are now using the tool: Georgia, Maine, Missouri, Mississippi, New York, and Rhode Island. Perhaps more significant, Immigration and Customs Enforcement has recently acquired GrayKey Preserve as well. That marks a major expansion. What began as a tool for local narcotics officers and forensic labs is now part of the federal government’s investigative toolkit. The company itself has been quiet about the product. Neither Apple nor Magnet Forensics responded to Forbes’ requests for comment. But the silence has not stopped demand. In an age when nearly every crime has a digital component, law enforcement agencies of all sizes are looking for ways to get around the privacy features built into their suspects’ devices.
The known use of GrayKey Preserve is scattered but growing. In New York, the Onondaga County Department of Law in Syracuse appears to be the biggest user: its Center for Forensic Sciences told Forbes that the Preserve technology had been used 71 times to date. The agency did not break down how many of those uses resulted in evidence being preserved successfully, but the sheer number suggests that Preserve is not a toy. It is a standard part of the forensic workflow. In Maine, the Androscoggin County Sheriff’s Office has integrated the device into its operations so thoroughly that Drouin says it is used weekly. Search warrants reviewed by Forbes show that the agency regularly deploys Preserve in narcotics trafficking investigations, the kind of cases where text messages and encrypted chats often make or break a prosecution. Drouin, who balances his local duties with work on an FBI task force focused on violent crimes against children, says the device has become a tool he can count on. Yet there are layers of secrecy around its use. Two GrayKey customers, the St. Louis County Police Department in Missouri and the Androscoggin County Sheriff’s Office, told Forbes they could not respond to specific public records questions about the tool because Magnet Forensics required them to sign nondisclosure agreements. Those agreements mean that the public may never learn the details of how often the tool is used, in what kinds of cases, and with what outcomes. It also means that the company, not the courts, sets the terms of public accountability. For law enforcement, the secrecy is part of a broader culture of operational security. Investigators do not want suspects to know what tools they have or how they work. But for privacy advocates, the arrangement is deeply troubling. The public has a right to know when and how the government freezes a suspect’s phone, especially when the freeze can go on for days or weeks. The lack of transparency, coupled with the growing number of agencies using the technology, raises questions that go beyond any single case.
Legal experts who have reviewed GrayKey Preserve say the tool is on solid ground in at least one important respect. Orin Kerr, a law professor at Stanford who has spent decades studying criminal procedure and technology, says the use of a Preserve device should be entirely lawful as long as police had probable cause for the initial seizure and are working to get a warrant. Federal law, he notes, permits police to take reasonable steps to preserve evidence. The deliberate act of preventing an automatic reboot is no different, in his view, from putting a car in a garage or putting a document in a safe so it doesn’t disappear before a judge can decide whether the police may search it. But the law also leaves a lot of room for interpretation. How long can police hold a phone while they are working on a warrant? What happens if the warrant is denied? What if the phone belongs to someone who is never charged? The Fourth Amendment requires that searches and seizures be reasonable, and a tool that preserves evidence can, in practice, become a tool that extends police power over a person’s digital life. Privacy advocates argue that the dangers are especially acute when the user of the tool is Immigration and Customs Enforcement. Maria Villegas Bravo, counsel at the Electronic Privacy Information Center, says the acquisition of Preserve “supercharges the existing issues with ICE’s instinct to search devices first and ask questions later.” She warns that “scope creep, mission creep, and general expansion of what they’re able to do, and being able to preserve that, gives them a longer time to investigate people.” For communities that already fear immigration enforcement, a phone that is frozen for weeks is not a neutral technicality. It is a source of anxiety, uncertainty, and potential harm. Apple designed its 72-hour reboot feature to give users a measure of protection. GrayKey Preserve takes that protection away. The constitutional balance may hold in routine cases, but the more the tool spreads, the harder it is to guarantee.
GrayKey Preserve is not the only device of its kind, and the market is clearly moving in the same direction. Cellebrite, Magnet’s biggest rival, recently announced that its Inseyets data extraction app includes a similar feature that promises to pause Apple’s countdown. Users of that app include U.S. Customs and Border Protection and the Pentagon. In other words, the ability to stop the 72-hour clock is becoming a standard feature in law enforcement forensics, not a one-off miracle tool. That reality evokes mixed feelings. It is reassuring because investigators in complicated cases involving cartels, child predators, and terrorism need every legal advantage they can get. It is worrying because the line between preserving evidence and invading privacy is not always clear. The case of the four iPhones in Westbrook shows how quickly the issue can become concrete. A parole violation led to a car search, which led to four phones, which led to a forensic tool that kept the phones in a state investigators could legally search later. If the tool had not been available, the phones might have quietly rebooted and locked their secrets away. And maybe that would have been the right outcome. Or maybe it would have allowed a dangerous trafficking network to escape justice. Behind every locked phone is a person, and behind every investigation is a victim somewhere hoping for answers. There is no easy answer, and the people who have to make these decisions every day know it. Drouin sees the tool as a form of fairness: evidence should not be destroyed simply because a company decided to make a phone that forgets its keys. Privacy advocates see the tool as a form of power: the government should not be able to press pause on a citizen’s digital life without oversight. The GrayKey Preserve story is far from finished. Apple will continue to update iOS. Cellebrite and Magnet will continue to build workarounds. Lawmakers and judges will be asked to decide which side has gone too far. In the meantime, the phones will stay locked, the timers will keep counting, and the argument over who should control the keys will only grow louder. The gray key has already opened a door; the only question is whether the door will be guarded by warrants and transparency, or pushed open by institutional demand and technological momentum.
