A massive leak has revealed the inner workings of Graykey, a powerful phone unlocking tool widely used by law enforcement for digital forensics. For the first time, detailed insights have been shared about its capabilities—particularly concerning newer iPhones running iOS 18.
The leaked documents, initially shared by 404 Media, show that while Graykey can still unlock many iPhones, there are limits. It works on devices from the iPhone 12 to the iPhone 16 series, but it can only access partial data from those running iOS 18 and the smaller update, iOS 18.0.1. For users hoping to retrieve everything from their devices, Graykey doesn"t quite deliver—there’s still plenty it can’t get to.
A significant twist in this leak is that it doesn’t clearly explain what Graykey can do with iPhones running iOS 18.1, which was released just last month. It seems Graykey hasn"t caught up to this version yet, and phones are running the beta versions of iOS 18. Forget it—Graykey can’t unlock them at all. 404 Media has provided full versions of the leak here and here.
While Graykey’s work on iPhones is increasingly tricky due to Apple"s constant security updates, its performance with Android devices isn’t much better. It can unlock partial data from Google Pixel devices—up to the Pixel 9—but only if the phone is in an “After First Unlock” state, meaning the device must have been unlocked at least once since booting up.
This leak is a big deal because it gives us a rare look into what Graykey can actually do and what it can’t. Before this, its capabilities were shrouded in secrecy. Forensic experts now have a much clearer picture of its strengths and weaknesses when it comes to cracking iPhones.
However, just because Graykey can’t unlock every piece of data doesn’t mean its battle with Apple and Google is over. In fact, it"s all part of a long-running cat-and-mouse game. While Apple and Google push updates to protect user data, forensic companies like Grayshift and Cellebrite work tirelessly to stay ahead, trying to overcome obstacles like the USB Restricted Mode, Inactivity Reboot, and other security measures Apple has introduced in recent years.