Exploits, Tools & Data Recovery · Passcode Bypass & the Unlocking Industry · Lesson 2 of 5

The Unlocking Industry

Meet the companies that sell phone unlocking to police, and what leaks revealed.

Who sells a way in

A small industry exists to help investigators get into locked phones. Its customers are mainly police, prosecutors, and border and military agencies. Vendors usually describe what they sell as lawful access tools, meant to be used with legal authority, such as a search warrant, or with the owner's consent.

Two names come up most in reporting:

• Cellebrite, an Israeli company best known for its phone extraction tools. Its top unlocking offering is called Premium. Cellebrite's website says Premium offers "AFU and BFU access to locked iOS devices" and to locked Android devices, and that agencies can run it as a cloud-based service or on their own server.
• GrayKey, built by the US company Grayshift. Investment firm Thoma Bravo took majority control of Grayshift in 2022, agreed in January 2023 to buy the Canadian forensics company Magnet Forensics, and planned to combine the two. The product is now sold as Magnet Graykey. Magnet's page says it gives access to "the latest iOS and Android devices", that it "is not available to the private sector", and that it's sold only in select countries.

Other forensic vendors, such as MSAB in Sweden and Oxygen Forensics, also sell extraction and analysis tools. Notice the quotation marks above. These are marketing claims, not independent test results.

Prices are rarely public. In 2018 Forbes reported GrayKey's early pricing as $15,000 for an internet-connected version limited to 300 uses, and $30,000 for an unlimited offline version. Motherboard later published a state police purchase order that matched that pattern. Today's prices are set by contract and are likely different.

Why do these tools exist at all, if phones are so well protected? Because protections are only as strong as their code, and code has bugs. Unlocking tools depend on vulnerabilities, flaws the vendor knows about and the phone maker hasn't fixed yet. That one fact explains most of what follows in this module.

What the leaks showed

Vendors keep the details of their tools' abilities private, but some have leaked. In July 2024 404 Media, a technology news site, reported on Cellebrite documents dated April 2024 that had been shared with customers but not published. They were support matrices, charts listing which phones and software versions a tool could handle.

According to 404 Media and outlets that summarized its report:

• Locked iPhones running iOS 17.4 or later were listed as "In Research", meaning Cellebrite couldn't reliably unlock them at the time.
• The Android chart showed Cellebrite could get into many Android phones, but not all. It couldn't brute force (guess its way into) a Google Pixel 6, 7 or 8 that was turned off.

In November 2024 404 Media reported on leaked GrayKey documents. They said GrayKey could retrieve only partial data from modern iPhones running iOS 18 or 18.0.1, and they didn't cover the public release of iOS 18.1.

Three lessons come out of these leaks. First, capability depends on the exact model, software version and lock state. Second, it changes constantly. A chart is a snapshot. An update can close a gap, and a vendor can later find a new one. Third, the newest software tends to be the hardest target.

The industry also faces criticism over who uses its tools. In December 2024 Amnesty International reported that Serbian police and intelligence services had used Cellebrite products to get into the phones of journalists and activists, in some cases before installing spyware. In February 2025 Amnesty reported that a chain of previously unknown Android flaws, which it linked to Cellebrite, had been used against a student activist's phone. Google fixed the first of them in its February 2025 Android Security Bulletin. Later that month Cellebrite said it had stopped the relevant Serbian customers from using its products. Vendors say they vet their customers. Rights groups argue that vetting and oversight need to be much stronger.