Grayshift
American mobile-device forensics company best known for GrayKey, a tool used by authorized law-enforcement and government customers to access and extract data from locked mobile devices.
Last updated October 14, 2026
AI crawler reads
4requests
1companies- Anthropic4
- Profile
- 2
- Controversies
- 2
- JSON · MD
- 0
- First read
- Nov 4, 2026
- Latest read
- Nov 4, 2026
From this site's server log
Overview
Grayshift is a United States-based mobile-device forensics company headquartered in Atlanta, Georgia. It develops tools intended for authorized investigators and government agencies that need to examine information stored on smartphones and tablets, particularly devices whose passcodes or security controls prevent ordinary forensic acquisition. Its best-known product is GrayKey, a compact hardware and software system designed to gain access to, and extract forensic data from, selected Apple iPhone and iPad models and supported Android devices. The company was founded in 2016 by David Miles, Braden Thomas, Justin Fisher, and Sean Larsson. It emerged during heightened public debate over mobile-device encryption, especially after the 2015–2016 dispute between Apple and the United States Federal Bureau of Investigation concerning access to an encrypted iPhone. Reports about Grayshift began circulating in 2017, when media coverage described a new commercial device that could attempt passcode attacks and recover information from iPhones without requiring Apple to create a general-purpose bypass. By 2018, Grayshift was described as a privately held Atlanta company with fewer than 50 employees. GrayKey became the company’s central commercial offering. The product has been marketed to law-enforcement, defense, and other government organizations rather than to general consumers. Reported customers and users have included the FBI and police organizations in the United States, the United Kingdom, and Canada. Grayshift stated in 2022 that GrayKey was used by thousands of law-enforcement and government defense agencies in approximately 30 countries. Its capabilities have varied by device model, operating-system version, security configuration, and the vulnerabilities available at a particular time. Older devices and some device states have supported more extensive extraction, while newer security architectures may restrict investigators to unencrypted files or selected metadata. The product’s operation has been described publicly as involving passcode brute-force techniques and exploitation of weaknesses in mobile operating systems. Apple has repeatedly strengthened iOS security and changed the conditions under which accessories or external connections can communicate with a device. This has created an ongoing cycle in which commercial forensic vendors seek access methods while device manufacturers close the underlying vulnerabilities. GrayKey has also expanded beyond Apple devices: Android support was introduced in early 2021, and a March 2024 company announcement claimed full support for iOS 17 devices, Samsung Galaxy S24 smartphones, and Google Pixel 6 and Pixel 7 devices. Grayshift’s technology has attracted significant scrutiny because it can weaken or bypass protections designed to keep personal data inaccessible without the device passcode. Supporters frame such tools as necessary for lawful investigations, including cases involving serious crime, while critics have raised concerns about privacy, security disclosure, vendor oversight, and the possibility that access capabilities could be misused. In 2018, attackers reportedly obtained portions of GrayKey source code and attempted to extort the company for two bitcoins, although the reported disclosure consisted of small code fragments rather than a complete public release. The company has been financed by private investors including PeakEquity Partners and C&B Capital. By 2023, investment firm Thoma Bravo had majority control of Grayshift. In the same year, Thoma Bravo acquired Canadian digital-investigations company Magnet Forensics for approximately US$1.35 billion and announced that Grayshift and Magnet would combine. The transaction and subsequent merger linked Grayshift’s mobile-access capabilities with Magnet’s broader digital-forensics software portfolio. Grayshift therefore operates within the Magnet Forensics organization while retaining a distinct identity associated…
History
Grayshift was established in 2016 by David Miles, Braden Thomas, Justin Fisher, and Sean Larsson. The Atlanta-based company focused on a specialized problem in digital investigations: acquiring evidence from mobile devices that could not be examined through conventional forensic methods because they were locked or protected by modern encryption. Its emergence followed the intense public dispute between Apple and the FBI over whether Apple should assist investigators in bypassing security on an iPhone. That dispute increased attention on third-party technologies capable of accessing mobile devices without requiring the manufacturer to build a universal decryption mechanism. By 2017, reports had begun describing Grayshift’s GrayKey product. The system was presented as a compact forensic appliance for authorized government and law-enforcement use. Public reporting described it as attempting passcodes and exploiting weaknesses in supported device and operating-system configurations. Its capabilities were not uniform: device generation, iOS version, Android version, lock state, and available vulnerabilities all affected what could be recovered. Older phones could sometimes yield more comprehensive extractions, while later models and software versions imposed greater restrictions. In 2018, Grayshift was characterized as a privately held company with fewer than 50 employees. GrayKey attracted customers among United States agencies and police organizations in the United States, Canada, and the United Kingdom. The company later described a wider international customer base spanning approximately 30 countries. Its commercial model and technology also generated debate. Law-enforcement organizations regarded mobile-device access as an investigative capability, whereas privacy and security observers questioned the implications of tools that could defeat or work around protections intended to keep data inaccessible. The competitive environment has been shaped by continuous changes from Apple and Google. Apple introduced additional protections around external device connections and repeatedly revised iOS security, while forensic vendors worked to identify new weaknesses or techniques. Public accounts described this as a continuing cycle of exploitation and patching. The practical result was that GrayKey’s functionality changed over time and differed across devices. In early 2021, Grayshift added Android support, broadening the product beyond the iPhone and iPad ecosystem. The company also experienced a security incident in 2018, when attackers reportedly obtained small portions of GrayKey source code and tried to extort Grayshift for two bitcoins. The incident added to concerns surrounding the security of commercial device-access tools, although the reported disclosure was not a complete public release of the product’s source code. Grayshift was financed by private investors, including PeakEquity Partners and C&B Capital. By 2023, Thoma Bravo held majority control. Thoma Bravo acquired Magnet Forensics, a Canadian company specializing in digital-investigation software, for approximately US$1.35 billion. Following that acquisition, Grayshift and Magnet announced a combination, and the merger was completed later in 2023. The resulting organization brought together GrayKey’s mobile-device access capabilities and Magnet’s broader forensic investigation, analysis, and case-management offerings. In March 2024, Grayshift announced support claims covering iOS 17 devices as well as Samsung Galaxy S24, Google Pixel 6, and Google Pixel 7 smartphones. These announcements illustrated the company’s continuing product-maintenance challenge: maintaining forensic access as mobile manufacturers introduce stronger hardware-backed security, revised authentication controls, and frequent operating-system updates. Grayshift remains associated with GrayKey and operates as part of the Magnet Forensics organization under Thoma Bravo’s ownership.
- 2024
Support announced for newer mobile devices
[2]Grayshift announced support claims for iOS 17, Samsung Galaxy S24, and Google Pixel 6 and Pixel 7 devices.
- 2023
Merger with Magnet Forensics
[1]After Thoma Bravo acquired Magnet Forensics, Grayshift and Magnet combined their businesses during 2023.
- 2021
Android support introduced
[1]GrayKey expanded its supported platform range by adding Android devices.
- 2018
Private-company profile and source-code incident
[1]Grayshift was reported to have fewer than 50 employees, and attackers separately sought bitcoins after obtaining small pieces of GrayKey source code.
- 2017
GrayKey gains public attention
[1]Reports began describing GrayKey as a device intended to access and extract data from locked iPhones.
- 2016
Company founded
[1]David Miles, Braden Thomas, Justin Fisher, and Sean Larsson founded Grayshift in the United States.
Products and positioning
A specialist provider of mobile-device access and forensic extraction technology for authorized law-enforcement, defense, and government investigations. Grayshift is positioned around access to locked or security-protected Apple and Android devices, with capabilities that change as mobile operating systems and device security are updated.
Mobile-device forensic access and extraction platform · 2017
GrayKey
GrayKey is Grayshift’s principal mobile-device forensics product. It is designed for authorized law-enforcement, defense, and government investigators seeking to access and extract evidence from supported iPhone, iPad, and Android devices. Public descriptions indicate that its effectiveness depends on the device model, operating-system version, passcode state, and currently available security weaknesses. Earlier devices and configurations could permit more extensive extraction, while newer devices may yield only unencrypted files or selected metadata. GrayKey has evolved through continuing updates as Apple, Google, and handset manufacturers modify their security systems.
Controversies
Brand decisions
2024
Extend GrayKey support to newer devicesGeneration changeBackground
Mobile operating-system updates and new hardware security controls require forensic vendors to continually revise their supported-device coverage.
Action taken
Grayshift announced full support claims for iOS 17 devices, Samsung Galaxy S24 smartphones, and Google Pixel 6 and Pixel 7 devices.
Aftermath
The announcement demonstrated continued maintenance of GrayKey for current Apple, Samsung, and Google device generations.
2023
Combine Grayshift with Magnet ForensicsM&ABackground
Thoma Bravo controlled a majority of Grayshift and acquired Canadian digital-forensics company Magnet Forensics for approximately US$1.35 billion.
Action taken
Grayshift and Magnet Forensics announced and completed a merger during 2023.
Aftermath
Grayshift became part of the Magnet Forensics organization, combining GrayKey’s mobile-access capabilities with Magnet’s wider digital-investigation software portfolio.
Magnet Forensics acquisition value. US$1.35 billion (2023 acquisition)
2021
Add Android support to GrayKeyProduct launchBackground
The company had initially become known primarily for iPhone and iPad access, while investigators also needed forensic capabilities for the expanding Android device market.
Action taken
Grayshift released GrayKey support for Android devices.
Aftermath
The product’s addressable platform range expanded beyond Apple’s mobile ecosystem.
Recent events
Sources3 sources
Cite this profile: Cite the canonical profile. /brand-wiki/grayshift · Editorial policy · How profiles are compiled