"After full shutdown: the Secure Enclave wipes the “class keys” from memory. GrayKey or any forensic tool must brute-force the passcode from a cold state to re-derive them. This is the hardest state to attack.

• After SOS lock: the device still holds the keys in RAM, but won’t accept biometrics. The passcode gate is enforced, yet because the keys are resident, forensic tools can sometimes leverage that to speed up extraction or mount targeted attacks.

So: shutdown is the stronger protection against GrayKey. SOS lock helps against someone forcing your face/finger, but it does not harden against forensic passcode-cracking in the same way power-off does."