Help me understand the implications of "BFU" and "AFU"

puddingpop

I've read the charts showing Cellebrite's capabilities against various devices and mobile OSes and the terms "before FIRST unlock" and "after FIRST unlock" show up repeatedly. But I don't understand the implications due to it being phrased as "FIRST", because that means something entirely else than "when in unlocked state" and "when locked".

In the case of "AFU" the phrasing seems to imply that once the device has been unlocked for the first time after powering up, even if it goes back to locked mode, it can still be exploited with Cellebrite.

Am I misunderstanding this?

DeletedUser87

puddingpop short version:
BFU: before first unlock, means that the device just rebooted. Since the password to unlock the phone hasn't been provided to the system, the contents (basically phone storage, broadly speaking) are still encrypted.
AFU: after first unlock, means the device is locked, but it has been unlocked since it booted up at least once. This is when the encryption keys are stored in RAM already and allows for a larger attack surface compared to BFU.

ErnestThornhill

This has already been thoroughly discussed on here.

For example: https://discuss.grapheneos.org/d/12848-claims-made-by-forensics-companies-their-capabilities-and-how-grapheneos-fares/87