PHONE SECURITY
AFU vs BFU: Why Restarting Your Phone Protects Your Data
Your phone's data is encrypted, but how well it's protected depends on one thing most people never think about: whether the phone has been unlocked since it was last switched on.
BFU: Before First Unlock
When a phone starts up, your data is fully encrypted and the keys to unlock it aren't in memory yet. They're only created when you enter your passcode for the first time. Until then, the phone is in BFU, Before First Unlock.
In BFU, almost everything on the phone is unreadable: messages, photos, app data and files. Without your passcode there's very little anyone can extract, even with specialist tools. It's the most protected state a phone can be in.
AFU: After First Unlock
Once you've unlocked the phone once, it moves to AFU, After First Unlock, and stays there even when you lock the screen again. Many encryption keys stay in memory, so notifications arrive, apps keep working in the background and your phone can sync while it's locked.
That convenience has a cost. A locked phone in AFU is far more exposed: forensic extraction tools used by law enforcement and criminals alike are designed to exploit phones in AFU, where much more data can be reached than in BFU.
Why restarting protects you
Restarting a phone throws away the keys in memory and puts it back into BFU. That's why security experts recommend switching your phone off, or restarting it, before crossing a border, handing it over, or whenever it might be out of your control.
The problem is remembering to do it, or having the chance. That's where automatic reboot comes in.
Automatic reboot on GrapheneOS and iPhone
- GrapheneOS automatically restarts the phone if it hasn't been unlocked for a set time, and you choose how long. A lost or seized phone returns to BFU by itself.
- iPhone now restarts itself after several days without being unlocked, which helps, but leaves a long window in AFU.
How our Encrypted Phones handle it
Our PF Secured GrapheneOS Device is configured to reboot automatically and return to BFU, permanently disables vulnerable functions such as USB data transfer, and automatically wipes data if the device is not unlocked within a specified timeframe.
Our PF iOSecured encrypted iPhone includes a shortcut that returns the phone to BFU with one tap, and wipes itself after 4 incorrect passcode attempts. See our Encrypted iPhone guide.
Quick tips
- Use a strong passcode: in BFU, the passcode is the only thing standing between someone and your data.
- Restart your phone before travelling, and whenever it's been out of your hands.
- Turn off fingerprint and face unlock in risky situations: a passcode can't be taken from you as easily.
Comparing phones? Read GrapheneOS vs iPhone: Which Is More Private?