Phone SeizedWhat is on your phoneWhat a 'full file system' extraction actually contains
What a 'full file system' extraction actually contains
What you must do, what you can refuse, and what they can do
Every claim below links to the source it comes from, with the wording quoted so you can check it yourself.
What the sources say
What a document, a report, an agency publication or a provision says, quoted as it is worded.
Cellebrite's Inseyets product page, in an FAQ answer on what Inseyets includes, describes Cellebrite Inseyets.UFED with the words “Access devices and data previously unreachable and extract the Full File System data including containerized applications and encrypted data.”
Cellebrite, "Cellebrite Inseyets" product page, FAQ "What does Cellebrite Inseyets include?" (cellebrite.com), as fetched 2026-10-04
“Cellebrite Inseyets.UFED – Access devices and data previously unreachable and extract the Full File System data including containerized applications and encrypted data.”
Read it at cellebrite.comquote checked 2026-10-04
Magnet Forensics markets its Graykey product as offering same-day access to the latest iOS and Android devices.
Magnet Forensics, Magnet Graykey product page (magnetforensics.com), as fetched 2026-09-08
“Get started with Graykey's same-day access to the latest iOS and Android devices”
Read it at magnetforensics.comquote checked 2026-09-08
A 2018 Privacy International report on UK police extraction says that MSAB's XRY Physical allows access to “system and deleted data and can use extra functionality to help overcome security and encryption challenges”.
Privacy International, "Digital stop and search: how the UK police can secretly download everything from your mobile phone", 27 Mar 2018 (archived copy of the report PDF)
“MSAB's XRY Physical allows access to "system and deleted data and can use extra functionality to help overcome security and encryption challenges”
Read it at web.archive.orgquote checked 2026-09-08
A 2020 Upturn report on mobile device forensic tools says: “Based on 110 public records requests to state and local law enforcement agencies across the country, our research documents more than 2,000 agencies that have purchased these tools, in all 50 states and the District of Columbia.”
Upturn, "Mass Extraction", October 2020
“law enforcement agencies use mobile device forensic tools (MDFTs), a powerful technology that allows police to extract a full copy of data from a cellphone—Based on 110 public records requests to state and local law enforcement agencies across the country, our research documents more than 2,000 agencies that have purchased these tools, in all 50 states and the District of Columbia.”
Read it at upturn.orgquote checked 2026-10-01
The UK Information Commissioner's Office's June 2020 report on police forces in England and Wales says that police data extraction practices vary across the country, with excessive amounts of personal data often being extracted, stored, and made available to others, without an appropriate basis in existing data protection law.
ICO, Mobile phone data extraction by police forces in England and Wales (June 2020)
“police data extraction practices vary across the country, with excessive amounts of personal data often being extracted, stored, and made available to others, without an appropriate basis in existing data protection law.”
Read it at ico.org.ukquote checked 2026-09-08
Apple's Platform Security Guide says that for the Complete Protection class, shortly after the user locks a device (10 seconds, if the Require Password setting is Immediately) the decrypted class key is discarded, rendering all data in this class inaccessible until the user enters the passcode again or unlocks (logs in to) the device using Optic ID, Face ID, or Touch ID.
Apple Platform Security Guide — "Data Protection classes", published 19 Dec 2024, Apple
“Complete Protection—The class key is protected with a key derived from the user passcode or password and the device UID. Shortly after the user locks a device (10 seconds, if the Require Password setting is Immediately), the decrypted class key is discarded, rendering all data in this class inaccessible until the user enters the passcode again or unlocks (logs in to) the device using Optic ID , Face ID , or Touch ID .”
Read it at support.apple.comquote checked 2026-10-01
Apple's Platform Security Guide describes a default class for all third-party app data not otherwise assigned to a Data Protection class.
Apple Platform Security Guide — "Data Protection classes", published 19 Dec 2024, Apple
“Protected Until First User Authentication—This class behaves in the same way as Complete Protection, except that the decrypted class key isn’t removed from memory when the device is locked or the user logged out.—This is the default class for all third-party app data not otherwise assigned to a Data Protection class.”
Read it at support.apple.comquote checked 2026-10-04
Android's file-based encryption documentation states that Credential Encrypted (CE) storage, which is the default storage location, is only available after the user has unlocked the device.
Android Open Source Project, "File-based encryption" (source.android.com), as fetched 2026-09-08
“Credential Encrypted (CE) storage, which is the default storage location and only available after the user has unlocked the device.”
Read it at source.android.comquote checked 2026-09-08
Android's file-based encryption documentation states that on an FBE-enabled device, each user of the device has two storage locations available to apps, one of which is Device Encrypted (DE) storage, which is a storage location available both during Direct Boot mode and after the user has unlocked the device.
Android Open Source Project, "File-based encryption" (source.android.com), as fetched 2026-10-04
“On an FBE-enabled device, each user of the device has two storage locations available to apps:—Device Encrypted (DE) storage, which is a storage location available both during Direct Boot mode and after the user has unlocked the device.”
Read it at source.android.comquote checked 2026-10-04
SWGDE's “Best Practices for Mobile Device Evidence Collection & Preservation Handling and Acquisition” (Version 2.0, 21 August 2025) lists “Full File System (FFS)” among its file system acquisitions and defines it as “A complete collection of all available active files and folders.”
SWGDE, "Best Practices for Mobile Device Evidence Collection & Preservation Handling and Acquisition", SWGDE 18-F-003-2.0, Version 2.0 (21 Aug 2025, Final Approved Document), section 6, "File System" acquisitions: "Full File System (FFS)"
“File System acquisitions include:—Full File System (FFS): A complete collection of all available active files and folders.”
Read it at swgde.orgquote checked 2026-11-02
SWGDE's document (Version 2.0, 21 August 2025) lists “After First Unlock (AFU/Hot)” among its file system acquisitions and defines it as “A collection of available data from a powered-on device that has been unlocked at least once since the last operating system boot.”
SWGDE, "Best Practices for Mobile Device Evidence Collection & Preservation Handling and Acquisition", SWGDE 18-F-003-2.0, Version 2.0 (21 Aug 2025, Final Approved Document), section 6, "File System" acquisitions: "After First Unlock (AFU/Hot)"
“File System acquisitions include:—After First Unlock (AFU/Hot): A collection of available data from a powered-on device that has been unlocked at least once since the last operating system boot.”
Read it at swgde.orgquote checked 2026-11-02
SWGDE's document (Version 2.0, 21 August 2025) lists “Before First Unlock (BFU/Cold)” among its file system acquisitions and defines it as “A collection of available data from a powered-on, locked device that has not been unlocked since the last operating system boot.” It adds: “This extraction contains a limited dataset when compared to AFU, Full File System, or Logical extractions.”
SWGDE, "Best Practices for Mobile Device Evidence Collection & Preservation Handling and Acquisition", SWGDE 18-F-003-2.0, Version 2.0 (21 Aug 2025, Final Approved Document), section 6, "File System" acquisitions: "Before First Unlock (BFU/Cold)"
“File System acquisitions include:—Before First Unlock (BFU/Cold): A collection of available data from a powered—on, locked device that has not been unlocked since the last operating system boot. This extraction contains a limited dataset when compared to AFU, Full File System, or Logical extractions.”
Read it at swgde.orgquote checked 2026-11-02
SWGDE's document (Version 2.0, 21 August 2025) has sections headed “Device – OFF” (sections 5.4 and 6.2).
SWGDE, "Best Practices for Mobile Device Evidence Collection & Preservation Handling and Acquisition", SWGDE 18-F-003-2.0, Version 2.0 (21 Aug 2025, Final Approved Document), sections 5.4 and 6.2, headings "Device – OFF"
“5.4 Device—OFF—6.2 Device—OFF”
Read it at swgde.orgquote checked 2026-11-02
Four states, one vocabulary
This site uses the same terms for a phone’s state on every page in this section and in Protect:
- Off / before first unlock (BFU) — the phone is switched off, or has been switched on but not yet unlocked once since it booted.
- After first unlock (AFU) — the phone has been unlocked at least once since it booted, and is now locked again.
- Unlocked — the phone is currently unlocked, in someone’s hand or on a desk.
- Cloud / carrier — data that is not on the phone at all, held instead by the phone maker, an app maker, or the mobile network operator. See Cloud and carrier.
The rest of this section reports what vendors and researchers say about devices, in the words they use — never as a blanket “police can” or “police cannot” statement.
What extraction vendors say their own tools do
Cellebrite and Magnet Forensics are two forensic vendors. Each describes a product, in its own marketing, in these words:
- Cellebrite’s Inseyets product page, in an FAQ answer on what Inseyets includes, describes Cellebrite Inseyets.UFED with the words “Access devices and data previously unreachable and extract the Full File System data including containerized applications and encrypted data.”
- Magnet Forensics markets its Graykey product as offering “same-day access to the latest iOS and Android devices.”
Neither statement says which specific models or OS versions it covers. See Passcode and updates for what AppleInsider reported about a model/iOS matrix.
What independent reports say about extraction tools and who has bought them
Two reports describe mobile extraction tools from outside the vendors:
- Privacy International’s 2018 report on UK police extraction says that MSAB’s XRY Physical allows access to “system and deleted data and can use extra functionality to help overcome security and encryption challenges.”
- Upturn’s 2020 “Mass Extraction” report says: “Based on 110 public records requests to state and local law enforcement agencies across the country, our research documents more than 2,000 agencies that have purchased these tools, in all 50 states and the District of Columbia.” The tools it means are mobile device forensic tools.
The Information Commissioner’s Office’s June 2020 report on police forces in England and Wales says that police data extraction practices vary across the country, “with excessive amounts of personal data often being extracted, stored, and made available to others, without an appropriate basis in existing data protection law.”
How device state changes what a tool can reach
Apple’s and Android’s documentation each describe more than one class of storage. Apple’s Platform Security Guide says that for the Complete Protection class, shortly after the user locks a device (10 seconds, if the Require Password setting is Immediately) the decrypted class key is discarded, “rendering all data in this class inaccessible until the user enters the passcode again or unlocks (logs in to) the device using Optic ID, Face ID, or Touch ID.” The same guide describes a default class for all third-party app data not otherwise assigned to a Data Protection class.
Android’s file-based encryption documentation describes Credential Encrypted (CE) storage as “the default storage location and only available after the user has unlocked the device,” and says that on an FBE-enabled device each user of the device has two storage locations available to apps, one of which is Device Encrypted (DE) storage, “a storage location available both during Direct Boot mode and after the user has unlocked the device.”
The BFU/AFU/unlocked vocabulary above is this site’s own shorthand; the quotations here are Apple’s and Android’s own descriptions of their storage classes. See Deleted is not gone for what its sources say about data the user has already deleted, and the cross-country comparison for how the legal power to demand a passcode differs from the technical question this page covers.
How SWGDE’s guidance uses the same terms
SWGDE’s “Best Practices for Mobile Device Evidence Collection & Preservation Handling and Acquisition” (Version 2.0, 21 August 2025) lists “Full File System (FFS)” among its file system acquisitions and defines it: “A complete collection of all available active files and folders.” That is SWGDE’s own definition. The vendor sentences quoted earlier on this page are the vendors’ marketing wording, and this page does not say the two mean the same thing.
The same SWGDE document also defines AFU and BFU: “After First Unlock (AFU/Hot): A collection of available data from a powered-on device that has been unlocked at least once since the last operating system boot.” and “Before First Unlock (BFU/Cold): A collection of available data from a powered-on, locked device that has not been unlocked since the last operating system boot.” Of the BFU collection it adds: “This extraction contains a limited dataset when compared to AFU, Full File System, or Logical extractions.”
Those definitions differ from this site’s four-state vocabulary above, and this page does not merge them:
- SWGDE’s AFU and BFU definitions each begin “A collection of available data”, so they describe a collection of data. The definitions at the top of this page describe the state of the phone.
- As worded, SWGDE’s BFU definition covers a “powered-on” device, so a switched-off phone does not fit those words. This site’s first state, Off / BFU, also includes a phone that is switched off. SWGDE’s document has sections headed “Device – OFF” (5.4 and 6.2).
- SWGDE’s AFU wording says “a powered-on device that has been unlocked at least once since the last operating system boot” and does not say that the device is locked again. This site’s AFU state is a phone that is now locked again, and a phone that is currently unlocked is a separate state here.
The four states at the top of this page stay as defined there. For how the sources describe logical, file-system and physical extraction, see What an extraction can see.
Last reviewed . Next review due . No lawyer has reviewed this page — see [email protected] if you think something here is wrong.