Could they get in?

Apple states that shortly after an iPhone locks, the key for its most-protected ('Complete Protection') data class is discarded, rendering that class of data inaccessible until the passcode is entered again or the device is unlocked.

Magnet Forensics reported on 13 Nov 2024 that on iOS 18, a device that has entered a locked state and has not been unlocked within 72 hours will reboot — which returns it to this off/before-first-unlock state.

Apple states that the key for its most-protected ('Complete Protection') data class is discarded shortly after the device locks — a state that does not depend on whether the device was unlocked earlier in this boot cycle.

Apple documents a separate, default Data Protection class for third-party app data not otherwise assigned to a class of its own — a different class from the one whose key is discarded at lock.

Apple states that the key for its most-protected data class is discarded only shortly after the device locks — while the device is unlocked, that key has not been discarded.

Where Lockdown Mode is switched on, Apple states that connecting an iPhone to an accessory or another computer requires the device to be unlocked.

Apple's own law enforcement guidelines state that content in a customer's iCloud account, as it exists there, may be provided in response to a search warrant issued on probable cause, or the customer's consent.

Where Advanced Data Protection is switched on, Apple states it does not hold the encryption keys for the iCloud categories that use end-to-end encryption, and cannot help recover that data if the account holder loses access to their account.

At a US border, CBP's own directive states that a passcode or other means of access obtained during the inspection may be used only to inspect the device and information subject to the border search itself, and may not be used to access information that is only stored remotely.

Android's file-based encryption documentation states that Credential Encrypted storage, the default storage location, is only available after the user has unlocked the device — meaning it is not available before that first unlock.

Android's file-based encryption documentation states that Device Encrypted storage is available both during Direct Boot mode — before the device is first unlocked — and after.

Android's file-based encryption documentation states that Credential Encrypted storage, the default storage location, is only available after the user has unlocked the device.

Android's file-based encryption documentation states that Credential Encrypted storage, the default storage location, is only available after the user has unlocked the device — which includes while it is currently unlocked.

At a US border, CBP's own directive states that a passcode or other means of access obtained during the inspection may be used only to inspect the device and information subject to the border search itself, and may not be used to access information that is only stored remotely.

GrapheneOS is built on top of standard Android file-based encryption, under which Credential Encrypted storage — the default storage location — is only available after the user has unlocked the device.

GrapheneOS documents an auto-reboot timer, set to 18 hours by default and adjustable between 10 minutes and 72 hours, or off — after that time a locked device reboots, returning it to this off/before-first-unlock state.

GrapheneOS documents an auto-reboot timer, set to 18 hours by default and adjustable between 10 minutes and 72 hours, or off — a locked device that has been unlocked earlier this boot reverts to off/before-first-unlock once that timer runs out.

GrapheneOS documents a USB-C default of 'Charging-only when locked,' which it states significantly reduces attack surface when the device is locked.

GrapheneOS is built on top of standard Android file-based encryption, under which Credential Encrypted storage becomes available once the device has been unlocked.

GrapheneOS documents a duress PIN or password option that, once entered anywhere the device credentials are requested, irreversibly wipes the device, including any installed eSIMs.

At a US border, CBP's own directive states that a passcode or other means of access obtained during the inspection may be used only to inspect the device and information subject to the border search itself, and may not be used to access information that is only stored remotely.