Phone SeizedToolsCould they get in?

Could they get in?

This does not answer “can it be cracked” — that is not a question a general-purpose page can answer, and it is not a question this site tries to. What it does answer, cited to vendor and government documentation, is a narrower one: in a given device state, what does the cited vendor or government documentation, or a dated report, say — about key availability, and about documented reboot, USB and wipe behaviour — in the source’s words.

Pick a device family and a device state below (off/before first unlock, after first unlock, unlocked, or cloud & carrier). Every combination this site has sourced vendor or government documentation for is shown, cited; where nothing has been sourced for a combination, that is stated explicitly rather than left blank. Each cell sets out what the cited vendor or government documentation, or a dated report, says about a phone in that state — key availability, and documented reboot, USB and wipe behaviour — in the source’s words, and never a claim about what any named forensic tool can or cannot do.

iPhone

Off / before first unlock (BFU)

Off, or not yet unlocked since it started

Apple’s Platform Security Guide says the protection in the Protected Until First User Authentication class has similar properties to desktop full-volume encryption, and protects data from attacks that involve a reboot.
Apple Platform Security Guide — "Data Protection classes", published 19 Dec 2024, Apple
“Protected Until First User Authentication—The protection in this class has similar properties to desktop full-volume encryption, and protects data from attacks that involve a reboot.”
Read it at support.apple.comquote checked 2026-10-04

After first unlock (AFU)

Locked again after being unlocked since it started

Apple's Platform Security Guide says that for the Complete Protection class, shortly after the user locks a device (10 seconds, if the Require Password setting is Immediately), the decrypted class key is discarded, rendering all data in this class inaccessible until the user enters the passcode again or unlocks (logs in to) the device using Optic ID, Face ID, or Touch ID.
Apple Platform Security Guide — "Data Protection classes", published 19 Dec 2024, Apple
“Complete Protection—The class key is protected with a key derived from the user passcode or password and the device UID. Shortly after the user locks a device (10 seconds, if the Require Password setting is Immediately), the decrypted class key is discarded, rendering all data in this class inaccessible until the user enters the passcode again or unlocks (logs in to) the device using Optic ID , Face ID , or Touch ID .”
Read it at support.apple.comquote checked 2026-10-01
Apple’s Platform Security Guide says the Protected Until First User Authentication class behaves in the same way as Complete Protection, except that the decrypted class key isn’t removed from memory when the device is locked or the user logged out, and that it is the default class for all third-party app data not otherwise assigned to a Data Protection class.
Apple Platform Security Guide — "Data Protection classes", published 19 Dec 2024, Apple
“Protected Until First User Authentication—This class behaves in the same way as Complete Protection, except that the decrypted class key isn’t removed from memory when the device is locked or the user logged out.—This is the default class for all third-party app data not otherwise assigned to a Data Protection class.”
Read it at support.apple.comquote checked 2026-10-04
Apple’s “Allow USB and other accessories to connect to your iPhone or iPad” page says that by default you need to first unlock your iPhone or iPad to connect to an accessory or computer, and that once you unlock your device, your accessory remains connected, even if your device is locked again.
Apple, "Allow USB and other accessories to connect to your iPhone or iPad" (support.apple.com/en-gb/111806), section "Unlock your device", page marked "Published Date: October 24, 2025", as fetched 2026-11-02
“By default, you need to first unlock your iPhone or iPad to connect to an accessory or computer—such as USB or Thunderbolt devices, Smart Connector accessories for iPad, or a Mac or PC. Once you unlock your device, your accessory remains connected, even if your device is locked again.”
Read it at support.apple.comquote checked 2026-11-02

Restarts of a locked phone, as the sources describe them

This tool files a restarted phone under “Off, or not yet unlocked since it started”.

In a blog post dated 13 Nov 2024 titled “Understanding the security impacts of iOS 18’s inactivity reboot”, Magnet Forensics said that once a device has entered a locked state and has not been unlocked within 72 hours, it will reboot; it also said that the timer is 72 hours (3 days) in iOS 18.1 and was originally 7 days in iOS 18.0, and that the reboot “ensures that data that is at rest for longer than three days gets rebooted so that it gets returned to its most secure state”.
Magnet Forensics blog, "Understanding the security impacts of iOS 18's inactivity reboot", 13 Nov 2024
“This reboot ensures that data that is at rest for longer than three days gets rebooted so that it gets returned to its most secure state.—The inactivity reboot trigger is tied to the lock state of the device, not to network settings, charging status, nor data functions. This means that once a device has entered a locked state and has not been unlocked within 72 hours, it will reboot. There are no prompts or warnings displayed on the device to cancel or interrupt this process. It should be noted that while the timer is 72 hours (3 days) in iOS 18.1, it was originally for 7 days in iOS 18.0.”
Read it at magnetforensics.comquote checked 2026-10-02

Unlocked

Apple's Platform Security Guide says that for the Complete Protection class, once the decrypted class key is discarded, all data in this class is inaccessible until the user enters the passcode again or unlocks (logs in to) the device using Optic ID, Face ID, or Touch ID.
Apple Platform Security Guide — "Data Protection classes", published 19 Dec 2024, Apple
“Complete Protection—The class key is protected with a key derived from the user passcode or password and the device UID. Shortly after the user locks a device (10 seconds, if the Require Password setting is Immediately), the decrypted class key is discarded, rendering all data in this class inaccessible until the user enters the passcode again or unlocks (logs in to) the device using Optic ID , Face ID , or Touch ID .”
Read it at support.apple.comquote checked 2026-10-01
Apple’s “About Lockdown Mode” page says that when Lockdown Mode is enabled some apps and features function differently, including “Device connections: to connect your iPhone or iPad to an accessory or another computer, the device needs to be unlocked.”
Apple, "About Lockdown Mode" (support.apple.com/en-gb/105120), as fetched 2026-09-08
“When Lockdown Mode is enabled, some apps and features will function differently, including:—Device connections: to connect your iPhone or iPad to an accessory or another computer, the device needs to be unlocked.”
Read it at support.apple.comquote checked 2026-10-01

Cloud & carrier

Cloud & carrier copies may exist

Apple's Legal Process Guidelines for government and law enforcement within the United States say that iCloud content, as it exists in the customer's account, may be provided in response to a search warrant issued upon a showing of probable cause, or customer consent.
Apple, "Legal Process Guidelines — Government & Law Enforcement within the United States", published October 2025, Apple
“iCloud content, as it exists in the customer's account, may be provided in response to a search warrant issued upon a showing of probable cause, or customer consent.”
Read it at apple.comquote checked 2026-09-08
Apple states that if you enable Advanced Data Protection and then lose access to your account, Apple will not have the encryption keys to help you recover it.
Apple, "iCloud data security overview" (support.apple.com/en-gb/102651), as fetched 2026-10-01
“you can choose to enable Advanced Data Protection to protect the vast majority of your iCloud data—If you enable Advanced Data Protection and then lose access to your account, Apple will not have the encryption keys to help you recover it”
Read it at support.apple.comquote checked 2026-10-01
CBP's directive states that passcodes or other means of access obtained during a border inspection will only be utilized to facilitate the inspection of devices and information subject to border search, and may not be utilized to access information that is only stored remotely.
CBP Directive No. 3340-049B §5.3.2 (eff. 1 Jan 2026)
“Passcodes or other means of access obtained during a border inspection will only be utilized to facilitate the inspection of devices and information subject to border search. Passcodes or other means of access may not be utilized to access information that is only stored remotely.”
Read it at cbp.govquote checked 2026-09-08

Android (stock)

Off / before first unlock (BFU)

Off, or not yet unlocked since it started

Android's file-based encryption documentation states that Credential Encrypted (CE) storage, which is the default storage location, is only available after the user has unlocked the device.
Android Open Source Project, "File-based encryption" (source.android.com), as fetched 2026-09-08
“Credential Encrypted (CE) storage, which is the default storage location and only available after the user has unlocked the device.”
Read it at source.android.comquote checked 2026-09-08
Android's file-based encryption documentation states that on an FBE-enabled device each user of the device has two storage locations available to apps, one of which is Device Encrypted (DE) storage, which is a storage location available both during Direct Boot mode and after the user has unlocked the device.
Android Open Source Project, "File-based encryption" (source.android.com), as fetched 2026-10-04
“On an FBE-enabled device, each user of the device has two storage locations available to apps:—Device Encrypted (DE) storage, which is a storage location available both during Direct Boot mode and after the user has unlocked the device.”
Read it at source.android.comquote checked 2026-10-04

After first unlock (AFU)

Locked again after being unlocked since it started

Android's file-based encryption documentation states that Credential Encrypted (CE) storage, which is the default storage location, is only available after the user has unlocked the device.
Android Open Source Project, "File-based encryption" (source.android.com), as fetched 2026-09-08
“Credential Encrypted (CE) storage, which is the default storage location and only available after the user has unlocked the device.”
Read it at source.android.comquote checked 2026-09-08
Google’s Advanced Protection help page lists, among the protections offered by Advanced Protection, USB Protection: “When your screen is locked, it protects your device from unauthorized access through a USB connection.”
Google, Android Help, "Improve device security with Advanced Protection for Android" (support.google.com/android/answer/16339980), as fetched 2026-10-14
“Review protections offered by Advanced Protection.—USB Protection: Secure your Android device with USB Protection. When your screen is locked, it protects your device from unauthorized access through a USB connection.”
Read it at support.google.comquote checked 2026-10-14

Restarts of a locked phone, as the sources describe them

This tool files a restarted phone under “Off, or not yet unlocked since it started”.

Google’s Advanced Protection help page lists, among the protections offered by Advanced Protection, Inactivity Reboot: “Automatically reboot your phone if it remains locked for 72 hours. The process of rebooting will make user data unreadable until a fresh unlock takes place.”
Google, Android Help, "Improve device security with Advanced Protection for Android" (support.google.com/android/answer/16339980), as fetched 2026-10-14
“Review protections offered by Advanced Protection.—Inactivity Reboot: Automatically reboot your phone if it remains locked for 72 hours. The process of rebooting will make user data unreadable until a fresh unlock takes place.”
Read it at support.google.comquote checked 2026-10-14

Unlocked

Android's file-based encryption documentation states that Credential Encrypted (CE) storage, which is the default storage location, is only available after the user has unlocked the device.
Android Open Source Project, "File-based encryption" (source.android.com), as fetched 2026-09-08
“Credential Encrypted (CE) storage, which is the default storage location and only available after the user has unlocked the device.”
Read it at source.android.comquote checked 2026-09-08

Cloud & carrier

Cloud & carrier copies may exist

CBP's directive states that passcodes or other means of access obtained during a border inspection will only be utilized to facilitate the inspection of devices and information subject to border search, and may not be utilized to access information that is only stored remotely.
CBP Directive No. 3340-049B §5.3.2 (eff. 1 Jan 2026)
“Passcodes or other means of access obtained during a border inspection will only be utilized to facilitate the inspection of devices and information subject to border search. Passcodes or other means of access may not be utilized to access information that is only stored remotely.”
Read it at cbp.govquote checked 2026-09-08

GrapheneOS

Off / before first unlock (BFU)

Off, or not yet unlocked since it started

GrapheneOS’s Features page says its auto-reboot feature doesn't apply when the device is in “Before First Unlock” state.
GrapheneOS, "Features" (grapheneos.org/features), "Auto reboot" paragraph, as fetched 2026-10-01
“GrapheneOS provides an auto-reboot feature which reboots locked devices after a set period of time to put data at rest.—The timer is set to 18 hours by default, but can be set to values between 10 minutes and 72 hours, or turned off.—This feature doesn't apply when the device is in "Before First Unlock" state”
Read it at grapheneos.orgquote checked 2026-10-01

After first unlock (AFU)

Locked again after being unlocked since it started

GrapheneOS’s Features page says its USB-C port and pogo pins setting protects against attacks through USB-C or pogo pins while the OS is booted, and that the default is Charging-only when locked, which significantly reduces attack surface when the device is locked.
GrapheneOS, "Features" (grapheneos.org/features), "USB-C port and pogo pins control" paragraph, as fetched 2026-10-01
“Our USB-C port and pogo pins setting protects against attacks through USB-C or pogo pins while the OS is booted.—The default is Charging-only when locked , which significantly reduces attack surface when the device is locked.”
Read it at grapheneos.orgquote checked 2026-10-01
GrapheneOS’s Features page says that the default for its USB-C port and pogo pins setting is Charging-only when locked, and that after locking, it blocks any new USB connections immediately through either USB-C and pogo pins at both the hardware level via configuring the USB controller and also at the OS level in the kernel.
GrapheneOS, "Features" (grapheneos.org/features), "USB-C port and pogo pins control" paragraph, as fetched 2026-10-14
“Our USB-C port and pogo pins setting protects against attacks through USB-C or pogo pins while the OS is booted.—The default is Charging-only when locked , which significantly reduces attack surface when the device is locked. After locking, it blocks any new USB connections immediately through either USB-C and pogo pins at both the hardware level via configuring the USB controller and also at the OS level in the kernel to provide a second layer of defense.”
Read it at grapheneos.orgquote checked 2026-10-14

Restarts of a locked phone, as the sources describe them

This tool files a restarted phone under “Off, or not yet unlocked since it started”.

GrapheneOS’s Features page says it provides an auto-reboot feature which reboots locked devices after a set period of time to put data at rest; that the timer is set to 18 hours by default, but can be set to values between 10 minutes and 72 hours, or turned off; and that the feature doesn't apply when the device is in “Before First Unlock” state.
GrapheneOS, "Features" (grapheneos.org/features), "Auto reboot" paragraph, as fetched 2026-10-01
“GrapheneOS provides an auto-reboot feature which reboots locked devices after a set period of time to put data at rest.—The timer is set to 18 hours by default, but can be set to values between 10 minutes and 72 hours, or turned off.—This feature doesn't apply when the device is in "Before First Unlock" state”
Read it at grapheneos.orgquote checked 2026-10-01

Unlocked

GrapheneOS’s Features page says it provides users with the ability to set a duress PIN/Password that will irreversibly wipe the device (along with any installed eSIMs) once entered anywhere where the device credentials are requested (on the lockscreen, along with any such prompt in the OS).
GrapheneOS, "Features" (grapheneos.org/features), as fetched 2026-09-08
“GrapheneOS provides users with the ability to set a duress PIN/Password that will irreversibly wipe the device (along with any installed eSIMs) once entered anywhere where the device credentials are requested (on the lockscreen, along with any such prompt in the OS).”
Read it at grapheneos.orgquote checked 2026-09-08
GrapheneOS’s Features page says that the wipe does not require a reboot and cannot be interrupted, and that if the duress PIN/Password is the same as the actual unlock method, the actual unlock method always takes precedence, and therefore no wipe will occur.
GrapheneOS, "Features" (grapheneos.org/features), "Duress PIN/Password" paragraph, as fetched 2026-10-14
“The wipe does not require a reboot and cannot be interrupted.—Duress PIN will also wipe the device when entered as the two-factor fingerprint unlock PIN but not currently when entered as the SIM PIN. Note that if the duress PIN/Password is the same as the actual unlock method, the actual unlock method always takes precedence, and therefore no wipe will occur.”
Read it at grapheneos.orgquote checked 2026-10-14

Statutes and prosecution guidance on destroying, concealing or obstructing, and a United States indictment, are set out at: Duress wipes, auto-reboot and the law.

Cloud & carrier

Cloud & carrier copies may exist

CBP's directive states that passcodes or other means of access obtained during a border inspection will only be utilized to facilitate the inspection of devices and information subject to border search, and may not be utilized to access information that is only stored remotely.
CBP Directive No. 3340-049B §5.3.2 (eff. 1 Jan 2026)
“Passcodes or other means of access obtained during a border inspection will only be utilized to facilitate the inspection of devices and information subject to border search. Passcodes or other means of access may not be utilized to access information that is only stored remotely.”
Read it at cbp.govquote checked 2026-09-08

If biometrics (fingerprint or face unlock) are enabled

This tool does not say whether someone can be legally compelled to present a fingerprint or face, as opposed to a passcode. These pages set out the legal position and its sources: