Phone SeizedToolsWhat's on your phone
What's on your phone
“A full extraction” is not one fixed thing — different tools, and different device states, reach different amounts of data. This walks through the categories that vendor marketing, independent reports, and phone makers’ own documentation describe a report as containing, each one linked to the quote it comes from.
Each line below is a category of data that a vendor’s own marketing, an independent report, or a phone maker’s own documentation describes a full extraction — or a particular data-protection class — as containing. Open a line to read the quote it comes from. Where a phone maker’s own documentation states which device state a category’s decryption key is available in, that is shown as a chip; most categories below carry no chip, because no cited source states one for them.
The Full File System
Cellebrite’s Inseyets product page describes Cellebrite Inseyets.UFED with the words “extract the Full File System data”.
Cellebrite, "Cellebrite Inseyets" product page, FAQ "What does Cellebrite Inseyets include?" (cellebrite.com), as fetched 2026-10-04
“Cellebrite Inseyets.UFED – Access devices and data previously unreachable and extract the Full File System data including containerized applications and encrypted data.”
Read it at cellebrite.comquote checked 2026-10-04
Containerized applications and encrypted data
Cellebrite’s Inseyets product page describes Cellebrite Inseyets.UFED with the words “extract the Full File System data including containerized applications and encrypted data”.
Cellebrite, "Cellebrite Inseyets" product page, FAQ "What does Cellebrite Inseyets include?" (cellebrite.com), as fetched 2026-10-04
“Cellebrite Inseyets.UFED – Access devices and data previously unreachable and extract the Full File System data including containerized applications and encrypted data.”
Read it at cellebrite.comquote checked 2026-10-04
System data and deleted data
A Privacy International report published 27 Mar 2018 says MSAB’s XRY Physical allows access to system and deleted data and can use extra functionality to help overcome security and encryption challenges.
Privacy International, "Digital stop and search: how the UK police can secretly download everything from your mobile phone", 27 Mar 2018 (archived copy of the report PDF)
“MSAB's XRY Physical allows access to "system and deleted data and can use extra functionality to help overcome security and encryption challenges”
Read it at web.archive.orgquote checked 2026-09-08
Third-party app data
Apple’s Platform Security Guide says the Protected Until First User Authentication class behaves in the same way as Complete Protection, except that the decrypted class key isn’t removed from memory when the device is locked or the user logged out, and that it is the default class for all third-party app data not otherwise assigned to a Data Protection class.
Apple Platform Security Guide — "Data Protection classes", published 19 Dec 2024, Apple
“Protected Until First User Authentication—This class behaves in the same way as Complete Protection, except that the decrypted class key isn’t removed from memory when the device is locked or the user logged out.—This is the default class for all third-party app data not otherwise assigned to a Data Protection class.”
Read it at support.apple.comquote checked 2026-10-04
Data in Apple's Complete Protection class
UnlockedApple’s Platform Security Guide says the decrypted class key is discarded shortly after the user locks a device.
Apple Platform Security Guide — "Data Protection classes", published 19 Dec 2024, Apple
“Complete Protection—The class key is protected with a key derived from the user passcode or password and the device UID. Shortly after the user locks a device (10 seconds, if the Require Password setting is Immediately), the decrypted class key is discarded, rendering all data in this class inaccessible until the user enters the passcode again or unlocks (logs in to) the device using Optic ID , Face ID , or Touch ID .”
Read it at support.apple.comquote checked 2026-10-01
Android Credential Encrypted (CE) storage
Android's file-based encryption documentation describes Credential Encrypted (CE) storage as the default storage location and only available after the user has unlocked the device.
Android Open Source Project, "File-based encryption" (source.android.com), as fetched 2026-09-08
“Credential Encrypted (CE) storage, which is the default storage location and only available after the user has unlocked the device.”
Read it at source.android.comquote checked 2026-09-08
Android Device Encrypted (DE) storage
Android's file-based encryption documentation says that on an FBE-enabled device, each user of the device has two storage locations available to apps, one of which is Device Encrypted (DE) storage, which is a storage location available both during Direct Boot mode and after the user has unlocked the device.
Android Open Source Project, "File-based encryption" (source.android.com), as fetched 2026-10-04
“On an FBE-enabled device, each user of the device has two storage locations available to apps:—Device Encrypted (DE) storage, which is a storage location available both during Direct Boot mode and after the user has unlocked the device.”
Read it at source.android.comquote checked 2026-10-04
iCloud Backup
Apple says that with Advanced Data Protection, the number of data categories that use end-to-end encryption rises to 25 and includes iCloud Backup.
Apple, "iCloud data security overview" (support.apple.com/en-gb/102651), as fetched 2026-09-08
“With Advanced Data Protection, the number of data categories that use end-to-end encryption rises to 25 and includes your iCloud Backup, Photos, Notes and more.”
Read it at support.apple.comquote checked 2026-09-08
Photos (an iCloud data category)
Named alongside iCloud Backup and Notes in the same Apple sentence on Advanced Data Protection categories.
Apple, "iCloud data security overview" (support.apple.com/en-gb/102651), as fetched 2026-09-08
“With Advanced Data Protection, the number of data categories that use end-to-end encryption rises to 25 and includes your iCloud Backup, Photos, Notes and more.”
Read it at support.apple.comquote checked 2026-09-08
Notes (an iCloud data category)
Named alongside iCloud Backup and Photos in the same Apple sentence on Advanced Data Protection categories.
Apple, "iCloud data security overview" (support.apple.com/en-gb/102651), as fetched 2026-09-08
“With Advanced Data Protection, the number of data categories that use end-to-end encryption rises to 25 and includes your iCloud Backup, Photos, Notes and more.”
Read it at support.apple.comquote checked 2026-09-08
Personal data
The ICO’s June 2020 report on mobile phone data extraction by police forces in England and Wales says police data extraction practices vary across the country, with excessive amounts of personal data often being extracted, stored, and made available to others, without an appropriate basis in existing data protection law.
ICO, Mobile phone data extraction by police forces in England and Wales (June 2020)
“police data extraction practices vary across the country, with excessive amounts of personal data often being extracted, stored, and made available to others, without an appropriate basis in existing data protection law.”
Read it at ico.org.ukquote checked 2026-09-08
Read more, sourced the same way:
Last reviewed . Next review due . No lawyer has reviewed this page — see [email protected] if you think something here is wrong.