Glossary
BFU and AFU (Before and After First Unlock)
BFU and AFU are the two lock states that decide what an Android extraction can decrypt: device-encrypted data only before first unlock, most data after it.
BFU (before first unlock) and AFU (after first unlock) describe whether the user has entered their PIN, pattern or password since the phone last booted. On Android with file-based encryption, that single fact decides which keys are in memory and therefore what any extraction can read.
- BFU: after a reboot and before the first unlock, only device-encrypted (DE) storage is available. System files such as
packages.xml, the telephony provider on most builds, Wi-Fi configuration and Bluetooth pairings can be read by a privileged extraction; app sandboxes and other credential-encrypted storage are ciphertext. - AFU: once the user has unlocked once, the credential-encrypted keys stay in memory even after the screen locks again, so a full file system extraction can reach messaging apps, browsers and usagestats (on Android 11 and later).
A phone falls back to BFU when it reboots or runs out of battery, and some builds and security settings reboot a locked phone automatically after a period of inactivity. That is why seized phones are kept powered and isolated, and why every artifact page on this site states BFU or AFU in its Access field. The acquisition guide covers handling at seizure.