Apple’s iPhone is widely regarded as one of the most secure consumer devices on the market. For digital forensics professionals, this strong security poses unique challenges—especially when dealing with the iPhone’s two key encryption states: Before First Unlock (BFU) and After First Unlock (AFU).
These states determine how much data is accessible based on whether the user has unlocked the device since the last reboot. The transition from BFU to AFU is controlled by a combination of hardware-based encryption, data protection classes, and the Secure Enclave Processor (SEP)—a dedicated chip responsible for handling sensitive operations like passcode verification and key management.