BFU and AFU are forensic states of an encrypted mobile device. BFU stands for Before First Unlock: the device has been freshly powered on and not yet unlocked since boot. The encryption keys are not in memory and most data is encrypted at rest with no decryption path available without the passcode. AFU stands for After First Unlock: the device has been unlocked at least once since boot, leaving keys in memory and most data extractable.
What it means in practice
The BFU/AFU distinction is the single most operationally important variable in modern phone forensics. Cellebrite UFED Premium against an AFU iPhone is hours; against a BFU iPhone with a strong passcode it is impractical with current public capability. The state changes whenever the device boots fresh: powering off and powering on returns the device to BFU. The state also changes after extended periods of inactivity on some configurations (iOS reverts to a partial BFU-like state after several hours of no biometric unlock; the exact threshold is undocumented and version-dependent). Operationally, the rule is: power off the device fully (not lock screen, fully off) before any anticipated seizure, so the device boots in BFU state.
Where it shows up
Forensic tooling explicitly differentiates capability between BFU and AFU. UFED Premium documentation segments capability matrices by state. GrayKey similarly. The reason: in AFU, encryption keys are loaded into memory to decrypt data on access, and forensic tools can extract those keys with various techniques. In BFU, the keys are still derived only from the passcode and the secure-enclave hardware, and the only path to extraction is brute-forcing the passcode itself. A 6-digit numeric passcode is brute-forceable in BFU within hours given the secure-enclave delays; a 10+ character alphanumeric passphrase pushes the time to years. The passcode strength matters more in BFU than in AFU; in AFU, the passcode strength is partially bypassed because the keys are already loaded.
What you can change today
Three actions before any high-risk situation. First, before traveling, before going to a protest, before any context where seizure is plausible: power the device fully off (hold the power button until the slide-to-power-off appears, slide it). The first boot brings BFU; do not unlock until necessary. Second, switch the passcode to alphanumeric 10+ characters; the BFU defense depends on passcode strength, not just on the BFU state. Third, configure auto-power-off behavior: iOS will revert to a partial BFU state after extended inactivity, but the exact threshold is undocumented; treating “off” as the only reliable BFU state is the conservative posture.