Mobile evidence guidance
What is the difference between AFU and BFU?
AFU means the device has been unlocked since its last restart; BFU means it has not. Available keys and accessible records can differ, but neither state guarantees acquisition.
Potential evidence sources
Where relevant records may exist.
- Observed lock and power state
- Device model, OS and patch level
- Existing backups and trusted computers
Decision factors
What materially changes the prospects.
- 01Whether a restart occurred
- 02Credential availability
- 03Supported methods for the exact build
Evidential limitations
What must not be overstated.
Do not restart merely to identify the state
A lock screen does not establish which data can be acquired
Sources and interpretation
Each entry identifies its limited supporting proposition and documentation-check date. General methodology is not a current device-support list. These checks are not laboratory validation; availability and method suitability require assessment for the exact source and configuration.
- NIST mobile device forensics guidance
Methodological background (2014), not a current device-support list.
General methodology · Documentation checked
Confidential case review
