In late 2024, police in Detroit noticed something eerie happening in their evidence vault. iPhones they had seized as evidence were rebooting themselves, with no one touching them, and it was wrecking their ability to extract data. They wrote it up. They speculated the phones were somehow signaling each other. It read like a ghost story for forensic examiners.

It was not a ghost. Apple had quietly shipped a feature that reboots an idle iPhone after a few days, on purpose, to lock investigators out. To understand why a simple reboot is powerful enough to defeat a professional forensics lab, and why the power button might be the most underrated security control on your phone, you have to understand the single most important distinction in phone security that almost nobody has heard of.

BFU and AFU: the whole ballgame

Modern phones encrypt everything at rest. But the key that unlocks your data is not sitting on the phone waiting to be grabbed. It is derived from your passcode, and it only comes into existence after you enter that passcode. This creates two completely different states.

Before First Unlock, or BFU, is the state a phone is in when it has been powered on or rebooted but nobody has entered the passcode yet, not even once. In BFU, the decryption keys do not exist in the phone’s memory. Your data is genuinely, mathematically locked, and even the best forensic tools, the Cellebrite-class machines law enforcement relies on, mostly cannot get at it. The phone itself cannot read most of its own contents.

After First Unlock, or AFU, is what happens the moment you unlock the phone once. Now the keys are derived and sitting in memory, and they stay there until the phone reboots or powers off. In AFU, forensic tools can extract dramatically more, because the phone is holding the keys that make the data readable. And here is the uncomfortable part: your phone lives in AFU essentially all day, every day, from the first time you unlock it in the morning until it next restarts.

So the single biggest factor in whether a seized phone gives you up is which state it was in when someone got their hands on it. And a phone that has been powered off, or rebooted, is in BFU.

That is the whole reason the Detroit iPhones rebooting mattered. They flipped from the crackable AFU state back to the locked-down BFU state, and the evidence sealed itself.

So yes, powering off does something. Something big.

This reframes the humble power button. Turning your phone off is not a superstition. It is the single most effective, one-tap thing you can do to protect the data on it against seizure, because it drops the device into the one state that resists forensic extraction.

Apple understood this well enough to automate it. Recent versions of iOS reboot the phone on their own after roughly three days without an unlock, deliberately forcing it back into BFU so that a lost, stolen, or seized device re-seals itself. The Secure Enclave will also start revoking keys after a period of inactivity. Apple, in effect, weaponized BFU on your behalf. Forensic examiners now have to race to extract an AFU phone within about seventy-two hours of seizing it, and keep it powered on and in a Faraday bag the whole time, specifically to stop it from rebooting into the state they cannot crack.

There is a second, unrelated benefit to powering off or rebooting. A large class of phone spyware is non-persistent: it lives in memory and does not survive a restart. This is exactly why security agencies have long advised regularly rebooting your phone, and why a reboot before and after a sensitive situation is cheap insurance. It will not stop a determined, persistent implant, but it clears out the common stuff for free.

If your worry is your data in someone else’s hands, the border, a search, a theft, powering the phone off first is genuinely one of the best moves available to you.

But “off” is not “invisible”

Here is where the myth needs busting in the other direction, because people extend “off protects my data” into “off makes my phone disappear,” and that is not true.

An iPhone still participates in Apple’s Find My network when it is powered off. A low-power radio stays alive in the “off” state precisely so the device can still be located. So powering down protects the contents of the phone, but it does not turn the phone into an inert brick that has vanished from the map. The location beacon can persist past “off.”

Airplane mode is not the escape hatch either. On newer phones, airplane mode no longer fully removes the device from the network the way people assume; certain radios and location features keep working. It quiets the phone. It does not disconnect it in the way the toggle implies.

And you cannot actually verify a true power-down. The “swipe to power off” screen is software, and sophisticated malware can fake a shutdown while keeping the device alive and listening. The cellular baseband is its own separate processor that the main operating system does not fully control. “Off,” on a device you do not control at a low level, is a claim the phone is making to you, not a fact you can confirm.

So the honest summary is two different answers to two different questions. Against someone taking your phone and trying to read it, powering off is powerful, it forces BFU. Against being tracked or located, powering off is not enough, because the phone can still beacon and you cannot be sure it is truly dead.

Two threats, two moves

Worried about your data if the phone is seized or stolen? Power it off, or reboot it, before it could leave your control, and rely on BFU. Reboot regularly as a habit to clear non-persistent spyware. Use a strong passcode rather than only biometrics, because BFU protection means nothing if they can compel your face or thumb, but that is its own post.

Worried about being tracked and located? Powering off is not sufficient. You want a Faraday bag that physically blocks every radio, or a phone whose radios you can genuinely disable or kill in hardware, or simply leaving the device behind. Trusting the “off” screen is not a location defense.

Where a controlled phone changes the math

On a stock phone, you are trusting the manufacturer’s version of “off” and their features around it. To Apple’s credit, BFU and the inactivity reboot are genuinely good for you. But you do not control the radios, you cannot verify the powered-on state, and you did not choose to have a location beacon that survives shutdown.

A hardened build changes what “off” and “on” actually mean for you. Radios you can truly disable, in some cases kill in hardware, so “off” is off. Verified boot, so the state the phone comes up in is one you can trust rather than one malware can fake. Sensible inactivity locking that drops you back to a locked, key-sealed state on your terms. No beacon you never asked for. You keep the real benefit, the forensic resistance of a locked, powered-down device, and you add the control that a stock phone withholds.

The power button is more useful than almost anyone realizes, and less magical than the movies suggest. Use it deliberately: off to seal your data, a Faraday bag or a phone you control to actually disappear, and a habit of rebooting to keep the cheap threats out. If you want a device where “off” means what you think it means, that is what we build. Email hello@spicycorp.com, or book a call.