Glossary of Terms

Commonly used terms and definitions in mobile digital forensics.

Airplane Mode

Device/phone setting to turn off Wifi and cellular services (Bluetooth and GPS are not turned off–When you turn on Airplane Mode, it turns off all radios except for Bluetooth)

AFU (After First Unlock)

The condition in which the device has been unlocked at least once since it was last turned on 


Objects that have forensic value such as messages, applications, files, timestamps, and event logs etc. which can be used in mobile forensic investigations  

BFU (Before First Unlock)

The condition in which the device rebooted or powered on and has not been unlocked since 

Brute force

Entering every conceivable passcode until the actual passcode is revealed 


Mobile Device Management (MDM) is a technology that is used to manage device deployments in enterprises. It is commonly used in corporate or government deployments to manage assets.

Full Extraction

An extraction that contains all data on the device 

HEL Data

Health-related information, emails, and location history 

iCloud Backup

Information about the phone’s backup state is shown in the device status:  whether iTunes or iCloud, whether encrypted, and last date of backup 


(Typically) unique mobile phone identifier 

Instant Unlock

A feature that can instantly unlock locked devices regardless of whether or not brute force is supported 

iOS Mobile Devices

products that use Apples iPhone Operating System, including iPhones and iPads 

iOS Keychain or Android Keystore

A password manager that is built into every Mac, iPhone, and iPad that allows your account names, passwords, and credit card numbers can be safely and securely stored on the device  

Known Passcode

Passcode is known to examiner

MDFT (Mobile Device Forensic Tools)

Tools such as GrayKey that help investigators retrieve deleted information, analyze, and preserve evidence on mobile devices that may arise during an examination of criminal activity 

MDM (Mobile Device Management)

A technology that is used to manage device deployments in enterprises 

State of a Device

Whether the device is unlocked, AFU (unlocked since last reboot), or BFU (not unlocked since last reboot). 

UDID (Unique Device Identifier)

A unique identifier for Apple’s iOS devices

Unknown Passcode

Passcode is unknown to an examiner 

Access is Critical

Solve Crimes Faster

Discover how GrayKey can expedite your investigations

Get Started