Mobile Fundamentals · Inside a Phone · Lesson 3 of 4

Storage & Memory

RAM vs flash, and why storage is encrypted.

Two kinds of memory

A phone has two very different kinds of memory. RAM is fast working memory. It holds whatever is happening right now, such as open apps, the web page you're reading, or a message you're halfway through typing. Flash storage is where things are kept for the long term, like photos, saved notes, messages and the apps themselves.

The big difference is power. RAM is volatile, which means it needs electricity to hold anything. When the phone turns off or restarts, RAM is wiped clean. Flash storage keeps its data with the power off, which is why your photos are still there tomorrow.

Here's an everyday example. If you type a note and the app hasn't saved it yet, that text exists only in RAM. Restart the phone and it's gone.

This matters in investigations. Some information, like unsaved drafts or the keys that unlock encrypted data, may exist only in RAM. That's one reason forensic guidance says to keep a seized phone powered on.

On the simulated phone, note what's open, then restart it and see what survives.

Locked at boot

Modern phones encrypt their flash storage. The keys that unlock most of your data are tied to your passcode, so the phone can't fully unlock them on its own.

When a phone restarts, it starts in a state called BFU, short for Before First Unlock. Only a small set of keys is available, enough to show the lock screen, sound an alarm and take a call. Your photos, messages and most app data stay encrypted. When you enter your passcode for the first time, the phone unlocks those keys and keeps them in RAM. That state is AFU, After First Unlock. The phone stays in AFU even when the screen locks again, until the next restart.

This is why fingerprint or face unlock won't work right after a restart. The phone needs your passcode first.

For forensics, the difference is huge. Data is much easier to extract from a phone in AFU than in BFU. To protect stolen phones, iPhones running iOS 18 or later restart themselves after about three days without being unlocked. In 2025, Android added a similar three-day automatic restart.