iOS Internals · Locks & Encryption · Lesson 2 of 5

Data Protection Classes

See why some files open after a restart and others stay locked until you unlock.

Four kinds of lock

An iPhone doesn't use one key for everything. Each file gets its own key, and that key is locked again by a class key. Apple's name for this system is Data Protection, and it turns on automatically when you set a passcode. Each file is placed in a protection class, which decides when the phone is able to open it.

There are four classes, named A to D:

• A, Complete Protection. Readable only while the phone is unlocked. Shortly after you lock it (Apple gives 10 seconds as the example), the phone throws away its unlocked copy of the class key. The file can't be read again until you unlock with your passcode, Face ID or Touch ID.
• B, Protected Unless Open. For files that need to be written while the phone is locked. Apple's example is a mail attachment downloading in the background. A file that's already open can keep being written. Once it's closed, it's locked until you unlock.
• C, Protected Until First User Authentication. Locked after a restart. After your first unlock, the key stays in memory even when the screen locks, so apps can keep working in the background. This is the default for app data that hasn't been given a class.
• D, No Protection. Still encrypted, but with a key that doesn't depend on your passcode. Readable any time the phone is on, which suits things the phone needs before you unlock, like alarm settings.

App developers pick the class. A notes app with private journals might choose Complete Protection. A podcast app downloading episodes overnight needs something looser.

The simulated phone holds four files: Notes.db, the Mail inbox, the alarm clock settings and a file that's downloading. Tap Restart, then Unlock with passcode, then Lock screen, and watch which files are readable at each step.

Keys, passcodes and BFU

You saw in Mobile Fundamentals that a restarted phone is in BFU (Before First Unlock), and that your first unlock moves it to AFU (After First Unlock). Data Protection classes are what make that difference real.

Remember from the last module that your passcode is entangled with the Secure Enclave's UID. The keys for classes A, B and C are protected by that mix. So without your passcode, the phone itself can't unlock them. In BFU, only class D files and a few things the system needs to start up are readable. Your photos, messages and nearly all app data stay sealed.

When you first unlock, the phone unwraps the class keys and keeps them in memory. Then the classes behave differently:

• Class C keys stay in memory until the next restart. Most app data lives here, so in AFU most of it is readable even while the screen is locked.
• Class A keys are thrown away seconds after each lock, so those files reseal every time.
• Class B lets an already-open file keep being written, then locks it when it closes.

Why isn't everything class A? Because many apps need to work while your phone sits in your pocket. Messages arrive, music plays, maps keep navigating. Class C is a practical middle ground. It protects data well against a thief who restarts the phone, but not against someone who gets hold of a phone that's already been unlocked since its last restart.

This is why a restart is such a strong security step. It drops every class key from memory, so the phone falls back to BFU. It's also why the passcode, not your face or fingerprint, is always needed after a restart. Only the passcode can rebuild those keys.

Class D has its own job. Its key is protected only by the UID and stored in a special area that can be wiped instantly, which makes erasing a phone fast.