Why restarting your phone protects your data

There’s a quiet difference between a phone that’s locked and a phone that’s just been switched on. Both show the lock screen. Both want your PIN. But inside, one has its keys out on the table and the other has them locked away. Knowing which is which explains some advice that can sound like superstition: turn your phone off before a border, restart it before a repair, and don’t be annoyed when it asks for your PIN instead of your face.

Two kinds of locked

Modern phones encrypt your data on storage with keys that are themselves protected by your PIN, pattern or password. When the phone starts up, those keys are sealed. Your photos, messages and app data can’t be read, even by someone who takes the storage chip out.

The first time you enter your PIN after the phone starts, the keys are unsealed and loaded into memory. They stay there afterward, even when you lock the screen again. That’s what lets your phone keep doing useful things while it’s in your pocket: receive messages, sync photos, play music.

So there are two states:

• Before the first unlock. The keys are sealed. Almost all of your data is unreadable until someone enters your PIN.
• After the first unlock. The screen is locked, but the keys are in memory. The lock screen is the main barrier.

On Android, the official documentation describes most app data as stored in credential-encrypted storage that’s only available after the user has unlocked the device. A small separate area holds what the phone needs before that, like alarms and the ability to take calls. iPhone works on the same idea, with most files protected until the first unlock after a restart.

Why the difference matters

A locked screen is a strong barrier for everyday threats, like a thief, a nosy friend or a lost phone. But forensic tools and sophisticated attackers target the state after the first unlock, because the keys are already in memory. If they can find a flaw that gets them past the lock screen, the data is ready to read.

Before the first unlock, there’s nothing to read without the PIN. That’s the strongest position your data can be in.

When to restart on purpose

Turning the phone off, or restarting it and leaving it at the lock screen, is a cheap habit worth adopting when your phone is about to leave your control:

• Before a border crossing, when the phone may be taken from you. See crossing a border with your phone.
• Before handing it in for repair, if you aren’t asked to unlock it. See protecting photos before a repair.
• At a protest or event where phones are snatched or confiscated.
• When you’ll leave it somewhere, like a hotel safe or a locker.

Many phones also have a quick lockdown option in the power menu that turns off face and fingerprint unlock until the next PIN entry. It’s useful, but a restart goes further.

Phones that restart themselves

Android now does this for you. Advanced Protection includes Inactivity Reboot, which restarts the phone if it stays locked for 72 hours, making user data unreadable until the next unlock. See Android Advanced Protection explained. If your phone ever greets you by asking for your PIN for no clear reason, an automatic restart is the likely cause.

What a restart doesn’t fix

• A PIN that someone knows. If they can unlock it, they get everything.
• A short PIN. Four digits can be guessed quickly if an attacker can get around the phone’s limit on attempts. Six or more digits, or a passphrase, hold up much better.
• What’s already left the phone. Photos synced to a cloud account are protected by that account, not your phone.
• Spying apps. They run after you unlock, like any other app.

A second layer for the most private things

The keys in memory after the first unlock open almost everything at once. Some apps add their own layer, with a separate key that’s only loaded while you use them. Silo, coming soon to iPhone and Android, encrypts imported photos and files with a key from its own PIN, and locking Silo clears its keys from memory. So even on a phone that’s been unlocked, the vault stays sealed until you open it.