Cellebrite is the best-known vendor of forensic extraction software, used by law enforcement agencies worldwide to read data off seized smartphones. Several leaked internal Cellebrite capability matrices give an unusually concrete look at how well that actually works against GrapheneOS.
BFU and AFU: the two decisive device states
Forensic capabilities are usually assessed in two states:
- BFU (Before First Unlock) — the device has not been unlocked a single time since its last reboot. Storage is fully encrypted.
- AFU (After First Unlock) — the device has been unlocked at least once but is still running (e.g. when it is seized while powered on).
According to the leaked documents, current Pixel devices (Generation 6a and newer) running GrapheneOS are far more resistant to Cellebrite in both states than practically any other Android setup — at the current security patch level, both BFU and AFU are considered inaccessible to the usual extraction methods.
The crucial caveat: the patch level is what matters
An older, likewise leaked capability matrix showed that Cellebrite still had access to GrapheneOS devices stuck on a 2022 security patch level. In practice, though, that affects almost no one: GrapheneOS enforces monthly security updates and deliberately makes it hard for users to run outdated versions for months on end. A device kept up to date does not fall under this older weakness.
Lost capabilities: Full File System Extraction
A Cellebrite matrix leaked in October 2025 further suggests that Cellebrite has by now lost the ability to perform a full file system (FFS) extraction on unlocked, current GrapheneOS devices — a step backwards compared to older Cellebrite versions.
What this means for you
An important point for context: this is a snapshot, not a permanent promise. Forensics vendors and operating-system developers are locked in a constant arms race — new exploits and new hardening measures keep trading places. What the leaked documents do prove, however: GrapheneOS at a current patch level is, by today's public state of knowledge, among the most forensically resistant configurations available to end users — clearly ahead of unmodified stock Android.
Every SaferPhone runs GrapheneOS and ships with the latest security updates. For more on the technical background, see our article What is GrapheneOS?
Sources: Privacy Guides Community — Claims made by forensics companies, Osservatorio Nessuno — Demystifying phone unlocking tools, CyberSecureFox — Leaked Cellebrite Briefing