I would suggest doing some reading on AFU (After First Unlock) and BFU (Before First Unlock) unlocked states. In short, BFU is when you restart your phone witho

I would suggest doing some reading on AFU (After First Unlock) and BFU (Before First Unlock) unlocked states. In short, BFU is when you restart your phone without unlocking it: the decryption keys for the user storage are unknown until your credentials are entered. When your device is locked after a restart, you're in AFU mode where the decryption keys are stored in memory. Devices such as Cellebrite use exploits to extrapolate the decryption key from memory, then use that key on the user storage. This is fundamentally how those tools work. If the device is in BFU, they can't collect nearly as much data. TL;DR: if you're under threat of having your device taken from you, restart it!