Heading back to the U.S.? 🇺🇸
Stop deleting everything. A blank phone is a massive red flag to Customs. 🚩
I’ve updated the Travel Mode Protocol with new forensic protections based on 2026 learnings:
1️⃣ Android: Use the "Cold Switch" method. This keeps your main encryption keys out of RAM (BFU state).
2️⃣ iOS: You MUST Disable Face ID. This forces the "Hidden" folder to use a Passcode (which has 5th Amdt protection).
See the step-by-step guides attached 👇🏾
@virtuous_sloth @chriscorrigan
You are right: "Logout" ≠ "Wipe." Cached images often persist on disk.
However, the "Cold Switch" (BFU State) neutralizes this.
When Powered Off (BFU), that cache is Encrypted. Even if the files exist, forensic tools (like Cellebrite) cannot read them because the decryption keys were wiped from RAM at shutdown.
Source on BFU/Encryption:
https://teeltechcanada.com/understanding-mobile-device-lock-states-in-forensic-extractions/
@chriscorrigan
sources
☁️ Data: CBP Directive 3340-049A (Sec 5.1.2) prohibits accessing data stored solely on the cloud.
https://www.dhs.gov/sites/default/files/publications/CBP%20Directive%203340-049A_Border-Search-of-Electronic-Media.pdf
Bio: United States v. Brown (D.C. Cir. 2025). The court ruled that compelled biometric unlocking IS testimonial (5th Amdt violation), splitting from older 9th Cir rulings.
https://www.arnoldporter.com/en/perspectives/advisories/2025/03/when-your-fingers-do-the-talking
Forensics: The 'Cold Switch' puts the device in BFU (Before First Unlock) state, where encryption keys are not yet loaded in RAM.
https://teeltechcanada.com/understanding-mobile-device-lock-states-in-forensic-extractions/
Durrell
@ChrisCorrigan has moved
Bruce Elrick