Bootloader
Definition
Firmware that runs immediately after power-on to verify, load, and hand control to the operating system. A locked bootloader refuses to execute unsigned or modified OS images, blocking many physical acquisition approaches that depend on booting custom recovery software.
- Function
- Verifies and loads the operating system at power-on
- Locked state
- Refuses unsigned or modified OS images
- Forensic impact
- Blocks acquisition methods needing a custom recovery boot
- Common bypass route
- Chip-off extraction or a device-specific exploit
Common questions
Why does a locked bootloader complicate physical acquisition specifically?+
Physical acquisition methods often rely on booting a custom recovery image to gain low-level access to flash memory before the operating system's own protections engage. A locked bootloader rejects any image not signed by the manufacturer, so that route is closed unless an examiner has a signed image or a bypass exploit.
Does an unlocked bootloader mean the device data is unencrypted?+
No, these are separate protections. An unlocked bootloader lets a custom image run, but the device's storage may still be encrypted at rest, so an examiner may gain low-level hardware access while the actual file contents remain unreadable without the decryption key.
Related terms
- Chip-Off Acquisition
- A physical extraction method in which the flash memory chip is desoldered from the device's circuit board and read directly with specialised...
- EDL Mode (Emergency Download Mode)
- A Qualcomm diagnostic protocol embedded in the Primary Boot Loader (PBL) that activates before the main OS and accepts raw memory read...
- File-Based Encryption (FBE)
- An Android encryption model introduced in Android 7.0 in which each file is encrypted with a separate key derived from the user...
- Full-Disk Encryption (FDE)
- A storage protection model in which the entire partition is encrypted with a key derived from the user's passcode and hardware-bound identifiers....
- NAND Flash
- The type of non-volatile memory used in all modern mobile device storage. Data is written to pages grouped into blocks; erasure operates...