A forensic analysis of GrapheneOS

The investigator's friend and foe: A forensic analysis of GrapheneOS - ScienceDirect

Overall, we find that GrapheneOS differs from Android devices in a way that makes potential methods of successfully acquiring data, such as enlisting the help of third-party providers or brute-forcing the device's user credentials, considerably more difficult. Data access through using a device's backup functionality is also significantly impeded since the developers implement their own encrypted backup strategy. So overall, depending on the use case, GrapheneOS may rightfully be called both the friend and the enemy of lawful investigations.