I believe by “first unlock” they mean a login/unlock right after a reboot. So - turn on device, do first unlock, then lock again.
Might be wrong, but afaik the very first unlock after a reboot is bit different then subsequent unlocks (I guess cached memory etc)
Yup. it's exactly this. After first unlock, data is decrypted and loaded into memory. You shouldn't be able to extract it though, without unlocking the device.
