Operating modes of iOS devices
Before we dive into the forensic techniques and acquisition methods, it is important to know the different operating modes of an iPhone. Many forensic tools and methods require you to place the device into one of the operating modes. Understanding the iOS device operating modes is required in order to perform a particular action on the device. iOS devices are capable of running in different operating modes: normal mode, recovery mode, and DFU mode. Most forensic tools require the examiner to know which mode the device is currently utilizing. We will define each mode in this section. When the term "iPhone" is referenced, it should be understood that the statement remains true for all iOS devices.
Normal mode
When an iPhone is switched on, it is booted to its operating system. This mode is known as normal mode. Most of the regular activities (calling, texting, and so on) performed on an iPhone will be run in normal mode.
When an iPhone is turned on,...