DFU mode

During the boot-up process, if the Boot ROM is not able to load or verify the LLB, then the iPhone displays a black screen. This mode is known as Device Firmware Upgrade (DFU) mode. DFU mode is a low-level diagnostic mode and is designed to perform firmware upgrades for the iPhone. During a firmware upgrade, the iPhone goes through a different boot sequence, as shown in the following figure. Most forensic tools use DFU mode to perform a physical acquisition on old iOS devices (iPhone 4 and older).

A secure boot chain of an iPhone in DFU mode

In DFU mode, the Boot ROM boots first, which, in turn, verifies and runs the second-stage ...

Get Practical Mobile Forensics - Third Edition now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.