Practical Mobile Forensics
上QQ阅读APP看书,第一时间看更新

DFU mode

During the boot-up process, if the Boot ROM is unable to load or verify the LLB or iBoot (on newer devices), the iPhone enters Device Firmware Upgrade (DFU) mode. DFU mode is a low-level diagnostic mode and is designed to perform firmware upgrades for iPhones.

To enter DFU mode, perform the following steps for iPhone 8 and later:

  1. Connect the device to your workstation via a USB cable.
  2. Press the Volume Up button and quickly release it.
  3. Press the Volume Down button and quickly release it.
  4. Hold the Side button and press the Volume Down button again.
  5. After 5 seconds, release the Side button, but continue holding the Volume Down button until you see the Recovery screen.

Follow these steps for iPhone 7:

  1. Connect the device to your workstation via a USB cable.
  2. At the same time, press and hold the Side and Volume Down buttons.
  3. Release the Side button, but continue to hold the Volume Down button until you see the Recovery screen.

Follow these steps for iPhone 6s and earlier:

  1. Connect the device to your workstation via a USB cable.
  2. At the same time, press and hold the Home and the Top (or Side) buttons.
  3. Release the Top (or Side) button and continue holding the Home button. 
On iPhone 6s and earlier, nothing will be displayed on the screen when the device is in DFU mode.

To verify whether the iPhone is in DFU mode on macOS, launch a System Report and go to the USB option. You should see something similar to the following screenshot:

The MacBook system information displaying a device in DFU mode

Next, we will have a quick look at the tools that are required to set up the forensic environment.