Before we dive into the forensic techniques and acquisition methods, it is important to know the different operating modes of an iOS device. Many forensic tools and methods require you to place the device into one of the operating modes. Understanding the iOS device's operating modes is required in order to perform a particular action on the device.
While most commercial tools will demonstrate the proper steps to get the device into a particular mode, the examiner must understand what that mode represents. iOS devices are capable of running in different operating modes: the normal mode, the recovery mode, and the DFU mode. Some forensic tools require the examiner to know which mode the device is currently utilizing. We will define each mode in this section.
