Every digital forensic investigator knows what this screen means:
It means end of the investigation—at least in some cases. The phone is locked—and
it might not even charge. This is called "USB restricted mode" and it introduced
severe challenges to DFIR investigations.
Belkasoft Evidence Center (BEC) with checkm8 supports lifting restricted mode.
Starting build 5401 of Belkasoft Evidence Center version 9.9800 and Belkasoft X version 1.0, the product now gets past the restrictions
automatically during the acquisition process. No manual or complicated maneuvers
are required from you.
The new function is extremely useful in situations where you do not have the
passcode to the device. Otherwise—if you had the passcode, you could just unlock
the phone (to avoid dealing with USB restricted mode)—and you could acquire data
in AFU. Now, even when you lack the passcode and USB restricted mode is in effect
on the device, you will be able to acquire data in BFU—if you have Belkasoft’s tool.
BFU acquisition can still provide you a lot of data. Here, you can see the results
from one of our experiments—Belkasoft’s checkm8-based acquisition from the same
iPhone with and without the passcode:
Supported models and versions of iOS are exactly the same as for checkm8, that
is, iPhone 5S through X and iOS 12.0 to 14.8.
Read our article on dealing with Apple's USB restricted mode.
See also:
