Lifting USB Restricted Mode with Belkasoft

Every digital forensic investigator knows what this screen means:

It means end of the investigation—at least in some cases. The phone is locked—and it might not even charge. This is called "USB restricted mode" and it introduced severe challenges to DFIR investigations.

Belkasoft X supports lifting restricted mode. The product gets past the restrictions automatically during the acquisition process. No manual or complicated maneuvers are required from you.

This function is extremely useful in situations where you do not have the passcode to the device. Otherwise—if you had the passcode, you could just unlock the phone (to avoid dealing with USB restricted mode)—and you could acquire data in AFU. Now, even when you lack the passcode and USB restricted mode is in effect on the device, you will be able to acquire data in BFU—if you have Belkasoft's tool.

BFU acquisition can still provide you a lot of data. Here, you can see the results from one of our experiments—Belkasoft's checkm8-based acquisition from the same iPhone with and without the passcode:

Supported models and versions of iOS are exactly the same as for checkm8.

Read our article on dealing with Apple's USB restricted mode.

See also