Before we dive into forensic techniques and acquisition methods, it's important to know the different operating modes of an iOS device. Many forensic tools and methods require you to place the device in one of the operating modes. Understanding the iOS device's operating modes is required in order to perform a particular action on the device.

While most commercial tools will demonstrate the proper steps to get the device in a particular mode, you must understand what that mode represents. iOS devices are capable of running in different operating modes: normal mode, recovery mode, and Device Firmware Update (DFU) mode. Some forensic tools require you to know which mode the device is currently utilizing. We will define each mode in this section.